PHP webshell免杀技术实践与探索  

Practice and Exploration of PHP Webshell Anti-antivirus Technology

作　　者：陈艺夫 王平 CHEN Yi-fu;WANG Ping(Zhangjiajie Institute of Aeronautical Engineering,Zhangjiajie Hunan 427000,China;Technology and Information Team,Wugang Public Security Bureau of Hunan Province,Shaoyang Hunan 422400,China)

机构地区：[1]张家界航空工业职业技术学院图书信息中心,湖南张家界427000 [2]湖南省武冈市公安局科技与信息大队,湖南邵阳422400

出　　处：《通信技术》2020年第12期3078-3086,共9页Communications Technology

摘　　要：webshell是web攻击者在web攻击阶段可以获得的最有利的工具。传统的webshell免杀技术,主要基于字符特征、内容特征等来欺骗防火墙策略。但这种方式已经不能够让其在“下一代防火墙”的查杀下免杀。实践完成了基于语法逻辑、运算逻辑、生僻回调、静态特征隐藏等方法的免杀技术。该方法在一定时间内能够完美适应“下一代防火墙”的查杀,并且通过大量的实验结果总结出一套适用于当代webshell免杀技术的方法论。Webshell is the most powerful tool that a web attacker can obtain during the web attack phase.Traditional Webshell anti-antivirus technology mainly deceives firewall strategies based on character features and content features.However,this method can no longer prevent viruses from being killed by the“Next Generation Firewall”.An anti-killing technique based on grammatical logic,arithmetic logic,uncommon callbacks,and static feature hiding is proposed.This technique can perfectly adapt to the detection and killing of the“Next Generation Firewall”within a certain period of time.And through a large number of experimental results,a set of methodology suitable for contemporary Webshell anti-antivirus technology is summarized.

关 键 词：WEB安全 免杀 代码安全 杀毒 WEBSHELL 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP309.1[自动化与计算机技术—计算机科学与技术]