WebShell Traffic Characterization_Godzilla

IV. Godzilla (Godzilla v3.0)

① All types of shells can bypass most of the static checks on the market.

②Traffic encryption bypasses most traffic waf

③Godzilla comes with a plug-in that Ice Scorpion and Ant Sword can't match.

1. Main functions

The functions it can realize besides the traditional command execution, file management, and database management, depending on the shell type:

(1) MSF Linkage

(2) Bypassing OpenBasedir

(3) ZIP compression ZIP decompression

(4) Code execution

(5) Bypassing DisableFunctions

（6）Mimikatz

(7) Read the configuration information of the server FileZilla Navicat Sqlyog Winscp XMangager and its password.

(8) Virtual terminal can be connected with netcat.

(9) Windows Elevation of Privilege (2012-2019 Rotten Potatoes)

(10) Read the account password saved by the server Google IE Firefox browser

(11) Windows Privilege Elevation Rotten Potatoes C# Version Sweet Potatoes

(12) Support Godzilla, Scorpion, Chopper, ReGeorg's memory shell and uninstallation.

(13) Screenshots

(14) Servlet Management Servlet Uninstallation

(15) Memory Load Jar Load Jar to SystemClassLoader

2. Basic configuration

Let's start with the most used encrypted shell of type PHP_XOR_BASE64. The main configuration of the shell used is as follows:

①URL：http://172.16.159.129/godzilla_shell.php

②Password: pass

③Key: key

④ Payload: PhpDynamicPayload

⑤ Encryptor: PHP_XOR_BASE64

⑥ Godzilla's Shell configuration includes basic configuration and request configuration, where the basic configuration mainly sets the shell address, password, key, encryptor and other information

Note the difference between a password and a key here:

① password: and ant sword, chopper, the password is the name of the parameter in the POST request, in this case Godzilla submitted each request is pass = xxxxxxxxxx such form

② Key: used to encrypt the requested data, however, the encryption process does not directly use the key plaintext, but calculates the md5 value of the key and then takes itsahead16-bitFor encryption processes

③ Godzilla shell request configuration is mainly used to customize the HTTP request header, as well as in the final request data around and then append some scrambled data to further reduce the characteristics of the traffic

3. PHP_XOR_BASE64 encryptor

Godzilla has 3 built-in Payloads as well as 6 encryptors, 6 support script suffixes, 20 built-in plug-ins, the following are mainly based on thePHP_XOR_BASE64 is analyzed as an example.

(1) Principle of encryption

XOR operation

XOR encryption

(2) Client-side encryption module analysis

(3) Shell server-side code analysis

PHP_XOR_BASE64The server-side code for an encrypted shell of typeencodefunction to encrypt or decrypt the request data. Since the encryption is achieved by bitwise dissimilarity, theencodeFunctions can be used for encryption as well as decryption.

The basic execution process of the shell is: the server receives the first request sent by Godzilla, because at this time the session has not been established, so the POST request data decrypted (the contents of the shell operations need to be used in the definition of the relevant php function code) into the session, the subsequent Godzilla will only be submitted to the relevant operation of the correspondingThe name of the function (e.g., the function corresponding to getting a list of files in a directory is getFile) and the related parameters, so that Godzilla's related operations do not need to send a lot of request data.

(4) Packet analysis

①The first Request request packet

② The first Response response packet

③The second Request request packet

④The second Response response packet

⑤ Third Request packet

⑥The third Response response packet

4. PHP_EVAL_XOR_BASE64 encryptor

5、PHP_XOR_RAWencryptor

6. Rules on the ground

alert http any any -> any any (msg:"Godzilla/Godzilla PHP Base64 Connection Successful!";
flow:established,from_server;
flowbits:txisset,Godzilla_webshell_request_match;
;
content:"Rising", negate;
http.response_body;
bsize:36;
pcre:"/^([0-9A-F]{16}|[0-9a-f]{16})/";
pcre:"/([0-9A-F]{16}|[0-9a-f]{16})$/";
pcre:"/^[\s\S]{16}(.*)[\s\S]{16}$/";
pcrexform:"^[\s\S]{16}(.*)[\s\S]{16}$";
pcre:"/[\s\S]/";
base64;
flowbits:unset,Godzilla_webshell_request_match;
)

• alert http any any -> any any Indicates that an alert is generated for any HTTP traffic between the source and destination IPs.
• msg: "Godzilla/Godzilla PHP Base64 Connection Successful" is a descriptive message for the alert.
• flow:from server,established Indicates that only traffic from the server side with an established connection is detected.
• flowbits:isset,Godzilla webshell request match Checks if the flow status bit named "Godzilla webshell request match" is set. (Note the use of isset instead of txisset).
• Indicates that only HTTP server responses are examined.
• content:!" Rising" means that the string "Rising" is not included in the HTTP response body.
• body Indicates that the body portion of the HTTP response is examined.
• bsize:36 Specifies that only the first 36 bytes of the response body are detected.
• pcre:"/^([0-9A-F]{16}|[0-9a-f]{16})/" and pcre:"/([0-9A-F]{16}|[0-9a-f]{16})$/" Use Perl-compatible Regular Expressions (PCRE) to detect if the response body starts and ends with 16 hexadecimal characters.
• pcre:"/^[\s\S]{16}(. *)[\s\S]{16}$/" and pcrexform:"^[\s\S]{16}(. *)[\s\S]{16}$" use PCRE to detect if the response body conforms to a specific pattern, i.e., starts with 16 arbitrary characters, has an arbitrary string as the middle part, and ends with 16 arbitrary characters.
• pcre:"/[\s\S]/" Matches a single arbitrary character surrounded by square brackets in the response body.
• isbase64:3 means decode the matched content in base64, and check whether the number of bytes after decoding is a multiple of 3.
• flowbits: unset,Godzilla webshell request match Clearing a file named"Godzilla webshell request match"stream status bits。