{"id":782,"date":"2025-01-18T20:12:39","date_gmt":"2025-01-18T12:12:39","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=782"},"modified":"2025-01-18T20:12:40","modified_gmt":"2025-01-18T12:12:40","slug":"03-ssrf%e6%bc%8f%e6%b4%9e%e5%88%a9%e7%94%a8","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/18\/03-ssrf%e6%bc%8f%e6%b4%9e%e5%88%a9%e7%94%a8\/","title":{"rendered":"03.SSRF\u6f0f\u6d1e\u5229\u7528"},"content":{"rendered":"

\u4e00\u3001\u4ea7\u751fSSRF\u6f0f\u6d1e\u7684\u51fd\u6570<\/h3>\n

SSRF\u653b\u51fb\u53ef\u80fd\u5b58\u5728\u4efb\u4f55\u8bed\u8a00\u7f16\u5199\u7684\u5e94\u7528\uff0c\u63a5\u4e0b\u6765\u5c06\u4e3e\u4f8bphp\u4e2d\u53ef\u80fd\u5b58\u5728SSRF\u6f0f\u6d1e\u7684\u51fd\u6570\u3002<\/p>\n

1\u3001file_get_contents:<\/h4>\n

\u4e0b\u9762\u7684\u4ee3\u7801\u4f7f\u7528file_get_contents\u51fd\u6570\u4ece\u7528\u6237\u6307\u5b9a\u7684url\u83b7\u53d6\u56fe\u7247\u3002\u7136\u540e\u628a\u5b83\u7528\u4e00\u4e2a\u968f\u5373\u6587\u4ef6\u540d\u4fdd\u5b58\u5728\u786c\u76d8\u4e0a\uff0c\u5e76\u5c55\u793a\u7ed9\u7528\u6237\u3002<\/p>\n

<?php
\nif (isset(Extra open brace or missing close brace<\/title>_POST[‘url’])) { <\/text><\/g><\/g><\/g><\/g><\/svg>_POST[‘url’])) { <\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>content = file_get_contents(<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>P<\/mi><\/msub>O<\/mi>S<\/mi>T<\/mi>[<\/mo>\u2032<\/mo><\/msup>u<\/mi>r<\/mi>l<\/mi>\u2032<\/mo><\/msup>]<\/mo>)<\/mo>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>filename =’.\/images\/’.rand().’;img1.jpg’;
\nfile_put_contents($filename, $content);
\necho <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>P<\/mi><\/msub>O<\/mi>S<\/mi>T<\/mi>[<\/mo>\u2032<\/mo><\/msup>u<\/mi>r<\/mi>l<\/mi>\u2032<\/mo><\/msup>]<\/mo>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>img = "<img src="".$filename.""\/>";
\n}
\necho $img;
\n?><\/p>\n

2\u3001sockopen():<\/h4>\n

\u4ee5\u4e0b\u4ee3\u7801\u4f7f\u7528fsockopen\u51fd\u6570\u5b9e\u73b0\u83b7\u53d6\u7528\u6237\u5236\u5b9aurl\u7684\u6570\u636e\uff08\u6587\u4ef6\u6216\u8005html\uff09\u3002\u8fd9\u4e2a\u51fd\u6570\u4f1a\u4f7f\u7528socket\u8ddf\u670d\u52a1\u5668\u5efa\u7acbtcp\u8fde\u63a5\uff0c\u4f20\u8f93\u539f\u59cb\u6570\u636e\u3002<\/p>\n

<?php
\nfunction GetFile(<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>h<\/mi>o<\/mi>s<\/mi>t<\/mi>,<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>port,Extra open brace or missing close brace<\/title>link) { <\/text><\/g><\/g><\/g><\/g><\/svg>link) { <\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>fp = fsockopen(<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>h<\/mi>o<\/mi>s<\/mi>t<\/mi>,<\/mo>i<\/mi>n<\/mi>t<\/mi>v<\/mi>a<\/mi>l<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>port), $errno, <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>e<\/mi>r<\/mi>r<\/mi>s<\/mi>t<\/mi>r<\/mi>,<\/mo>30<\/mn>)<\/mo>;<\/mo>i<\/mi>f<\/mi>(<\/mo>!<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>fp) {
\necho "$errstr (error number Extra close brace or missing open brace<\/title>errno) \\n”; } else { <\/text><\/g><\/g><\/g><\/g><\/svg>errno) \\n”; } else { <\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>out = "GET <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>l<\/mi>i<\/mi>n<\/mi>k<\/mi>H<\/mi>T<\/mi>T<\/mi>P<\/mi>\/<\/mo><\/mrow>1.1<\/mn>\\r<\/mtext>\\n<\/mtext>“<\/mo><\/mrow>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>out .= "Host: <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>h<\/mi>o<\/mi>s<\/mi>t<\/mi>\\r<\/mtext>\\n<\/mtext>“<\/mo><\/mrow>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>out .= "Connection: Close\\r\\n\\r\\n";
\n<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>o<\/mi>u<\/mi>t<\/mi>.<\/mo>=<\/mo>“<\/mo><\/mrow>\\r<\/mtext>\\n<\/mtext>“<\/mo><\/mrow>;<\/mo>f<\/mi>w<\/mi>r<\/mi>i<\/mi>t<\/mi>e<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>fp, <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>o<\/mi>u<\/mi>t<\/mi>)<\/mo>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>contents=”;
\nwhile (!feof(Extra open brace or missing close brace<\/title>fp)) { <\/text><\/g><\/g><\/g><\/g><\/svg>fp)) { <\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>contents.= fgets(Extra close brace or missing open brace<\/title>fp, 1024); } fclose(<\/text><\/g><\/g><\/g><\/g><\/svg>fp, 1024); } fclose(<\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>fp);
\nreturn $contents;
\n}
\n}
\n?><\/p>\n

3\u3001curl_exec():<\/h4>\n

cURL\u8fd9\u662f\u53e6\u4e00\u4e2a\u975e\u5e38\u5e38\u89c1\u7684\u5b9e\u73b0\uff0c\u5b83\u901a\u8fc7 PHP\u83b7\u53d6\u6570\u636e\u3002\u6587\u4ef6\/\u6570\u636e\u88ab\u4e0b\u8f7d\u5e76\u5b58\u50a8\u5728\u201ccurled\u201d\u6587\u4ef6\u5939\u4e0b\u7684\u78c1\u76d8\u4e2d\uff0c\u5e76\u9644\u52a0\u4e86\u4e00\u4e2a\u968f\u673a\u6570\u548c\u201c.txt\u201d\u6587\u4ef6\u6269\u5c55\u540d\u3002<\/p>\n

<?php
\nif (isset(Extra open brace or missing close brace<\/title>_POST[‘url’])) { <\/text><\/g><\/g><\/g><\/g><\/svg>_POST[‘url’])) { <\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>link = <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>P<\/mi><\/msub>O<\/mi>S<\/mi>T<\/mi>[<\/mo>\u2032<\/mo><\/msup>u<\/mi>r<\/mi>l<\/mi>\u2032<\/mo><\/msup>]<\/mo>;<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>curlobj = curl_init();
\ncurl_setopt(<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>c<\/mi>u<\/mi>r<\/mi>l<\/mi>o<\/mi>b<\/mi>j<\/mi>,<\/mo>C<\/mi>U<\/mi>R<\/mi>L<\/mi>O<\/mi>P<\/mi>T<\/mi>P<\/mi><\/msub>O<\/mi>S<\/mi>T<\/mi>,<\/mo>0<\/mn>)<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>s<\/mi><\/msub>e<\/mi>t<\/mi>o<\/mi>p<\/mi>t<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>curlobj,CURLOPT_URL,<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>l<\/mi>i<\/mi>n<\/mi>k<\/mi>)<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>s<\/mi><\/msub>e<\/mi>t<\/mi>o<\/mi>p<\/mi>t<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>curlobj, CURLOPT_RETURNTRANSFER, 1);
\n<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>r<\/mi>e<\/mi>s<\/mi>u<\/mi>l<\/mi>t<\/mi>=<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>e<\/mi><\/msub>x<\/mi>e<\/mi>c<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>curlobj);
\ncurl_close($curlobj);<\/p>\n

<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>f<\/mi>i<\/mi>l<\/mi>e<\/mi>n<\/mi>a<\/mi>m<\/mi>e<\/mi>=<\/mo>\u2032<\/mo><\/msup>.<\/mo>\/<\/mo><\/mrow>c<\/mi>u<\/mi>r<\/mi>l<\/mi>e<\/mi>d<\/mi>\/<\/mo><\/mrow>\u2032<\/mo><\/msup>.<\/mo>r<\/mi>a<\/mi>n<\/mi>d<\/mi>(<\/mo>)<\/mo>.<\/mo>\u2032<\/mo><\/msup>.<\/mo>t<\/mi>x<\/mi>t<\/mi>\u2032<\/mo><\/msup>;<\/mo>f<\/mi>i<\/mi>l<\/mi>e<\/mi>p<\/mi><\/msub>u<\/mi>t<\/mi>c<\/mi><\/msub>o<\/mi>n<\/mi>t<\/mi>e<\/mi>n<\/mi>t<\/mi>s<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>filename, $result);
\necho $result;
\n}
\n?><\/p>\n

\u5148\u521b\u5efa\u4e00\u4e2aSSRF\u6f0f\u6d1e\u7684\u6587\u4ef6
\n<?php
\nfunction curl($url){
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>c<\/mi>h<\/mi>=<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>i<\/mi><\/msub>n<\/mi>i<\/mi>t<\/mi>(<\/mo>)<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>s<\/mi><\/msub>e<\/mi>t<\/mi>o<\/mi>p<\/mi>t<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>ch, CURLOPT_URL, <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>u<\/mi>r<\/mi>l<\/mi>)<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>s<\/mi><\/msub>e<\/mi>t<\/mi>o<\/mi>p<\/mi>t<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>ch, CURLOPT_HEADER, 0);
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 curl_exec(<\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>c<\/mi>h<\/mi>)<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>c<\/mi><\/msub>l<\/mi>o<\/mi>s<\/mi>e<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>ch);
\n}
\n$url = <\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/g><\/svg>G<\/mi><\/msub>E<\/mi>T<\/mi>[<\/mo>\u2032<\/mo><\/msup>u<\/mi>r<\/mi>l<\/mi>\u2032<\/mo><\/msup>]<\/mo>;<\/mo>c<\/mi>u<\/mi>r<\/mi>l<\/mi>(<\/mo><\/math><\/mjx-assistive-mml><\/mjx-container>url);
\n?><\/p>\n

\"Pasted<\/p>\n

\u83b7\u53d6\u767e\u5ea6\u8d44\u6e90
\n\"Pasted<\/p>\n

\u83b7\u53d6\u5185\u90e8\u7f51\u7ad9
\n\"Pasted<\/p>\n

\"Pasted\"Pasted<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e00\u3001\u4ea7\u751fSSRF\u6f0f\u6d1e\u7684\u51fd\u6570 SSRF\u653b\u51fb\u53ef\u80fd\u5b58\u5728\u4efb\u4f55\u8bed\u8a00\u7f16\u5199\u7684\u5e94\u7528\uff0c\u63a5\u4e0b\u6765\u5c06\u4e3e\u4f8bphp\u4e2d\u53ef\u80fd\u5b58\u5728SSRF\u6f0f\u6d1e\u7684 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,4],"tags":[],"class_list":["post-782","post","type-post","status-publish","format-standard","hentry","category-ssrf","category-web"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/782\/revisions"}],"predecessor-version":[{"id":783,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/782\/revisions\/783"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=782"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}