Update antsword-backdoor.yaml

vulnerabilities/other/antsword-backdoor.yaml

@@ -1,13 +1,12 @@
 id: antsword-backdoor
 
 info:
-  name: AntSword_bypass_disable_functions_shell
+  name: Antsword backdook
   author: ffffffff0x
   severity: critical
-  description: |
+  description: 蚁剑「绕过 disable_functions」插件生成的 shell
-    蚁剑「绕过 disable_functions」插件生成的 shell
   reference: https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/9
-  tags: backdoor
+  tags: backdoor,antsword
 
 requests:
   - method: POST
@@ -15,25 +14,15 @@ requests:
       - "{{BaseURL}}/.antproxy.php"
     headers:
       Content-Type: application/x-www-form-urlencoded
-    body: 'ant=phpinfo();'
+    body: 'ant=echo md5("antproxy.php");'
 
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
-          - "PHP Extension"
+          - "951d11e51392117311602d0c25435d7f"
-          - "PHP Version"
-          - "Zend"
-          - "探针"
-        condition: or
 
       - type: status
         status:
           - 200
-
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '>PHP Version <\/td><td class="v">([0-9.]+)'