phpstudy backdoor vulnerability reproducibility

Some time ago phpstudy was found in some versions of the back door, and it was as many broilers up to two years

Back door hidden in the program comes with php of php_xmlrpc.dll module

Version impact: phpstudy2016 and 2018

 

In H: \ PhpStudy20180211 \ PHPTutorial \ php \ \ ext php-5.2.17 find php_xmlrpc.dll

 

With notepad ++ open, Ctrl + f search eval

 

 

 

 

 

Description This version of phpstudy by the back door

 

With firefox access the local IP , with bp capture, with ctrl + r to the repeater

 

 

 

 

 

 

 

 

 

 

Find the Accept-encoding , the deleted space after the comma, the deflate behind the carriage return line, plus the Accept-charset : c3lzdGVtKCdpcGNvbmZpZycpIDs = , then go

 

(This is the system ( 'ipconfig'); the base64 encryption)

 

 

 

 

 

Vulnerabilities recurring success

 

Plus System ( 'path'); (semicolon in front of spaces)

 

 

 

Security issues can not be underestimated ah

 

Guess you like

Origin www.cnblogs.com/shayanboy/p/11605565.html