复现iis7/ii7.5的fastcgi解析漏洞

最新推荐文章于 2024-08-02 08:01:34 发布

per_se_veran_ce

最新推荐文章于 2024-08-02 08:01:34 发布

阅读量1.5k

点赞数 2

分类专栏：漏洞复现

本文链接：https://blog.csdn.net/per_se_veran_ce/article/details/100122633

版权

漏洞复现专栏收录该内容

17 篇文章 0 订阅

订阅专栏

在windows server 2008 r2上搭建 php服务
1、下载php解释器

地址为http://windows.php.net/download/
版本有两种，线程安全和非线程安全，线程安全是给apache用的，非线程安全是给iis用的，我们要配的是iis，所以下载非线程安全的，x86和x64看自己的机器是什么系统选择对应的版本下载就行了。

安装vcredist_x64.exe

2、安装php解释器

php可以说不用安装的，只要将文件解压到c:\php(一般不放在系统盘，那么就放E:\PHP)文件夹，就算安装完成了。
3、配置php.ini
拷贝php.ini-development，改名为php.ini，并进行如下修改：
注意每个选项前面的分号如果开启这个选项可以就直接删除掉前面的分号

3、配置php.ini

拷贝php.ini-development，改名为php.ini，并进行如下修改：
（1）扩展插件的路径
[html] view plain copy
1 ; Directory in which the loadable extensions (modules) reside.
2 ; http://php.net/extension-dir
3; extension_dir = “./”
4 ; On windows:
5 extension_dir = “c:\php5\ext”
修改最后一行，填入自己真实的PHP解释器地址，以及后面跟着ext文件夹，这个里面放的都是插件

（2）设置要引入哪些插件
[html] view plain copy
1 ; Windows Extensions
2 ; Note that ODBC support is built in, so no dll is needed for it.
3 ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5)
4 ; extension folders as well as the separate PECL DLL download (PHP 5).
5.; Be sure to appropriately set the extension_dir directive.
6 ;
7 ;extension=php_bz2.dll
8.;extension=php_curl.dll
9 ;extension=php_fileinfo.dll
10 ;extension=php_gd2.dll
11 ;extension=php_gettext.dll
12 ;extension=php_gmp.dll
13 ;extension=php_intl.dll
14 ;extension=php_imap.dll
15 ;extension=php_interbase.dll
16 ;extension=php_ldap.dll
17 extension=php_mbstring.dll
18 ;extension=php_exif.dll ; Must be after mbstring as it depends on it
19 extension=php_mysql.dll
20 extension=php_mysqli.dll
21 ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client
22 ;extension=php_openssl.dll
23 ;extension=php_pdo_firebird.dll
24 ;extension=php_pdo_mysql.dll
25 ;extension=php_pdo_oci.dll
26 ;extension=php_pdo_odbc.dll
27 ;extension=php_pdo_pgsql.dll
28 ;extension=php_pdo_sqlite.dll
29 ;extension=php_pgsql.dll
30 ;extension=php_shmop.dll
要引入的插件，只要把前面的分号去掉就可以了，我这里只引入了mysql、mysqli、mbstring。

（3）设置时区

[html] view plain copy
1[Date]
2 ; Defines the default timezone used by the date functions
3; http://php.net/date.timezone
4date.timezone = Asia/Shanghai

（4）支持短标签

[html] view plain copy
1 ; This directive determines whether or not PHP will recognize code between
2.; <? and ?> tags as PHP source which should be processed as such. It is
3 ; generally recommended that <?php and ?> should be used and that this feature
4 ; should be disabled, as enabling it may result in issues when generating XML
5 ; documents, however this remains supported for backward compatibility reasons.
6; Note that this directive does not control the <?= shorthand tag, which can be
7 ; used regardless of this directive.
8 ; Default Value: On
9 ; Development Value: Off
10 ; Production Value: Off
11 ; http://php.net/short-open-tag
12 short_open_tag = On

（5）启用fastcgi

[html] view plain copy
1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate
2 ; security tokens of the calling client. This allows IIS to define the
3; security context that the request runs under. mod_fastcgi under Apache
4 ; does not currently support this feature (03/17/2002)
5 ; Set to 1 if running under IIS. Default is zero.
6 ; http://php.net/fastcgi.impersonate
7 fastcgi.impersonate = 1

（6）cgi相关设置pathinfo

[html] view plain copy
1 ; cgi.fix_pathinfo provides real PATH_INFO/PATH_TRANSLATED support for CGI. PHP’s
2 ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
3 ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
4 ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
5 ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
6 ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
7 ; http://php.net/cgi.fix-pathinfo
8 cgi.fix_pathinfo=1

（7）cgi相关设置redirect

[html] view plain copy
1 ; cgi.force_redirect is necessary to provide security running PHP as a CGI under
2 ; most web servers. Left undefined, PHP turns this on by default. You can
3 ; turn it off here AT YOUR OWN RISK
4 ; You CAN safely turn this off for IIS, in fact, you MUST.
5 ; http://php.net/cgi.force-redirect
6 cgi.force_redirect = 0

（8）session存储路径

[html] view plain copy
1 ; where MODE is the octal representation of the mode. Note that this
2 ; does not overwrite the process’s umask.
3 ; http://php.net/session.save-path
4 session.save_path = “d:\server\web\session”

（9）数据库

mysql.default_port = 3306
mysql.default_host = localhost
mysql.default_user = root

（10）输出缓存

[php] view plain copy
1 ; Note: This directive is hardcoded to Off for the CLI SAPI
2 ; Default Value: Off
3 ; Development Value: 4096
4 ; Production Value: 4096
5 ; http://php.net/output-buffering
6 output_buffering = On//这里应该是填一个值，比如4096

（11）限定上传文件体积最大值

[php] view plain copy
1 upload_max_filesize = 100M
1 display_errors=On
2 error_log=“C:\windows\Temp\php-5.x.yy_errors.log”
3 error_reporting = E_ALL
4 fastcgi.logging = 0
5 html_errors=On
6 log_errors = On

4、将php.ini放到系统目录