{"id":89,"date":"2022-01-01T22:42:19","date_gmt":"2022-01-01T14:42:19","guid":{"rendered":"https:\/\/www.hm-zy.cn\/?p=89"},"modified":"2022-09-01T22:43:34","modified_gmt":"2022-09-01T14:43:34","slug":"%e5%b8%b8%e8%a7%81%e7%9a%84webshell%e6%b5%81%e9%87%8f%e7%89%b9%e5%be%81","status":"publish","type":"post","link":"https:\/\/www.hm-zy.cn\/?p=89","title":{"rendered":"\u5e38\u89c1\u7684webshell\u6d41\u91cf\u7279\u5f81"},"content":{"rendered":"

\u51b0\u874e\u7279\u5f81<\/h3>\n

\u5f3a\u7279\u5f81\uff1a<\/p>\n

    \n
  1. POST\u8bf7\u6c42content-type<\/li>\n
  2. Accept&Cache-Control<\/li>\n
  3. \u54cd\u5e94\u5934\u7279\u5f81:md5\u524d\u5341\u516d\u4f4d+base64+md5\u540e\u5341\u516d\u4f4d<\/li>\n
  4. \u8bf7\u6c42\u90fd\u542b\u6709"pass="\u7b2c\u4e00\u4e2a\u5305<\/li>\n<\/ol>\n

    \u5f31\u7279\u5f81\uff1a<\/p>\n

      \n
    1. \n

      \u7f51\u7edc\u4e0a\u67e5\u627e\u5185\u7f6e16\u4e2aua\u5934<\/p>\n<\/li>\n

    2. \n

      content-length \u8bf7\u6c42\u957f\u5ea6<\/p>\n<\/li>\n<\/ol>\n

      \u5de5\u4f5c\u539f\u7406\uff1a<\/p>\n

        \n
      1. \n

        \u4e24\u7aef\u5bc6\u94a5\u534f\u5546\uff0c\u4e24\u6b21\u8fd4\u56de\u5305\u4e2d\u7684\u6570\u636e\u4e0d\u540c\u7684\u5730\u65b9\u53d6\u5bc6\u94a5<\/p>\n<\/li>\n

      2. \n

        \u52a0\u5bc6\u4f20\u8f93\uff0c\u4f7f\u7528\u968f\u673a\u6570MD5\u7684\u9ad816\u4f4d\u4f5c\u4e3a\u5bc6\u94a5\u50a8\u5b58\u4f1a\u8bdd\u7684$_SESSION\u53d8\u91cf\u4e2d\uff0c\u8fd4\u56de\u653b\u51fb\u8005\u3002<\/p>\n<\/li>\n<\/ol>\n

        \u54e5\u65af\u62c9\u7279\u5f81<\/h3>\n

        \u5de5\u4f5c\u539f\u7406\uff1a<\/p>\n

          \n
        1. \n

          \u57fa\u4e8e\u6d41\u91cf\uff0cHTTP\u5168\u52a0\u5bc6\u7684webshell<\/p>\n<\/li>\n

        2. \n

          AES\u52a0\u5bc6<\/p>\n<\/li>\n<\/ol>\n

          \u6d41\u91cf\u7279\u5f81\uff1a<\/p>\n

            \n
          1. \n

            \u4f4e\u7248\u672c\u4f1a\u6709\u7279\u5f81\uff0c\u662f\u5f3a\u7279\u5f81\u3002<\/p>\n<\/li>\n

          2. \n

            \u53d1\u9001\u4e00\u6bb5\u56fa\u5b9a\u4ee3\u7801(payload)\uff0chttp\u54cd\u5e94\u4e3a\u7a7a<\/p>\n<\/li>\n

          3. \n

            \u53d1\u9001\u4e00\u6bb5\u56fa\u5b9a\u4ee3\u7801(test)\uff0c\u6267\u884c\u7ed3\u679c\u4e3a\u56fa\u5b9a\u7684\u3002<\/p>\n<\/li>\n

          4. \n

            \u5728\u53d1\u9001\u7591\u7aef\u56fa\u5b9a\u4ee3\u7801(getGacisInfo)<\/p>\n<\/li>\n<\/ol>\n

            \u8681\u5251php\u8fde\u63a5\u7279\u5f81<\/h3>\n
              \n
            1. \n

              php_XOR_BASE64<\/p>\n<\/li>\n

            2. \n

              \u591a\u4e2a\u8bf7\u6c42\u5305\u6709\u591a\u4e2a\u76f8\u540c\u7684\u4f20\u53c2\u5b57\u7b26<\/p>\n<\/li>\n<\/ol>\n

              \u8681\u952e\u6d41\u91cf UA\u8bf7\u6c42\u5934 \u6709antworld \u5b57\u6837<\/p>\n

              \u7ed5\u8fc7\u65b9\u5f0f:<\/p>\n

              1\uff09\u5f00\u542f\u8681\u5251\u4ee3\u7406\u8bbe\u7f6e<\/p>\n

              2\uff09UA\u7279\u5f81\u4f2a\u9020<\/p>\n

              3\uff09RSA<\/a>\u6d41\u91cf\u52a0\u5bc6<\/p>\n

              \u83dc\u5200<\/h3>\n

              caidao=Execute\uff08payload\uff09\u96c6\u4e2d\u4e8ebody eval\u5c11\u6570\u60c5\u51b5\u4f1a\u4f7f\u7528assert\u66ff\u4ee3<\/p>\n","protected":false},"excerpt":{"rendered":"\u51b0\u874e\u7279\u5f81 \u5f3a\u7279\u5f81\uff1a POST\u8bf7\u6c42content-type Accept&Cache-Control \u54cd\u5e94\u5934\u7279\u5f81:md5\u524d\u5341\u516d\u4f4d+base64+md5\u540e\u5341\u516d\u4f4d \u8bf7\u6c42\u90fd\u542b\u6709"pass="\u7b2c\u4e00\u4e2a\u5305 \u5f31\u7279\u5f81\uff1a \u7f51\u7edc\u4e0a\u67e5\u627e…Read more \u00bb<\/a>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-89","post","type-post","status-publish","format-standard","hentry","category-12"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t