冰蝎shell_冰蝎2和3及哥斯拉Godzilla特征分析

最新推荐文章于 2025-03-17 12:13:58 发布

weixin_39975122

最新推荐文章于 2025-03-17 12:13:58 发布

阅读量1.8k

点赞数 1

文章标签：冰蝎shell

本文链接：https://blog.youkuaiyun.com/weixin_39975122/article/details/112325016

版权

冰蝎2

冰蝎是一款基于Java开发的动态加密通信流量的新型Webshell客户端。

冰蝎工具通信原理

冰蝎的通信过程可以分为两个阶段：

密钥协商

加密传输

1)第一阶段-密钥协商

a.php

攻击者通过GET方式请求服务器密钥；

GET /hackable/uploads/shell.php?pass=300 HTTP/1.1

当我们输入命令操作后，请求方式就会变成POST

POST /hackable/uploads/shell.php HTTP/1.1Content-Type: application/x-www-form-urlencodedCookie: PHPSESSID=lsgi7fb09enqcn3svmti4eqbo7; path=/User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1Cache-Control: no-cachePragma: no-cacheHost: 192.168.0.129:777Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-aliveContent-Length: 1112hxx/2GPvW+iHRI+j7FKIjpbHv6JcLQzyNs8uQ1IPDTB2xcS5+oKiaSKujjcZ/uYLEwn6oA8a1YehtGbT9arlXe3LaA0kig9BITcK3iZZKYhjpK0/ziTfTa5CnU3lfrnmCcadnmtgUKyTZDdb93DSqwyGn3cFb7BuIPkdCu6SpLov3+EExlHPbY/+6PiiDIpWGCxzkEIwli6zJiS8fa4fSxYcr/e0viSLVI3eXHAvhcohXLsVbWV5HmZMovp4EHYkcofLdR7fjx+NZbIfBOTZfzbOTOXBRBI2GBEUZG4uzi7s0xeHzUWeKf/n+CjrCs1OgYT893Q5KyRSr9+wn3Gi8JfDYPKCady

b.jsp

先通过GET方法，向服务器请求随机密钥

GET /s.jsp?pass=987 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Host: 192.168.0.132:555Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-aliveHTTP/1.1 200 OKServer: Apache-Coyote/1.1Set-Cookie: JSESSIONID=D89B13E292E0D8D7CD9433522F293EDB; Path=/; HttpOnlyContent-Type: text/html;charset=ISO-8859-1Content-Length: 16   Date: Wed, 18 Nov 2020 12:32:58 GMT9e39ae1ad6ee9e32  //服务器返回的密钥

同样输入命令后，也和PHP一样，请求方式就变成了POST

POST /s.jsp HTTP/1.1Content-Type: application/octet-streamCookie: JSESSIONID=D89B13E292E0D8D7CD9433522F293EDB; Path=/; HttpOnlyUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Cache-Control: no-cachePragma: no-cacheHost: 192.168.0.132:555Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-aliveContent-Length: 855675Zv64K/CymLAnv5UhDhKfJdj58rU1o/0yZ7D0XlJU7MgTbzaA4zrvImnNs1Y1cmNPGAdxaaEaYxvasJSp2sCHk5TPv+fWunDMvZWoBqjcnkHGMYyohZpH1v7OvWcdAZPg7CIL87y9HPc2lydWTiBVspavD0FkRVY7/