Preface
This article fully and thoroughly reproduces every vulnerability case mentioned in the book Code Auditing: Enterprise Web Code Security Architecture and provides the source code packages, so that newcomers who start with this book can reproduce the cases themselves and gain a deeper understanding.
Vulnerability Title
Metinfo File Inclusion Vulnerability Analysis, p. 92 of the book
Preparations
- Phpstorm (another IDE is also fine; I usually use Phpstorm for coding, so I am accustomed to it)
- Metinfo 4.0 source code package
Getting Started
- The vulnerability point appears in /message/index.php, which obtains the module name directly from the get request and concatenates it into the require_once function, as shown below:
- The corresponding feature is shown below:
- The vulnerability is relatively simple. Here, we enable allow_url_include in php.ini and restart the web server software. This results in remote file inclusion. We create a 1.txt file, as shown below:
- Then construct the exp: http://localhost/techpackage.net-MetInfo4.0/message/index.php?metid =http://localhost/1.txt?.php After visiting it, the running php version information is printed, as shown below:
- As you can see, a ? is used here for truncation. Page 92 of the book explains that a question mark is used for pseudo-truncation during remote file inclusion. This is not restricted by GPC or the PHP version. As long as code can be returned to the inclusion function, it can execute. Under the HTTP protocol, accessing http://localhost/1.txt and accessing http://localhost/1.txt?.php returns the same result, because at this point WebServer treats the content after the question mark as request parameters, while txt is not parsed by WebServer. The parameters do not affect the content returned when accessing 1.txt, thereby achieving pseudo-truncation. These are the book's original words.