深入解析PHP代码审计技术与实战【网络安全】
<h1 style="color: black; text-align: left; margin-bottom: 10px;">前言</h1><p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">登录某个网站并浏览其页面时，<span style="color: black;">重视</span>到了<span style="color: black;">有些</span>看起来不太对劲的<span style="color: black;">地区</span>。这些迹象可能是该网站存在漏洞或被黑客入侵的标志。为了<span style="color: black;">保证</span>这个网站的安全性，需要进行代码审计，这是一项专门针对软件代码进行<span style="color: black;">检测</span>和分析的技术。在本文中，<span style="color: black;">咱们</span>将深入探讨代码审计的重要性和<span style="color: black;">怎样</span>进行有效的代码审计。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">1.目录遍历漏洞</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入模板功能-模板管理功能处。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">这儿</span>说句题外话，之前有不少小伙伴私信我要网络安全<span style="color: black;">关联</span>的资源，我<span style="color: black;">这儿</span>都整理好了，需要的私信我自取 《黑客&网络安全入门&进阶学习资源包》免费领取</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>此处的功能点<span style="color: black;">能够</span>遍历目录下的文件，接下来<span style="color: black;">咱们</span>抓包查看当前功能点的代码。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">经过</span>路由找到对应的文件 template.php ,<span style="color: black;">而后</span>接着<span style="color: black;">经过</span> mudi=manage 进行分支<span style="color: black;">选取</span>进入到对应的函数中。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入template.php文件。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在 manage() 函数中，<span style="color: black;">首要</span>传入了两个参数， dirStr 参数则是<span style="color: black;">掌控</span>路径的参数，而 sel 参数则是<span style="color: black;">掌控</span><span style="color: black;">是不是</span>进入代码的if，而最后将路径传入到File类下的 GetDirList() 函数中。跟进GetDirList() 函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span><span style="color: black;">运用</span> opendir() 函数列出目录下的文件</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入模板管理功能处，<span style="color: black;">而后</span>进行抓包。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">抓包之后，进行测试。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>在dirStr<span style="color: black;">运用</span>.../../来测试目录穿越。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">2.任意文件读取漏洞</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">全局fread() 函数，<span style="color: black;">发掘</span>Read()函数中调用了 fread() 函数。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>搜索 Read() 函数的调用<span style="color: black;">状况</span>。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>搜索fread()函数的用法。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>在 sysCheckFile_deal.php 文件中调用了 File::read() 函数，跟进该函数。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">按照</span>路由，去构造url路径，<span style="color: black;">而后</span><span style="color: black;">拜访</span>。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">接着抓包，<span style="color: black;">协同</span>../进行目录穿越读取文件。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">3.任意文件删除漏洞</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在测试模板管理功能点处，<span style="color: black;">发掘</span>该处存在一个删除的功能点，<span style="color: black;">发掘</span>存在任意文件删除漏洞。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">首要</span><span style="color: black;">咱们</span><span style="color: black;">经过</span>路由找对相应的源代码 template_deal.php 文件，且<span style="color: black;">这儿</span>的路由指向为 DelFile() 函数，该函数中接收了三个参数，其中filePath参数为<span style="color: black;">重点</span><span style="color: black;">掌控</span>路径的参数，将filePath参数带入到File::Del()中进行删除。跟进 del() 函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">该函数很简单，<span style="color: black;">首要</span>判断路径<span style="color: black;">是不是</span>为空，不为空修改权限最后进行文件的删除操作。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入功能点处。<span style="color: black;">而后</span>点击X号。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>在根路径写入一个xxx.txt文件。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>在filepath参数后<span style="color: black;">协同</span>../来删除文件。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">4.msql_getshell</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在 黑盒 测试中中存在一个 SQL语句调试 的功能点，该处<span style="color: black;">无</span>对SQL语句关键字的过滤而<span style="color: black;">导致</span>SQL语句的任意执行，<span style="color: black;">引起</span>getshell。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入功能点处。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>执行简单的SQL语句进行测试。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span><span style="color: black;">运用</span>抓包工具来定位路由。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>看一下代码，<span style="color: black;">发掘</span>文件的开头以<span style="color: black;">要求</span>分支来<span style="color: black;">选取</span>对应要执行的功能点，<span style="color: black;">因为</span><span style="color: black;">以上</span> mudi=sql ，<span style="color: black;">因此</span><span style="color: black;">咱们</span>找到该处要执行的sql所对应的函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">经过</span> OT::PostStr <span style="color: black;">办法</span>传入五个参数，其中 sqlContent 中是需要传入的SQL语句，而下面对</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">into_outfile 、 global general_log 等SQL关键字进行了过滤</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在下面检测你填入的后台<span style="color: black;">秘码</span><span style="color: black;">是不是</span>正确，<span style="color: black;">倘若</span>正确继续执行下面代码，在代码中执行了<span style="color: black;">咱们</span>输入</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">的SQL语句。未对其进行过滤完全，<span style="color: black;">引起</span><span style="color: black;">咱们</span><span style="color: black;">能够</span>绕过过滤，来执行SQL语句。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">首要</span>去开启数据库日志功能，<span style="color: black;">发掘</span>有过滤。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span><span style="color: black;">咱们</span>构造payload成功绕过过滤。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span><span style="color: black;">咱们</span>写入phpinfp文件。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">构造payload，成功写入。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">拜访</span>之后，成功getshell。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">5.xss漏洞</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入users_deal.php</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">检测type<span style="color: black;">是不是</span>为数组中的固定值，不是则带入AlertEnd<span style="color: black;">办法</span>中 跟进AlertEnd<span style="color: black;">办法</span></span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>type被带<script>标签，<span style="color: black;">运用</span>AlertFilter函数处理后直接alert，跟进AlertFilter函数</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">构造payload，成功实现弹窗。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">6.xss漏洞2</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入read.php</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>在GetCityData函数中，idName参数<span style="color: black;">无</span>做任何处理，带入GetCituOptionJs函数中跟进该<span style="color: black;">办法</span></span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">该<span style="color: black;">办法</span>中idName参数被直接带入DOM<span style="color: black;">办法</span>中输出</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">要调用GetCityData函数需mudi参数，<span style="color: black;">而后</span>在idName处输入XSS的payload。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">成功实现弹框。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">7.ssrf漏洞</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在浏览代码过程中，<span style="color: black;">发掘</span>该处<span style="color: black;">运用</span>curl_exec()函数来执行命令。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">在函数UseCurl中，调用curl_exec函数执行了一个curl会话，<span style="color: black;">仅有</span>$url参数可控，<span style="color: black;">就可</span><span style="color: black;">导致</span>ssrf漏洞</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">进入info_deal.php</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">跟进AddOrRev函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">接着跟进PostStr函数，<span style="color: black;">发掘</span>其调用了post函数。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">跟进post函数。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">$img参数<span style="color: black;">经过</span>POST方式传入，并且无过滤<span style="color: black;">办法</span> 继续跟进SaveRemoteFile函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">第二个参数被带入GetUrlContent函数，跟进GetUrlContent函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">按照</span>可控参数的带入，跟进UseAuto函数，并且此处传入3个参数 0，GET，$url</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">按照</span>传入<span style="color: black;">第1</span>个参数$seMode为0，会调用UseCurl函数，即进入漏洞关键函数</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">日前</span>已知漏洞触发链条，接下来只需要<span style="color: black;">按照</span>进入函数的<span style="color: black;">要求</span>，构造poc<span style="color: black;">就可</span></span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">首要</span>需要进入AddOrRev函数，只需$mudi值为add</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">而后</span>需要满足进入SaveRemoteFile函数的<span style="color: black;">要求</span></span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>输入的参数为http://，接着来复现漏洞。</span></p>
<h1 style="color: black; text-align: left; margin-bottom: 10px;">漏洞复现：</h1>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">拜访</span>url<span style="color: black;">位置</span>，<span style="color: black;">运用</span>post方式，在img参数后面输入dnslog<span style="color: black;">位置</span>。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">成功收到监听。</span></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">##总结 代码审计<span style="color: black;">能够</span><span style="color: black;">帮忙</span><span style="color: black;">发掘</span><span style="color: black;">各样</span>类型的漏洞。这些漏洞可能<span style="color: black;">包含</span>输入验证问题、授权问题、会话管理问题、跨站点脚本漏洞、SQL注入漏洞等。</span></p>
页:
[1]