企业资讯
- 企业新闻
- 行业文章

针对weevely的一处细节的修改

weevely是一款常用的命令行下的webshell连接工具,因为具有大量自动化的模块能大大提高渗透的效率而广为各种入侵爱好者使用.今天看了下源码,发现其中一个很有意思的特点,core/http/request.py这个文件,其中有一个随机数组

 agent = choice(( “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6″, “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)”, “Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0″, “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)”, “Opera/9.20 (Windows NT 6.0; U; en)”, “Opera/9.00 (Windows NT 5.1; U; en)”, “Googlebot/2.1 ( http://www.googlebot.com/bot.html)”, “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.95 Safari/537.11″, “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.17 (KHTML, like Gecko) Version/6.0.2 Safari/536.26.17″, “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0″, “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11″, “Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91)”, ))

agent = choice((

“Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6″,

“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)”,

“Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0″,

“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)”,

“Opera/9.20 (Windows NT 6.0; U; en)”,

“Opera/9.00 (Windows NT 5.1; U; en)”,

“Googlebot/2.1 ( http://www.googlebot.com/bot.html)”,

“Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.95 Safari/537.11″,

“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.17 (KHTML, like Gecko) Version/6.0.2 Safari/536.26.17″,

“Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0″,

“Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11″,

“Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91)”,

))

好多过时的agent头啊,我尝试找了下,好几款浏览器连下载地址都没有,如果防火墙拦截了这些http头,不仅不会影响用户使用,反而会阻止weevely的工作.所以我们一不做二不休,直接改成这样

 agent = choice(( “Googlebot/2.1 ( http://www.googlebot.com/bot.html)”, ))

agent = choice((

“Googlebot/2.1 ( http://www.googlebot.com/bot.html)”,

))

只出现一个谷歌蜘蛛的agent,这下子投机取巧的防火墙就没戏鸟.

相关文章：《免杀shell-weevely分析》

日币奖励：

本文为工具发布且为原创、首发，给予日币奖励共5枚。

AD：本站开放投稿及积分（日币），日币可兑换实物奖励，每月top3可获得礼品一份。

详情请看：积分规则及日币超市

鸿大千秋网站建设团队敬上