{"id":428,"date":"2013-07-04T17:09:29","date_gmt":"2013-07-04T09:09:29","guid":{"rendered":"https:\/\/yanjingang.com\/blog\/?p=428"},"modified":"2016-03-09T17:17:11","modified_gmt":"2016-03-09T09:17:11","slug":"%e7%a8%8b%e5%ba%8f%e5%ae%89%e5%85%a8%e4%b9%8b-%e4%bb%a3%e7%a0%81%e6%b3%a8%e5%85%a5","status":"publish","type":"post","link":"https:\/\/yanjingang.com\/blog\/?p=428","title":{"rendered":"\u7a0b\u5e8f\u5b89\u5168\u4e4b\u2014\u2014\u4ee3\u7801\u6ce8\u5165"},"content":{"rendered":"

\u5f88\u591a\u7a0b\u5e8f\u4e0a\u9519\u8bef\u5c31 \u50cf\u4eba\u7c7b\u4e16\u754c\u7684\u75c5\u6bd2\u4e00\u6837\uff0c\u6211\u4eec\u5e94\u8be5\u7ed9\u6211\u4eec\u7684\u65b0\u5165\u884c\u7684\u7a0b\u5e8f\u5458\u666e\u53ca\u4e00\u4e0b\u7a0b\u5e8f\u5b89\u5168\u77e5\u8bc6\uff0c\u5e0c\u671b\u4ed6\u4eec\u4ece\u5165\u884c\u65f6\u5c31\u5bf9\u8fd9\u4e9b\u9519\u8bef\u6709\u62b5\u6297\u529b\u3002<\/p>\n

\u5148\u5411\u5927\u5bb6\u4ecb\u7ecd\u7b2c\u4e00\u6ce8\u75ab\u82d7\u2014\u2014\u4ee3\u7801\u6ce8\u5165\u3002<\/p>\n

\u4e00\u3001Shell\u6ce8\u5165<\/h4>\n

\u6211\u4eec\u5148\u6765\u770b\u4e00\u6bb5perl\u7684\u4ee3\u7801\uff1a<\/p>\n

    \n
  1. use\u00a0CGI\u00a0qw(:standard);<\/li>\n
  2. $name\u00a0=\u00a0param(‘name’);<\/li>\n
  3. $nslookup\u00a0=\u00a0“\/path\/to\/nslookup”;<\/li>\n
  4. print\u00a0header;<\/li>\n
  5. if\u00a0(open($fh,\u00a0“$nslookup\u00a0$name|”))\u00a0{<\/li>\n
  6. \u00a0\u00a0\u00a0\u00a0while\u00a0(<$fh>)\u00a0{<\/li>\n
  7. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print\u00a0escapeHTML($_);<\/li>\n
  8. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print\u00a0“<br>\\n”;<\/li>\n
  9. \u00a0\u00a0\u00a0\u00a0}<\/li>\n
  10. \u00a0\u00a0\u00a0\u00a0close($fh);<\/li>\n
  11. }<\/li>\n<\/ol>\n

    \u5982\u679c\u7528\u6237\u8f93\u5165\u7684\u53c2\u6570\u662f\uff1a<\/p>\n

      \n
    1. coolshell.cn%20%3B%20\/bin\/ls%20-l<\/li>\n<\/ol>\n

      \u90a3\u4e48\uff0c\u8fd9\u6bb5perl\u7684\u7a0b\u5e8f\u5c31\u6210\u4e86\uff1a<\/p>\n

        \n
      1. \/path\/to\/nslookup\u00a0coolshell.cn\u00a0;\u00a0\/bin\/ls\u00a0-l<\/li>\n<\/ol>\n

        \u6211\u4eec\u518d\u6765\u770b\u4e00\u6bb5PHP\u7684\u7a0b\u5e8f\uff1a<\/p>\n

          \n
        1. $myvar\u00a0=\u00a0‘somevalue’;<\/li>\n
        2. $x\u00a0=\u00a0$_GET[‘arg’];<\/li>\n
        3. eval(‘$myvar\u00a0=\u00a0‘\u00a0.\u00a0$x\u00a0.\u00a0‘;’);<\/li>\n<\/ol>\n

          \u201ceval<\/code>\u201c\u7684\u53c2\u6570\u5c06\u4f1a\u89c6\u540cPHP\u5904\u7406\uff0c\u6240\u4ee5\u989d\u5916\u7684\u547d\u4ee4\u53ef\u88ab\u6dfb\u52a0\u3002\u4f8b\u5982\uff1a\u5982\u679c\u201darg\u201d\u5982\u679c\u88ab\u8bbe\u6210\u201d10; system('rm -rf \/')<\/code>\u201c\uff0c\u540e\u9762\u7684\u201dsystem('rm -rf \/')<\/code>\u201c\u4ee3\u7801\u5c06\u88ab\u8fd0\u884c\uff0c\u8fd9\u7b49\u540c\u5728\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u5f00\u53d1\u8005\u610f\u6599\u5916\u7684\u7a0b\u5e8f\u3002\uff08\u5173\u4e8erm -rf \/\uff0c\u4f60\u61c2\u7684\uff0c\u53ef\u53c2\u770b\u201c\u4e00\u4e2a\u7a7a\u683c\u5f15\u53d1\u7684\u60b2\u5267\u201d\uff09<\/p>\n

          \u518d\u6765\u770b\u4e00\u4e2aPHP\u7684\u4ee3\u7801<\/p>\n

            \n
          1. $isadmin=\u00a0false;<\/li>\n
          2. …<\/li>\n
          3. …<\/li>\n
          4. foreach\u00a0($_GET\u00a0as\u00a0$key\u00a0=>\u00a0$value)\u00a0{<\/li>\n
          5. \u00a0\u00a0$$key\u00a0=\u00a0$value;<\/li>\n
          6. }<\/li>\n<\/ol>\n

            \u5982\u679c\u653b\u51fb\u8005\u5728\u67e5\u8be2\u5b57\u7b26\u4e32\u4e2d\u7ed9\u5b9a\u201disadmin=1\u2033\uff0c\u90a3$isadmin\u5c06\u4f1a\u88ab\u8bbe\u4e3a\u503c \u201c1\u2033\uff0c\u7136\u540e\u653b\u51fb\u503c\u5c31\u53d6\u5f97\u4e86\u7f51\u7ad9\u5e94\u7528\u7684admin\u6743\u9650\u4e86\u3002<\/p>\n

            \u518d\u6765\u770b\u4e00\u4e2aPHP\u7684\u793a\u4f8b\uff1a<\/p>\n

              \n
            1. $action\u00a0=\u00a0‘login’;<\/li>\n
            2. \u00a0\u00a0\u00a0if\u00a0(__isset(\u00a0$_GET[‘act’]\u00a0)\u00a0)<\/li>\n
            3. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$action\u00a0=\u00a0$_GET[‘act’];<\/li>\n
            4. \u00a0\u00a0\u00a0require(\u00a0$action\u00a0.\u00a0‘.php’\u00a0);<\/li>\n<\/ol>\n

              \u8fd9\u4e2a\u4ee3\u7801\u76f8\u5f53\u5371\u9669\uff0c\u653b\u51fb\u8005\u6709\u53ef\u80fd\u53ef\u4ee5\u5e72\u8fd9\u4e9b\u4e8b\uff1a<\/p>\n