{"id":442,"date":"2025-01-18T18:33:29","date_gmt":"2025-01-18T10:33:29","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=442"},"modified":"2025-01-18T18:33:31","modified_gmt":"2025-01-18T10:33:31","slug":"05-%e6%96%87%e4%bb%b6%e5%8c%85%e5%90%ab%e7%bb%95%e8%bf%87","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/18\/05-%e6%96%87%e4%bb%b6%e5%8c%85%e5%90%ab%e7%bb%95%e8%bf%87\/","title":{"rendered":"05.\u6587\u4ef6\u5305\u542b\u7ed5\u8fc7"},"content":{"rendered":"

\u4e00\u3001\u6709\u9650\u5236\u7684\u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u7ed5\u8fc7:<\/h1>\n

\u6f0f\u6d1e\u4ee3\u7801\uff1a<\/p>\n

<?php
\n<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>f<\/mi>i<\/mi>l<\/mi>e<\/mi>=<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>_GET[‘file’];
\ninclude($file.".html");
\n?>
\n\u00a0 \u8be5\u4ee3\u7801\u4f1a\u9ed8\u8ba4\u7ed9\u6587\u4ef6\u52a0\u4e00\u4e2a.html\u540e\u7f00
\n\u00a0 \u5bfc\u81f4\u65e0\u6cd5\u627e\u5230\u8be5\u6587\u4ef6
\n\"Pasted<\/p>\n

\u7ed5\u8fc7\u65b9\u5f0f\uff1a
\n\u4e0a\u4f20html\u6587\u4ef6
\n\"Pasted<\/p>\n

\"Pasted<\/p>\n

\u4e0d\u80fd\u4e0a\u4f20html\u6587\u4ef6\u65f6\u5176\u4ed6\u7ed5\u8fc7\u65b9\u6cd5<\/h2>\n

\u7b2c\u4e00\u79cd\u65b9\u5f0f %00\u622a\u65ad<\/h3>\n

\u6761\u4ef6\uff1amagic_quotes_gpc=off\u00a0\u00a0 PHP\u7248\u672c<5.3.4<\/p>\n

\u7b2c\u4e8c\u79cd\u8def\u5f84\u957f\u5ea6\u622a\u65ad<\/h3>\n

\u6761\u4ef6\uff1awindows \uff0c\u70b9\u53f7\u9700\u8981\u957f\u5ea6256\uff1blinux \u957f\u5ea6\u9700\u89814096.<\/p>\n

Windows\u4e0b\u76ee\u5f55\u6700\u5927\u957f\u5ea6\u4e3a256\u5b57\u8282\uff0c\u8d85\u51fa\u7684\u90e8\u5206\u4f1a\u88ab==\u4e22\u5f03==\uff1b<\/p>\n

Linux\u4e0b\u76ee\u5f55\u6700\u5927\u957f\u5ea6\u4e3a4096\u5b57\u8282\uff0c\u8d85\u51fa\u7684\u90e8\u5206\u4f1a\u88ab==\u4e22\u5f03==\u3002<\/p>\n

\u6210\u529f\u622a\u65ad
\n\/.\/.\/.\/.\/.\/.\/.\/.\/.\uff08\u540e\u9762\u7701\u7565\u8bb8\u591a\/.)
\n

\"Pasted<\/div>
\n\u6216\u8005…………………………….
\n\"Pasted<\/p>\n

\u4e8c\u3001\u6709\u9650\u5236\u7684\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\uff1a<\/h1>\n

\u6d4b\u8bd5\u4ee3\u7801\u4e5f\u662f\u4e00\u6837\u7684\u3002<\/p>\n

<?php
\n\u00a0 $file = <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>G<\/mi><\/msub>E<\/mi>T<\/mi>[<\/mo>\u2032<\/mo><\/msup>f<\/mi>i<\/mi>l<\/mi>e<\/mi>\u2032<\/mo><\/msup>]<\/mo>;<\/mo>i<\/mi>n<\/mi>c<\/mi>l<\/mi>u<\/mi>d<\/mi>e<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>file.".html");
\n\u00a0 ?><\/p>\n

\"Pasted<\/p>\n

\"Pasted<\/p>\n

\"Pasted<\/p>\n

1.\u7b2c\u4e00\u79cd\u95ee\u53f7\u7ed5\u8fc7<\/h3>\n

\u95ee\u53f7\u540e\u9762\u7684\u503c\u4f1a\u5f53\u6210\u53c2\u6570
\nyuancheng.txt–>yuancheng.txt.html
\n\"Pasted<\/p>\n

2.\u7b2c\u4e8c\u79cd\u4e95\u53f7\u7ed5\u8fc7<\/h3>\n

\u53f7\uff08%23\uff09\u4e0d\u662f\u6ce8\u91ca<\/h1>\n

\"Pasted<\/p>\n

3.\u5f53allow_url_include\u548callow_url_fopen\u8bbe\u7f6e\u4e3aoff\u65f6\u7ed5\u8fc7<\/h3>\n

\u5728PHP\u914d\u7f6e\u6587\u4ef6\u4e2d\uff0c\u201callow_url_include\u201dwrapper\u9ed8\u8ba4\u8bbe\u7f6e\u4e3a\u201cOff\u201d\uff0c\u6307\u793aPHP\u4e0d\u52a0\u8f7d\u8fdc\u7a0bHTTP\u6216FTP URL\uff0c\u4ece\u800c\u9632\u6b62\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u653b\u51fb\u3002\u4f46\u662f\uff0c\u5373\u4f7f\u201callow_url_include\u201d\u548c\u201callow_url_fopen\u201d\u90fd\u8bbe\u7f6e\u4e3a\u201cOff\u201d\uff0cPHP\u4e5f\u4e0d\u4f1a\u963b\u6b62\u52a0\u8f7dSMB URL\u3002\u800c\u8fd9\u5c31\u6781\u6709\u53ef\u80fd\u88ab\u6ee5\u7528\u6765\u4eceSMB\u5171\u4eab\u52a0\u8f7d\u8fdc\u7a0b\u6258\u7ba1\u7684PHP Web shell\u3002<\/p>\n

SMB\uff08Server Messages Block\uff0c\u4fe1\u606f\u670d\u52a1\u5757\uff09\u662f\u4e00\u79cd\u5728\u5c40\u57df\u7f51\u4e0a\u5171\u4eab\u6587\u4ef6\u548c\u6253\u5370\u673a\u7684\u4e00\u79cd\u901a\u4fe1\u534f\u8bae\uff0c\u5b83\u4e3a\u5c40\u57df\u7f51\u5185\u7684\u4e0d\u540c\u8ba1\u7b97\u673a\u4e4b\u95f4\u63d0\u4f9b\u6587\u4ef6\u53ca\u6253\u5370\u673a\u7b49\u8d44\u6e90\u7684\u5171\u4eab\u670d\u52a1\u3002<\/p>\n

smb.conf\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n

[global]
\nworkgroup = WORKGROUP\u00a0\u00a0\u00a0\u00a0\u00a0
\nserver string = Samba Server %v
\nnetbios name = indishell-lab
\nsecurity = user
\nmap to guest = bad user
\nname resolve order = bcast host
\ndns proxy = no
\nbind interfaces only = yes
\n[ica]
\npath = \/var\/www\/html\/pub
\nwritable = no
\nguest ok = yes
\nguest only = yes
\nread only = yes
\ndirectory mode = 0555<\/p>\n

kali\u642d\u5efaSMB<\/h4>\n

1.\u542f\u52a8samba
\n

\"Pasted<\/div>
\n2.
\n
\"Pasted<\/div>
\n3.\u521b\u5efapub\u5171\u4eab\u6587\u4ef6\u5939
\n
\"Pasted<\/div>
\n4.\u8bbe\u7f6e\u6743\u9650
\n
\"Pasted<\/div>
\n5.
\n
\"Pasted<\/div>
\n6.\u4fee\u6539\u914d\u7f6e\u6587\u4ef6
\n
\"Pasted<\/div>
\n
\"Pasted<\/div>
\n7.\u91cd\u542fsmaba
\n
\"Pasted<\/div>
\n8.\u5728\u5171\u4eab\u6587\u4ef6\u91cc\u7f16\u5199\u6728\u9a6c
\n\"Pasted<\/p>\n

\"Pasted<\/div>
\n9.\u6253\u5f00\u8fd0\u884c\u6846
\n
\"Pasted<\/div>
\n10.\u8bbf\u95ee\u5171\u4eab\u6587\u4ef6\u5939
\n
\"Pasted<\/div>
\n11.\u8fdb\u884c\u6587\u4ef6\u5305\u542b
\n\u6210\u529f\u7ed5\u8fc7
\n\"Pasted<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e00\u3001\u6709\u9650\u5236\u7684\u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u7ed5\u8fc7: \u6f0f\u6d1e\u4ee3\u7801\uff1a <?php file=_GET[‘file& […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,11],"tags":[],"class_list":["post-442","post","type-post","status-publish","format-standard","hentry","category-web","category-11"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=442"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/442\/revisions"}],"predecessor-version":[{"id":443,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/442\/revisions\/443"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=442"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}