https://blog.dansec.vip/tags/debug/ Recent content in Debug on Dan`s Blog Hugo zh-CN Wed, 25 Dec 2024 19:06:13 +0800 https://blog.dansec.vip/p/phpsrcdebug/ Wed, 25 Dec 2024 19:06:13 +0800 https://blog.dansec.vip/p/phpsrcdebug/ <h1 id="期望效果">期望效果</h1> <p>比如某个php文件内容如下</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-php" data-lang="php"><span class="line"><span class="cl"><span class="o">&lt;?</span><span class="nx">php</span> </span></span><span class="line"><span class="cl"><span class="nx">error_reporting</span><span class="p">(</span><span class="mi">0</span><span class="p">);</span> </span></span><span class="line"><span class="cl"><span class="nv">$strr</span> <span class="o">=</span> <span class="s2">&#34;&lt;?php exit();&#34;</span><span class="p">;</span> </span></span><span class="line"><span class="cl"><span class="nv">$r</span> <span class="o">=</span> <span class="nx">preg_replace</span><span class="p">(</span><span class="s1">&#39;|[^a-z0-9A-Z+/]|s&#39;</span><span class="p">,</span> <span class="s1">&#39;&#39;</span><span class="p">,</span> <span class="nv">$strr</span><span class="p">);</span> </span></span><span class="line"><span class="cl"><span class="nx">var_dump</span><span class="p">(</span><span class="nv">$r</span><span class="p">);</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="nv">$a1</span> <span class="o">=</span> <span class="nx">base64_decode</span><span class="p">(</span><span class="nv">$r</span><span class="p">);</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="nx">file_put_contents</span><span class="p">(</span><span class="s1">&#39;php://filter/convert.base64-decode|convert.iconv.UCS-2LE.UCS-2BE/resource=shell.php&#39;</span><span class="p">,</span><span class="nv">$strr</span><span class="p">);</span> </span></span><span class="line"><span class="cl"><span class="nv">$a2</span> <span class="o">=</span> <span class="nx">file_get_contents</span><span class="p">(</span><span class="s1">&#39;shell.php&#39;</span><span class="p">);</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="nx">var_dump</span><span class="p">(</span><span class="nv">$a1</span> <span class="o">===</span> <span class="nv">$a2</span><span class="p">);</span> </span></span></code></pre></td></tr></table> </div> </div><p>运行脚本的命令为：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">php test.php </span></span></code></pre></td></tr></table> </div> </div><p>对于该脚本来说：</p> <ol> <li>我无法得知<code>file_put_contents()</code>的内部实现流程</li> <li>我无法得知<code>php://filter</code>伪协议的具体实现</li> </ol> <p>这些当然可以通过看源码来获取，但是如果能实现对<code>php</code>的<code>debug</code>，那岂不是美哉</p>