phpd代码审计

*获取源码

*网站结构

*入口文件

*配置文件

*过滤功能

审计方法-通读全文法
disable_functions
disable_classes
safe_mode=off
safe_mode_exec_dir=/var/www/html
file_uploads=on
upload_max_filesize=8M
文件上传目录
upload_tmp_dir=
用户访问目录限制
open_basedir=
display_error=on
error_reporting=E_ALL
error_log=
log_errors=on
log_errors_max_length=1024
magic_quotes_gpc=On
magic_quotes_runtime=Off
allow_url_fopen = on
allow_url_include = Off

常见危险函数及特殊函数

eval()
assert()
preg_replace()
preg_replace("/test/e",$_GET['h'],"just test");
?h=phpinfo(),phpinfo()将会执行

create_function()
call_user_func()
call_func_array()

require
include
require_once
include_once

命令执行函数

exec()
passthru()
proc_open()
shell_exec()
system()
popen()

文件操作函数
copy
file_get_contents
file_put_contents
file
fopen
move_uploaded_file
readfile
rename
rmdir
unlink & delete

特殊函数
phpinfo()
symlink()
getenv()
putenv()
dl()

配置相关
ini_get()
ini_set
ini_alter
ini_restore

数字判断
is_numeric

数组相关
in_array

变量覆盖

parse_str()
mb_parse_str
extract()
import_request_variables()

列目录
glob

无参数获取信息
get_defined_vars
get_defined_constants
get_defined_functions
get_includes_files

<?php 
error_reporting(E_ALL);

print_r($_GET);

print_r($_POST);

echo "The var \$test is ".(isset($test)?"defined :\$test=$test":"undefined");

$tag_var = 'short tags';
?>

<?= $tag_var?>
<?php echo system('whoami');
print_r(scandir(dirname(__FILE__)));
echo "\r\n";
print_r(scandir(dirname(__FILE__)."/../"));




@eval('echo "test"');
echo "\r\n";
echo 'test';

assert('system("whoami");');

preg_replace("/test/e", "phpinfo();", "just test");
$cfunc = create_function('$v', 'return system($v);');
$cfunc('whoami');

$sfunc = 'sys'.'tem';
$sfunc('whoami');


function test($var){
    echo 'callable test '.$var;
}
call_user_func('test','amu');
call_user_func('system','whoami');



?>

<?php 
/*
echo "\r\n<br/>allow_url_include=".(ini_get('allow_url_include')?'On':'Off');
echo "\r\n<br/>allow_url_fopen=".(ini_get('allow_url_fopen')?'On':'Off');
echo "\r\n";
include($_GET['v']);
*/

/*
echo shell_exec('ping 127.0.0.1');
echo shell_exec('ping '.$_GET["v"]);//?v=127.0.0.1 | whoami
*/
/*
file_put_contents('fpc.test', 'test');
file_put_contents('fpc.test', file_get_contents("http://www.baidu.com"));
unlink('fpc.test');
*/

/*
var_dump(getenv('test'));
putenv('test=123');
echo "\r\ntest=".getenv('test');
*/

/*
echo "\r\n<br/>display_errors=".(ini_get('display_errors')?'On':'Off');
ini_set("display_errors", 0);
echo "\r\n<br/>display_errors=".(ini_get('display_errors')?'On':'Off');
*/

/*
echo "is_numeric :";
var_dump(is_numeric($_GET["v"]));//?v=127'   ?v=0e1   ?v=0x123
echo "\r\n";
echo "output :".$_GET["v"];
echo "\r\n";
echo "intval :".intval($_GET["v"]);
*/


/*
$v = 1;
var_dump(in_array($v, array("1",2,3)));
echo "\r\n";;

$a = '1abc';  // '1abc' == 1
in_array($a, array(1,2,3));//in_array($a, array(1,2,3),true);
in_array($a, array("2",2,3));
*/

/*
$str = "first=value&arr[]=foobar&arr[]=baz";
echo "<pre>";
parse_str($str,$array);
print_r($array);

var_dump(isset($first));

parse_str($str);
var_dump(isset($first));
echo "\$arr[0]=$arr[0]";
echo "\$arr[1]=$arr[1]";
*/

/*
echo "<pre>";
print_r(glob("t*.php"));
*/


echo "<pre>";
$test = 'test';
print_r(get_defined_vars());

define("TEST", 'test');
echo "<pre>";
print_r(get_defined_constants(true));

function abc(){}
print_r(get_defined_functions());
 ?>

<?php
$password = 'sfdsfsdfsdfdffdfdf';
if (isset($_POST['passwd'])) {
    $pass = $_POST['passwd'];
    if ($pass === $_POST['passwd']) {
        webshell();
    } else {
        echo "password is error";
    }
    
} else {
    echo '<form action="" method=post><input type="text" name="passwd" /><input type="submit" name="login" value="login"></form>';
    exit;
}

function webshell(){
    echo "this is a test";
}

Xdebug的配置PHP.ini

xdebug.auto_trace = 1
xdebug.trace_format = 0
xdebug.trace_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.trace_options = 0

xdebug.collect_params = 4
xdebug.collect_return = 1
xdebug.collect_vars = 1
xdebug.collect_assignments = 1

xdebug.profiler_append = 0
xdebug.profiler_enable = 1
xdebug.profiler_enable_trigger = 0
xdebug.profiler_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.profiler_output_name = "cache.out.%t-%s"

xdebug.remote_enable = 1
xdebug.remote_handler = "dbgp"
xdebug.remote_host = "127.0.0.1"
zend_extension="D:\phpStudy\php\php-5.4.45\ext\php_xdebug.dll"