• PHP代码审计入门-DVWA靶场暴力破解篇

    0x00  写在前面

    从零学习php，最终目的实现代码审计入门，软件采用sublime text，环境使用phpstudy搭建，数据库是navicat，需要有基本的前端基础、简单的php+mysql后端基础、渗透知识和漏洞原理，文章跟随流沙前辈学习记录，看看曾经遥不可及的代码审计能不能慢慢啃下来。

    本章为代码审计入门第五篇-DVWA靶场篇，对DVWA靶场漏洞进行代码审计。

    0x01  暴力破解

    暴力破解模块，注释写在代码里，尽量用详细的语言描述代码含义。

    level-low

    存在万能密码，可绕过用户名

    1. low.php
    3.  
    4. if( isset( $_GET[ 'Login' ] ) ) {		//isset函数检测变量非空且设置
    5. 	// Get username
    6. 	$user = $_GET[ 'username' ];		//GET方式接收用户名
    7.  
    8. 	// Get password
    9. 	$pass = $_GET[ 'password' ];		//GET方式接收密码
    10. 	$pass = md5( $pass );				//接收到的密码进行md5加密
    11.  
    12. 	// Check the database
    13. 	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    14. 	//直接交互数据库，用户名存在万能密码
    15.  
    16. 	/*var_dump($query);		//这里可以添加var_dump输出代码进行调式
    17. 	exit();*/
    18.  
    19. 	$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '
      ' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '
      '       );
    20. 	//直接将SQL语句的执行结果显示给客户端
    21. 	if( $result && mysqli_num_rows( $result ) == 1 ) {
    22. 		//mysqli_num_rows()接受一个结果对象作为参数，检索返回给定结果的行数。实践见下图
    23.  
    24. 		// Get users details
    25. 		$row    = mysqli_fetch_assoc( $result );
    26. 		//取一行比对
    27. 		$avatar = $row["avatar"];
    28.  
    29. 		// Login successful
    30. 		$html .= "
      Welcome to the password protected area {$user}
      "      ;
    31. 		$html .= "{$avatar}\" />";
    32. 		//成功输出xxx调用图片
    33. 	}
    34. 	else {
    35. 		// Login failed
    36. 		$html .= "

      Username and/or password incorrect.
      "      ;
    37. 	}
    38.  
    39. 	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
    40. }
    41.  
    42. ?>
    43. //为什么可以爆破，因为没用作任何限制

    数据库users表单是五行数据，使用mysqli_num_rows()返回总共的行数

     初级基本就这么多了

    level-medium

     这里相较于low，最大的区别点在于使用mysqli_real_escape_string()函数进行转义以防止恶意注入，所以万能密码登陆用不了了。

    但有可能存在宽字节绕过，这与本身使用的php版本有关，可参考之前文章的第三十六关：

    SQLI-labs靶场Less1-37详细学习记录（7400字总结）_身高两米不到的博客-CSDN博客

     

    level-high

    high和之前相比最大的区别点在于token认证

    1. high.php
    3.  
    4. if( isset( $_GET[ 'Login' ] ) ) {
    5. 	// Check Anti-CSRF token
    6. 	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
    7.     //调用checkToken
    8. 	// Sanitise username input
    9. 	$user = $_GET[ 'username' ];
    10. 	$user = stripslashes( $user );        //删除反斜杠，防注入的
    11. 	$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    12.  
    13. 	// Sanitise password input
    14. 	$pass = $_GET[ 'password' ];
    15. 	$pass = stripslashes( $pass );
    16. 	$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    17. 	$pass = md5( $pass );
    18.  
    19. 	// Check database
    20. 	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    21. 	$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '
      ' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '
      '       );
    22.  
    23. 	if( $result && mysqli_num_rows( $result ) == 1 ) {
    24. 		// Get users details
    25. 		$row    = mysqli_fetch_assoc( $result );
    26. 		$avatar = $row["avatar"];
    27.  
    28. 		// Login successful
    29. 		$html .= "
      Welcome to the password protected area {$user}
      "      ;
    30. 		$html .= "{$avatar}\" />";
    31. 	}
    32. 	else {
    33. 		// Login failed
    34. 		sleep( rand( 0, 3 ) );
    35.         //随机slep0-3秒
    36. 		$html .= "

      Username and/or password incorrect.
      "      ;
    37. 	}
    38.  
    39. 	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
    40. }
    41.  
    42. // Generate Anti-CSRF token
    43. generateSessionToken();
    44.  
    45. ?>

     跟进到checkToken方法，设置三个参数，如果user_token不等于session_token或者session_token为空，调用dvwaRedirect方法。

    跟进到dvwaRedirect，发现起到跳转作用

     F12可以查看随机生成的token，token爆破绕过可以参考之前文章

     level-impossiable

    既然是impossibale，那以咱水平肯定绕不过去，直接看代码，代码对防注入方面使用了PDO预处理，对于爆破而言最狗的是设置次数。实际目标站点渗透可以死猜个用户名，然后弱密码隔断时间试试，至于hw还是早点溜了。

    1. impossiable.php
    3.  
    4. if( isset( $_POST[ 'Login' ] ) && isset ($_POST['username']) && isset ($_POST['password']) ) {
    5. 	// Check Anti-CSRF token
    6. 	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
    7.  
    8. 	// Sanitise username input
    9. 	$user = $_POST[ 'username' ];		//改成POST提交账号密码
    10. 	$user = stripslashes( $user );
    11. 	$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    12.  
    13. 	// Sanitise password input
    14. 	$pass = $_POST[ 'password' ];
    15. 	$pass = stripslashes( $pass );
    16. 	$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    17. 	$pass = md5( $pass );
    18. 	//前面还是token，以及防注入的函数使用
    19.  
    20. 	// Default values
    21. 	$total_failed_login = 3;			//登陆次数失败三次
    22. 	$lockout_time       = 15;			//等十五分钟
    23. 	$account_locked     = false;		//判断用户是否锁定
    24.  
    25. 	// Check the database (Check user information)
    26. 	$data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
    27. 	$data->bindParam( ':user', $user, PDO::PARAM_STR );
    28. 	//使用PDO
    29. 	$data->execute();
    30. 	$row = $data->fetch();
    31.  
    32. 	// Check to see if the user has been locked out.
    33. 	if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
    34. 		// User locked out.  Note, using this method would allow for user enumeration!
    35. 		//$html .= "

      This account has been locked due to too many incorrect logins.
      ";
    36.  
    37. 		// Calculate when the user would be allowed to login again
    38. 		$last_login = strtotime( $row[ 'last_login' ] );
    39. 		$timeout    = $last_login + ($lockout_time * 60);
    40. 		$timenow    = time();
    41.  
    42. 		/*
    43. 		print "The last login was: " . date ("h:i:s", $last_login) . "
      ";
    44. 		print "The timenow is: " . date ("h:i:s", $timenow) . "
      ";
    45. 		print "The timeout is: " . date ("h:i:s", $timeout) . "
      ";
    46. 		*/
    47.  
    48. 		// Check to see if enough time has passed, if it hasn't locked the account
    49. 		if( $timenow < $timeout ) {
    50. 			$account_locked = true;
    51. 			// print "The account is locked
      ";
    52. 		}
    53. 	}
    54.  
    55. 	// Check the database (if username matches the password)
    56. 	$data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
    57. 	$data->bindParam( ':user', $user, PDO::PARAM_STR);
    58. 	$data->bindParam( ':password', $pass, PDO::PARAM_STR );
    59. 	$data->execute();
    60. 	$row = $data->fetch();
    61.  
    62. 	// If its a valid login...
    63. 	if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
    64. 		// Get users details
    65. 		$avatar       = $row[ 'avatar' ];
    66. 		$failed_login = $row[ 'failed_login' ];
    67. 		$last_login   = $row[ 'last_login' ];
    68.  
    69. 		// Login successful
    70. 		$html .= "
      Welcome to the password protected area {$user}
      "      ;
    71. 		$html .= "{$avatar}\" />";
    72.  
    73. 		// Had the account been locked out since last login?
    74. 		if( $failed_login >= $total_failed_login ) {
    75. 			$html .= "
      Warning: Someone might of been brute forcing your account.
      "      ;
    76. 			$html .= "
      Number of login attempts: {$failed_login}.
      Last login attempt was at: ${last_login}.
      "      ;
    77. 		}
    78.  
    79. 		// Reset bad login count
    80. 		$data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
    81. 		$data->bindParam( ':user', $user, PDO::PARAM_STR );
    82. 		$data->execute();
    83. 	} else {
    84. 		// Login failed
    85. 		sleep( rand( 2, 4 ) );
    86.  
    87. 		// Give the user some feedback
    88. 		$html .= "

      Username and/or password incorrect.

      Alternative, the account has been locked because of too many failed logins.
      If this is the case, please try again in {$lockout_time} minutes.
      "      ;
    89.  
    90. 		// Update bad login count
    91. 		$data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
    92. 		$data->bindParam( ':user', $user, PDO::PARAM_STR );
    93. 		$data->execute();
    94. 	}
    95.  
    96. 	// Set the last login time
    97. 	$data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
    98. 	$data->bindParam( ':user', $user, PDO::PARAM_STR );
    99. 	$data->execute();
    100. }
    101.  
    102. // Generate Anti-CSRF token
    103. generateSessionToken();
    104.  
    105. ?>

    关于PDO预编译防注入原理推荐文章：

    奇安信攻防社区-SQL注入&预编译

    0x02  总结

    工作一年多重回校园，以打工人身份又转变到学生，这段时间开始忙碌，没有办法，作业考试太多。。。

  • 相关阅读:
    HLS 的新特性
    Java实现音频转码，WAV、MP3、AMR互转
    Spring 篇
    leetcode-48.旋转图像
    计算机毕业设计Java点餐系统的设计与实现(源码+系统+mysql数据库+lw文档)
    JAVA中常用的10个Lambda表达式
    Unity Rain Ai 插件的使用入门
    .c文件怎么变成可执行的应用程序的？
    数字孪生在灌区信息中的应用
    linux中用date命令获取昨天、明天或多天前后的日期
  • 原文地址：https://blog.csdn.net/m0_60988110/article/details/127778066