对PHP-Audit-Labs Day2 示例的简单分析

  • 漏洞位于themes/default/404.php

    1
    2
    3
    4
    5
    6
    7
    8
    9
    <?php theme_include('header'); ?>

    	<section class="content wrap">
    		<h1>Page not found</h1>

    		<p>Unfortunately, the page <code>/<?php echo current_url(); ?></code> could not be found. Your best bet is either to try the <a href="<?php echo base_url(); ?>">homepage</a>, try <a href="#search">searching</a>, or go and cry in a corner (although I don’t recommend the latter).</p>
    	</section>

    <?php theme_include('footer'); ?> was not found

  • Anchor 使用了路由，如果访问的url不存在则会执行404.php
    比如访问/admin/xxx,会返回

    404
    The page admin/xxx was not found.
    Try the homepage

  • 其中xxx用户可控，处理不好就可能造成xss

  • 可以看到404.php中调用了base_url()获取用户访问的url

    1
    2
    3
    function current_url() {
    	return Uri::current();
    }

  • 跟进Uri类的current静态方法

    1
    2
    3
    4
    5
    public static function current() {
    	if(is_null(static::$current)) static::$current = static::detect();

    	return static::$current;
    }

  • 跟进detect静态方法

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    /**
    	 * Try and detect the current uri
    	 *
    	 * @return string
    	 */
    	public static function detect() {
    		// create a server object from global
    		$server = new Server($_SERVER);

    		$try = array('REQUEST_URI', 'PATH_INFO', 'ORIG_PATH_INFO');

    		foreach($try as $method) {

    			// make sure the server var exists and is not empty
    			if($server->has($method) and $uri = $server->get($method)) {

    				// apply a string filter and make sure we still have somthing left
    				if($uri = filter_var($uri, FILTER_SANITIZE_URL)) {

    					// make sure the uri is not malformed and return the pathname
    					if($uri = parse_url($uri, PHP_URL_PATH)) {
    						return static::format($uri, $server);
    					}

    					// woah jackie, we found a bad'n
    					throw new ErrorException('Malformed URI');
    				}
    			}
    		}

    		throw new OverflowException('Uri was not detected. Make sure the REQUEST_URI is set.');
    	}

  • 先通过$server->get($method) 依次获得 $_SERVER的’REQUEST_URI’ ,’PATH_INFO’和’ORIG_PATH_INFO’键值，存储在$uri中

  • 如果filter_var($uri, FILTER_SANITIZE_URL) 和 parse_url($uri, PHP_URL_PATH) 都为真的话就将其返回,否则抛出一个错误

  • 其中FILTER_SANITIZE_URL过滤器的作用如下

    1
    2
    FILTER_SANITIZE_URL 过滤器删除字符串中所有非法的 URL 字符。
    该过滤器允许所有的字符、数字以及 $-_.+!*'(),{}|\\^~[]`"><#%;/?:@&=。

    该过滤器不会过滤<>/，直接可以插入

    1
    <scirpt></scirpt>

    标签

  • 只有严重不合格的url，parse_url才会返回false

    1
    2
    3
    4
    5
    php > print_r(parse_url('/admin/<script>alert(1)</script>'));
    Array
    (
        [path] => /admin/<script>alert(1)</script>
    )

  • 因此最后的payload

    1
    /admin/<script>alert(1)</script>