利用目录遍历攻击执行命令
有没有办法使用目录遍历攻击来执行命令？
例如，我像这样访问服务器的 etc/passwd 文件
http://server.com/..%01/..%01/..%01//etc/passwd
有没有办法改为运行命令？就像......
http://server.com/..%01/..%01/..%01//ls
并得到输出？
需要澄清的是，我在我们公司的服务器中发现了该漏洞。我希望通过证明它可以让攻击者完全访问系统来提高风险级别（或对我来说是加分）
Is there a way to execute commands using directory traversal attacks?
For instance, I access a server's etc/passwd file like this
http://server.com/..%01/..%01/..%01//etc/passwd
Is there a way to run a command instead? Like...
http://server.com/..%01/..%01/..%01//ls
..... and get an output?
To be clear here, I've found the vuln in our company's server. I'm looking to raise the risk level (or bonus points for me) by proving that it may give an attacker complete access to the system
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
Linux 上的 Chroot 很容易被破坏（与 FreeBSD 不同）。更好的解决方案是打开 SELinux 并在 SELinux 沙箱中运行 Apache：
确保已安装 mod_security 并正确配置。
Chroot on Linux is easily breakable (unlike FreeBSD). Better solution is to switch on SELinux and run Apache in SELinux sandbox:
Make sure you have mod_security installed and properly configured.
如果由于服务器上未正确配置文档根或目录访问权限而导致您能够查看 /etc/passwd，则此漏洞的存在并不自动意味着您可以执行以下命令你的选择。
另一方面，如果由于 Web 应用程序在 popen、exec、system、shell_exec 或未经充分清理的变体等调用中使用用户输入（文件名）而能够查看 /etc/passwd 中的条目，那么您可能会能够执行任意命令。
If you are able to view /etc/passwd as a result of the document root or access to Directory not correctly configured on the server, then the presence of this vulnerability does not automatically mean you can execute commands of your choice.
On the other hand if you are able view entries from /etc/passwd as a result of the web application using user input (filename) in calls such as popen, exec, system, shell_exec, or variants without adequate sanitization, then you may be able to execute arbitrary commands.
除非网络服务器是由不知道自己在做什么的人完全可怕地编程的，否则尝试使用它访问
ls（假设它甚至有效）将导致您看到的内容ls二进制文件，仅此而已。这可能不是很有用。
Unless the web server is utterly hideously programmed by someone with no idea what they're doing, trying to access
lsusing that (assuming it even works) would result in you seeing the contents of thelsbinary, and nothing else.Which is probably not very useful.
是的，如果应用程序真的很糟糕（就安全性而言），则有可能（第一个问题）。
http://www.owasp.org/index.php/Top_10_2007-Malicious_File_Execution
Yes it is possible (the first question) if the application is really really bad (in terms of security).
http://www.owasp.org/index.php/Top_10_2007-Malicious_File_Execution
编辑#2：我已经删除了我的评论，因为它们被认为是讽刺和直率的。好吧，现在更多信息来自 gAMBOOKa，Apache 与 Fedora - 您应该将其放入问题中 - 我建议：
希望这有帮助，
此致，
汤姆.
Edit#2: I have edited out my comments as they were deemed sarcastic and blunt. Ok now as more information came from gAMBOOKa about this, Apache with Fedora - which you should have put into the question - I would suggest:
Hope this helps,
Best regards,
Tom.
如果您已经可以查看etc/passwd，那么服务器的配置一定很差......
如果你真的想执行命令，那么你需要知道服务器中运行的php脚本是否有system()命令，以便你可以通过url传递命令。
例如： url?command=ls
尝试查看 .htaccess 文件....它可能会成功..
If you already can view etc/passwd then the server must be poorly configured...
if you really want to execute commands then you need to know the php script running in the server whether there is any system() command so that you can pass commands through the url..
eg: url?command=ls
try to view the .htaccess files....it may do the trick..