Thinkphp5 log file contains trick

Preface

Thinkphp5 The log file contains trick, A method of using logs for file inclusion

Environmental Science

• thinkphp5.0.24 Variable coverage rce Fix version , No, forced routing is not enabled rce Affects version

• Did not open app_debug

Use conditions

• Log path
• Include a point

analysis

The controller writes a method that can trigger an error , Found incoming php The code will work url code

Follow up log related functions

Four correlation functions are analyzed

ip：

ip It can be used XFF HCI RA Etc , But in the end, there is the legitimacy of the test ,ip2long testing ip Invalid return false, The last set ip by 0.0.0.0

method：

There is no filtering here , But the final return is uppercase HTTP_X_HTTP_METHOD_OVERRIDE

host：

Go straight back to HTTP_X_REAL_HOST

url：

return HTTP_X_REWRITE_URL

Add header information

X-REAL-HOST: <?php phpinfo();?>
X-REWRITE-URL: <?php phpinfo();?>
X-HTTP-METHOD-OVERRIDE: <?php phpinfo();?>

Include log files