diff --git a/vulnerabilities/other/antsword-backdoor.yaml b/vulnerabilities/other/antsword-backdoor.yaml index 6e3641e755..6202b0feb0 100644 --- a/vulnerabilities/other/antsword-backdoor.yaml +++ b/vulnerabilities/other/antsword-backdoor.yaml @@ -1,13 +1,12 @@ id: antsword-backdoor info: - name: AntSword_bypass_disable_functions_shell + name: Antsword backdook author: ffffffff0x severity: critical - description: | - 蚁剑「绕过 disable_functions」插件生成的 shell + description: 蚁剑「绕过 disable_functions」插件生成的 shell reference: https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/9 - tags: backdoor + tags: backdoor,antsword requests: - method: POST @@ -15,25 +14,15 @@ requests: - "{{BaseURL}}/.antproxy.php" headers: Content-Type: application/x-www-form-urlencoded - body: 'ant=phpinfo();' + body: 'ant=echo md5("antproxy.php");' matchers-condition: and matchers: - type: word + part: body words: - - "PHP Extension" - - "PHP Version" - - "Zend" - - "探针" - condition: or + - "951d11e51392117311602d0c25435d7f" - type: status status: - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - '>PHP Version <\/td>([0-9.]+)'