Finger
一只孤独的代码狗/程序猿/攻城狮

一.基础环境

[AppleScript] 纯文本查看 复制代码
1
2
3
4
5
#!bash
apt-get install php5
apt-get install php5-dev
apt-get install apache
apt-get install mysql

二.使用PHPTracert

[AppleScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
#!bash
mkdir godhead
wget [url]https://github.com/Qihoo360/phptrace/archive/v0.3.0.zip[/url]
unzip v0.3.0.zip
cd ./phptrace-0.3.0/extension
phpize5
./configure --with-php-config=/usr/bin/php-config
make & make install
cd ../cmdtool
make

编辑php.ini,增加:

[AppleScript] 纯文本查看 复制代码
1
2
#!bash
extension=trace.so

三.测试

[AppleScript] 纯文本查看 复制代码
1
2
3
4
5
6
7
#!php
<?php
for($i=0;$i<100;$i++){
    echo $I;
    sleep(1);
}
?>

CLI

[AppleScript] 纯文本查看 复制代码
1
2
3
4
#!shell
php test.php &
ps -axu|grep php
./phptrace -p pid

apache

[AppleScript] 纯文本查看 复制代码
1
2
3
4
#!bash
curl 127.0.0.1/test.php
ps -aux|grep apache
./phptrace -p pid

四.phptrace分析

执行的代码如下:

[AppleScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
#!php
<?php
function c(){
    echo 1;
}
function b(){
    c();
}
function a(){
    b();
}
a();
?>

执行顺序是:

[AppleScript] 纯文本查看 复制代码
1
2
#!bash
a>b>c>echo

 

参数含义:

[td]

[AppleScript] 纯文本查看 复制代码
1
2
3
4
5
6
7
8
9
#!js[/td][/tr]
[/table]{"seq":0, "type":1, "level":1, "func":"{main}", "st":1448387651119445, "params":"", "file":"/var/www/html/2.php", "lineno":11 }
{"seq":1, "type":1, "level":2, "func":"a", "st":1448387651119451, "params":"", "file":"/var/www/html/2.php", "lineno":11 }
{"seq":2, "type":1, "level":3, "func":"b", "st":1448387651119452, "params":"", "file":"/var/www/html/2.php", "lineno":9 }
{"seq":3, "type":1, "level":4, "func":"c", "st":1448387651119453, "params":"", "file":"/var/www/html/2.php", "lineno":6 }
{"seq":4, "type":2, "level":4, "func":"c, "st":1448387651119457, "return":"NULL", "wt":4, "ct":4, "mem":48, "pmem":144 }
{"seq":5, "type":2, "level":3, "func":"b, "st":1448387651119459, "return":"NULL", "wt":7, "ct":6, "mem":48, "pmem":144 }
{"seq":6, "type":2, "level":2, "func":"a, "st":1448387651119459, "return":"NULL", "wt":8, "ct":8, "mem":80, "pmem":176 }
{"seq":7, "type":2, "level":1, "func":"{main}, "st":1448387651119460, "return":"1", "wt":15, "ct":14, "mem":112, "pmem":208 }

五.逻辑分析1.解析监控进程

开一个后台进程一直刷新进程列表,如果出现没有tracer的进程就立即进行托管

2.json提取

通过对每一个文件的json进行提取,提取过程如下:

  • 便利所有文件
  • 读读取文件
  • 提取json,按照seq排序
  • 提取type=2的与type=1的进行合并
  • 按照level梳理上下级关系存储同一个字典
  • 按照seq排序,取出头函数进行输出
  • 提取恶意函数往上提取level直到level=0

函数对应如下:

[AppleScript] 纯文本查看 复制代码
1
2
3
4
5
6
7
8
9
#!python
list1={
     level1:[seq,type,func,param,return]
     level2:[seq,type,func,param,return]
     level3:[seq,type,func,param,return] #eval
     level4:[seq,type,func,param,return]
}
list2=

3.数据查看

通过追踪危险函数,然后将其函数执行之前的关系梳理出来进行输出,然后再进行人工审查。

放上demo

六.使用XDEBUG安装

[AppleScript] 纯文本查看 复制代码
1
2
#!bash
apt-get install php5-xdebug

修改php.ini

[AppleScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
#!bash
[xdebug]
zend_extension = "/usr/lib/php5/20131226/xdebug.so"
xdebug.auto_trace = on
xdebug.auto_profile = on
xdebug.collect_params = on
xdebug.collect_return = on
xdebug.profiler_enable = on
xdebug.trace_output_dir = "/tmp/ad/xdebug_log"
xdebug.profiler_output_dir = "/tmp/ad/xdebug_log"

放上几个demo图片:

七.优缺点缺点

人为参与力度较大,无法进行脱离人工的操作进行独立执行。

优点

精准度高,对于面向对象和面向过程的代码都可以进行分析。

0x01 语法分析(静态分析)


案例:

一.使用php-parser介绍:

二.安装

[AppleScript] 纯文本查看 复制代码
1
2
3
#!shell
git clone [url]https://github.com/nikic/PHP-Parser.git[/url] & cd PHP-Parser
curl -sS [url]https://getcomposer.org/installer[/url] | php

PHP >= 5.3; for parsing PHP 5.2 to PHP 5.6

[AppleScript] 纯文本查看 复制代码
1
2
#!bash
php composer.phar require nikic/php-parser

PHP >= 5.4; for parsing PHP 5.2 to PHP 7.0

[AppleScript] 纯文本查看 复制代码
1
2
#!bash
php composer.phar require nikic/php-parser 2.0.x-dev

三.测试

[AppleScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
#!php
<?php
include 'autoload.php';
use PhpParser\Error;
use PhpParser\ParserFactory;
$code = '<?php  eval($_POST[c][/c])?>';
$parser = (new ParserFactory)->create(ParserFactory::PREFER_PHP7);
try {
    $stmts = $parser->parse($code);
    print_r($stmts);
    // $stmts is an array of statement nodes
} catch (Error $e) {
    echo 'Parse Error: ', $e->getMessage();
}

输出如下:

[AppleScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#!js
Array
(
    [0] => PhpParser\Node\Expr\Eval_ Object
        (
            [expr] => PhpParser\Node\Expr\ArrayDimFetch Object
                (
                    [var] => PhpParser\Node\Expr\Variable Object
                        (
                            [name] => _POST
                            [attributes:protected] => Array
                                (
                                    [startLine] => 1
                                    [endLine] => 1
                                )
                        )
                    [dim] => PhpParser\Node\Expr\ConstFetch Object
                        (
                            [name] => PhpParser\Node\Name Object
                                (
                                    [parts] => Array
                                        (
                                            [0] => c
                                        )
                                    [attributes:protected] => Array
                                        (
                                            [startLine] => 1
                                            [endLine] => 1
                                        )
                                )
                            [attributes:protected] => Array
                                (
                                    [startLine] => 1
                                    [endLine] => 1
                                )
                        )
                    [attributes:protected] => Array
                        (
                            [startLine] => 1
                            [endLine] => 1
                        )
                )
            [attributes:protected] => Array
                (
                    [startLine] => 1
                    [endLine] => 1
                )
        )
)

由此可见,我们需要提取出

[AppleScript] 纯文本查看 复制代码
1
2
3
4
5
6
7
#!js
[0] => PhpParser\Node\Expr\Eval_ Object
[name] => _POST
[parts] => Array
                                        (
                                            [0] => c
                                        )

然后进行拼接之后即可发现原始语句是:

[AppleScript] 纯文本查看 复制代码
1
2
#!php
eval($_POST[c][/c])

四.逻辑分析代码解析

  • 通过该库进行语法分析
  • 提取结果
  • 提取危险函数
  • 提取危险函数中存在的变量
  • 从上文中提取此变量的赋值方式
  • 分析出可控结果
  • 输出结果

五.优缺点缺点

对于面向对象的程序进行分析比较弱。

优点

适合大批量的自动化分析,可以脱离人工操作进行独立执行

这篇文章有人发言喽~

  1. I hate my life but at least this makes it beberala.

    Leatrix

    2016/12/27

    @Ta
    #1

发表评论