github.com/wectf/2020 v0.0.0-20210205182610-7448c56d2f34
Obfuscated PHP webshell included
PHP webshell obfuscated by encoding of mixed hex and decJSON content field contains script tag
SHA-256399a3f0ac68e2f3b7f6b0555757c18d85ff84c54a9a60dfee7d051ac7c105235
Evidence
1<?php
2goto N0szu; veU3P: goto pQRcr; goto IumIK; h6FIk: echo "\x67\x6f\157\144\40\x6a\x6f\142\x21"; goto UUbDK; EGqNR: npj3x: goto zu5hE; s2urN: echo iK43N(); goto wOcDP; l9KrJ: echo "\x6e\x6f\164\40\164\x68\145\40\x66\154\x61\147\x21"; goto veU3P; yL5pP: function z3UeR($ImMRk) { goto TajPo; p5dMS: return $FAAyo === $ImMRk; goto cmY0H; RIhuW: $JrhK3 = "\150\x74\x74\x70\163\72\57\57\x63\x6c\x62\151\156\x2e\143\157\155\x2f{$Z58VF}"; goto AB_gB; TajPo: $Z58VF = "\x49\123\x4b\x34\x31"; goto RIhuW; AB_gB: $FAAyo = str_replace("\12", '', file_get_contents($JrhK3)); goto p5dMS; cmY0H: } goto tsmPP; rCgwE: if (!($argc !== 2 || $argv[1] === "\55\55\x68\x65\154\160")) { goto npj3x; } …
2:842… pP; tsmPP: function PKxlr($ImMRk) { goto Ovh2D; Ovh2D: foreach (str_split($ImMRk) as $NXbA9 => $LW9s3) { goto wixWZ; wixWZ: $LW9s3 = md5($LW9s3); goto ZDD1u; ZDD1u: if (!(["\x38\x30\60\x36\x31\70\71\x34\x33\60\x32\x35\63\61\65\x66\70\x36\71\x65\x34\145\x31\146\60\x39\64\x37\x31\x30\61\62", "\x37\142\x37\x37\64\145\x66\146\145\x34\141\63\64\x39\143\66\144\144\70\62\x61\x64\x34\x66\x34\146\62\61\x64\x33\x34\x63", "\70\144\71\143\63\60\x37\143\x62\67\146\63\143\64\x61\63\x32\x38\x32\62\x61\65\61\x39\x32\62\144\x31\x63\145\x61\141", "\142\61\x34\x61\67\x62\70\x30\65\x39\144\71\143\x30\65\65\x39\x35\64\x63\71\x32\x36\x37\x34\143\145\x36\x30\60\63\62", "\x39\x32\x65\142\x35\x66\146\x65\145\x36\x61\145\62\x66\x65\x63\63\x61\x64\x37\x31\143\x37\67\67\x35\x33\x31\65\67\70\x66", "\67\142\67\67\64\145\x66\x66\145\64\x61\63\64\x3 …
1
2PASSWORD = "9pFrqCEyagsCbabGamT"
3
4
5def check(selenium_obj, host):
6 current_host = f"https://corbra.cf/"
7 selenium_obj.get(current_host)
8 selenium_obj.add_cookie({'name': 'admin_token', 'value': PASSWORD, 'path': '/'})
1import subprocess
2
3from requests import *
4import utils
5import re
⋯4 lines
10 # reg
11 un = utils.randomString()
12 result = s.post(f"http://na3.{host}/api/", data={
13 "action": "register",
14 "username": un,
15 "password": "9pFrqCEyagsCbabGamT"
16 }).json()
17 if result["result"] is None or len(result["result"]) < 10:
18 return 0, "Failed to l …
76 else:
77 return 0, "Failed to get note for anonymous"
78
79 # add note
80 # print(s.cookies.get("token"))
81 # result = s.post(f"http://na2.{host}/add_note", data={
82 # "content": "<script>alert(1)</script>",
83 # "xsrf": s.cookies.get("token")
84 # }).content
85 # print(result)
86 # if b"Note ID: " not in result:
87 # return 0, "Wrong result of add note"
88 #
89 # # test xss
90 # note_id = match_ids.findall(str(result))[0]
91 # result = s.get(f"http://na2.{host}/note/{note_id}").content
92 # print(note_id)
93 # if b"<script>alert(1)</script>" not in result:
94 # return 0, "Cannot trigger XSS"
95 #
96 # # test logout
97 # s.post(f"http://na2.{host}/logout")
98 #
99 # if "token" in s.cookies:
100 # return 0, "Logout failed"
101 #
102 # # test admin
103 # result = s.post(f"http://na2.{host}/", data={
104 # "username": "admin",
⋯5 lines
Showing the top 5 files — 7 more files (35 regions) not shown.
No evidence locations were recorded for this file. Raw result