ThinkPHP6í§ÒâÎļþ²Ù×÷Îó²îÆÊÎö
Ðû²¼Ê±¼ä 2020-01-14
2020Äê1ÔÂ10ÈÕ£¬ThinkPHPÍŶÓÐû²¼Ò»¸ö²¹¶¡¸üУ¬ÐÞ¸´ÁËÒ»´¦Óɲ»Çå¾²µÄSessionIdµ¼ÖµÄí§ÒâÎļþ²Ù×÷Îó²î¡£¸ÃÎó²îÔÊÐí¹¥»÷ÕßÔÚÄ¿µÄÇéÐÎÆôÓÃsessionµÄÌõ¼þϽ¨Éèí§ÒâÎļþÒÔ¼°É¾³ýí§ÒâÎļþ£¬ÔÚÌض¨ÇéÐÎÏ»¹¿ÉÒÔgetshell¡£
ÏêϸÊÜÓ°Ïì°æ±¾ÎªThinkPHP6.0.0-6.0.1¡£
Îó²î¸´ÏÖ
ÍâµØÇéÐνÓÄÉThinkPHP 6.0.1+PHP7.1.20+Apache¾ÙÐи´ÏÖ¡£ÔÚÌض¨ÇéÐÎÏÂÖ´ÐвâÊÔÑéÖ¤³ÌÐò¼´¿ÉдÈëÒ»¸öwebshell£¬ÈçÏÂͼ£º
Îó²îÆÊÎö
ƾ֤¹Ù·½githubµÄcommit£ºhttps://github.com/top-think/framework/commit/1bbe75019ce6c8e0101a6ef73706217e406439f2¡£
Òò¶øÍƲ⣬¿ÉÄÜÊÇÔÚ´æ´¢sessionʱµ¼ÖµÄÎļþдÈ롣Ȼºó£¬¸ú×Ù£ºvendor/topthink/framework/src/think/session/Store.php:254¡£
ÕâÀïŲÓÃÁËÒ»¸öwriteº¯Êý£¬¸ú½øһϣºvendor/topthink/framework/src/think/session/driver/File.php:210¡£
ŲÓÃwriteFileº¯Êý£¬¸úÈ룺
¹ûÕæÊÇдÈëÎļþµÄ²Ù×÷¡£
¼ÌÐø·´Ïò¿´Ò»ÏÂÎļþÃûÊÇ·ñ¿É¿Ø£¬¸ÃÎļþÃûÀ´×ÔÓÚ×î×îÏȵÄgetId()»ñµÃµÄ$sessionIdµÄÖµ¡£¼ÈÈ»ÓÐgetId£¬¾Í»áÓÐsetId£¬¿´Ò»Ïº¯ÊýÄÚÈÝ£º
µ±´«ÈëµÄ²ÎÊý$idÖª×ã32λµÄ³¤¶Èʱ£¬¾Í½«¸ÃÖµÉèΪ$this->id¡£Å²ÓÃsetIdµÄµØ·½Îª£ºvendor/topthink/framework/src/think/middleware/SessionInit.php:46¡£
ÕâÀïµÄ$cookieNameµÄÖµÊÇPHPSESSID¡£
¶ø$sessionIdÊÇcookieÖÐÃûΪPHPSESSIDµÄÖµ£¬Òò´ËÊǹ¥»÷Õ߿ɿصģ¬´Ó¶øµ¼ÖÂдÈëµÄÎļþÃû¿É¿Ø¡£
дÈëµÄÎļþÃû¿É¿Ø£¬ÄÇôдÈëµÄÄÚÈÝÊÇ·ñ¿É¿ØÄØ£¿ÆÊÎö·¢Ã÷£¬Ð´ÈëµÄÄÚÈݾÍÊǽ¨ÉèsessionʹÓõÄÄÚÈÝ¡£¿ÉÊÇsessionµÄ½¨ÉèÊÇÓÉÏÖʵµÄºó¶ËÓªÒµÂß¼À´¾öÒéµÄ£¬¶øĬÈÏÇéÐÎϲ¢Ã»Óн¨Éèsession¡£Òò´Ë£¬Ä¬ÈÏÇéÐÎÏÂÎÞ·¨×öµ½í§ÒâÎļþдÈë¡£
ÔÚ¶Ô¸ÃÎó²îµÄÉîÈëÆÊÎöÀú³ÌÖУ¬ÎÒÃÇ·¢Ã÷¸ÃÎó²î»¹¿ÉÒÔʵÏÖí§ÒâÎļþɾ³ý£¬ÇÒÎļþɾ³ý¶Ôºó¶ËÓªÒµÂß¼ÒÀÀµ½ÏµÍ¡£
ÕÕ¾ÉÔÚ vendor/topthink/framework/src/think/session/Store.php:254ÖУº
̫ͨ¹ýÎöÑéÖ¤£¬ÎÒÃÇ·¢Ã÷Îó²î£¨ÈçÉÏͼ£©»¹Äܵ¼ÖÂí§ÒâÎļþɾ³ý¡£
×Ü ½á
ÔÚÄ¿µÄÇéÐÎΪWindowsÇÒ¿ªÆôsessionµÄÇéÐÎÏ£¬ÈÝÒ×ÔâÊÜí§ÒâÎļþɾ³ý¹¥»÷¡£
ÔÚÄ¿µÄÇéÐοªÆôsessionÇÒдÈëµÄsession¿É¿ØµÄÇéÐÎÏ£¬ÈÝÒ×ÔâÊÜí§ÒâÎļþдÈë¹¥»÷¡£
½¨ÒéÏà¹ØÓû§ÊµÊ±Éý¼¶µ½ThinkPHP6.0.2°æ±¾£¬ÒÔÃâÔâÊܹ¥»÷¡£
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÆð¾¢·ÀÓùʵÑéÊÒ£¨ADLab£©
ADLab½¨ÉèÓÚ1999Ä꣬ÊÇÖйúÇå¾²ÐÐÒµ×îÔ罨ÉèµÄ¹¥·ÀÊÖÒÕÑо¿ÊµÑéÊÒÖ®Ò»£¬Î¢ÈíMAPPÍýÏë½¹µã³ÉÔ±£¬¡°ºÚȸ¹¥»÷¡±¿´·¨Ê×ÍÆÕß¡£×èÖ¹ÏÖÔÚ£¬ADLabÒÑͨ¹ýCVEÀÛ¼ÆÐû²¼Çå¾²Îó²î1000Óà¸ö£¬Í¨¹ý CNVD/CNNVDÀÛ¼ÆÐû²¼Çå¾²Îó²î600Óà¸ö£¬Ò»Á¬¼á³Ö¹ú¼ÊÍøÂçÇå¾²ÁìÓòÒ»Á÷Ë®×¼¡£ÊµÑéÊÒÑо¿Æ«Ïòº¸Ç²Ù×÷ϵͳÓëÓ¦ÓÃϵͳÇå¾²Ñо¿¡¢Òƶ¯ÖÇÄÜÖÕ¶ËÇå¾²Ñо¿¡¢ÎïÁªÍøÖÇÄÜ×°±¸Çå¾²Ñо¿¡¢WebÇå¾²Ñо¿¡¢¹¤¿ØϵͳÇå¾²Ñо¿¡¢ÔÆÇå¾²Ñо¿¡£Ñо¿Ð§¹ûÓ¦ÓÃÓÚ²úÆ·½¹µãÊÖÒÕÑо¿¡¢¹ú¼ÒÖصã¿Æ¼¼ÏîÄ¿¹¥¹Ø¡¢×¨ÒµÇå¾²·þÎñµÈ¡£