网传宝塔0day挂马事件—附检测脚本

GET / HTTP/1.1Host: webmail.zachey.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate

#!/usr/bin/python3# -*- coding: UTF-8 -*-# Author: afei00123
from pocsuite3.api import requestsfrom pocsuite3.api import register_poc,POC_CATEGORYfrom pocsuite3.api import Output, POCBase, loggerimport ssl
ssl._create_default_https_context = ssl._create_unverified_context
class BTPOC(POCBase):    vulID = '0121'    version = '1.0'    author = ['afei00123']    vulDate = '2021-03-08'    createDate = '2021-12-26'    updateDate = '2020-12-27'    references = ['https://www.cnvd.org.cn/flaw/show/']    name = 'Nginx挂马事件'    appPowerLink = 'https://www.bt.cn/bbs'    appName = '宝塔面板'    appVersion = '''All'''    vulType = "guaMa"    desc = '''宝塔面板疑似出现重大安全漏洞。遭到攻击的服务器，Nginx会自动检测header中accept字段是否包含Gzip。如果包含，则会向目标页面中加入一段JS引用，从而实现恶意挂马。'''    samples = ["http://webmail.zachey.com/", "http://sayfetrip.com/"]    category = POC_CATEGORY.EXPLOITS.WEBAPP    #zoomeye: "x67\x65\x74\x4D\x69\x6E\x75\x74\x65\x73"
    def get_headers(self):        headers = {            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0",            "Accept-Encoding": "gzip, deflate",            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"        }        return headers
    def _verify(self):        result = {}        headers = self.get_headers()
        try:            respon = requests.get(self.url, headers=headers, verify=False, timeout=10)            if "\x67\x65\x74\x4D\x69\x6E\x75\x74\x65\x73" in respon.text:                result['VerifyInfo'] = {}                result['VerifyInfo']['URL'] = self.url                result['VerifyInfo']['INFO'] = "您的宝塔面板已被挂马，请使用以下官方脚本登录服务器进行自查："                result['VerifyInfo']['Check Script'] = "n" + '''import os
list1 = ['/var/tmp/systemd-private-56d86f7d8382402517f3b51625789161d2cb-chronyd.service-jP37av','/var/tmp/systemd-private-56d86f7d8382402517f3b5-jP37av','/tmp/systemd-private-56d86f7d8382402517f3b5-jP37av','/var/tmp/count','/var/tmp/count.txt','/var/tmp/backkk','/var/tmp/msglog.txt']sum = 0for i in list1:    if os.path.exists(i):         sum += 1        print("检测到异常木马文件：",i)
if sum == 0: print("没有检测到异常木马文件！")''' + "n"                with open(__file__.replace('.py', '.txt'), 'a+') as f:                    f.write(self.url+ 'n')                    f.close()            else:                logger.info("恭喜您，您的宝塔面板未检测到挂马事件.")        except Exception:            logger.error(f"connect {self.url} faild!!!")        return self.parse_attack(result)
    def _attack(self):        return self._verify()
    def parse_attack(self, result):        output = Output(self)        if result:            output.success(result)        else:            output.fail('Internet nothing returned')        return output
register_poc(BTPOC)

import os
list1 = ['/var/tmp/systemd-private-56d86f7d8382402517f3b51625789161d2cb-chronyd.service-jP37av','/var/tmp/systemd-private-56d86f7d8382402517f3b5-jP37av','/tmp/systemd-private-56d86f7d8382402517f3b5-jP37av','/var/tmp/count','/var/tmp/count.txt','/var/tmp/backkk','/var/tmp/msglog.txt']sum = 0for i in list1:    if os.path.exists(i):         sum += 1        print("检测到异常木马文件：",i)
if sum == 0: print("没有检测到异常木马文件！")