Tokumaru-Seminar-oganyan4

Eval Injection

Transcript

1. FWBMΠϯδΣΫγϣϯ ಙؙษڧձ 
   ͓͕ʹΌΜ
2. FWBMͱ͸ ༩͑ΒΕͨจࣈྻΛεΫϦϓτͷιʔεͱͯ͠ ղऍ࣮ͯ͠ߦ͢Δػೳ $like = 'nogizaka'; $name = 'oganyan'; $str = '$name likes $like.'; echo $str . "\n"; eval("\$str = \"$str\";"); echo $str . "\n"; $name likes $like. oganyan likes nogizaka. $str = "$name likes $like.";
3. FWBMͱ͸ ͷ
4. FWBMΠϯδΣΫγϣϯ FWBMͷར༻๏ʹ໰୊͕͋Δ৔߹ʹɺ
 ֎෦͔ΒૹΓࠐ·ΕͨεΫϦϓτ͕࣮ߦ͞Εͯ ͠·͏੬ऑੑ
   ૝ఆ͞ΕΔओͳඃ֐
   w৘ใ࿙Ӯ
   wαΠτվ͟Μ
   wෆਖ਼ͳػೳ࣮ߦ ͗
5. FWBMΠϯδΣΫγϣϯ $a = array(1, 2, 3); $ex = var_export($a, true); $b64 = base64_encode($ex); Τϯίʔυ $data = $_GET['data']; $str = base64_decode($data); eval('$a = ' . $str . ';'); var_dump($a); σίʔυ "YXJyYXkgKAogIDAgPT4gMSwKI CAxID0+IDIsCiAgMiA9PiAzLAo p" array(1, 2, 3) "array ( 0 => 1, 1 => 2, 2 => 3, )" WBS@FYQPSU FWBM EFDPEF FODPEF ͟
6. FWBMΠϯδΣΫγϣϯ "MDsgcGhwaW5mbygp" "0; phpinfo();" WBS@FYQPSU FWBM EFDPEF FODPEF http://example.jp/test.php? data=YXJyYXkgKAogIDAgPT4gMSwKICAxID0+IDIsCiAgMiA9PiAzLAop $a = 0; phpinfo(); http://example.jp/test.php?data=MDsgcGhwaW5mbygp ͔
7. ݪҼ w FWBMΛ༻͍Δ͜ͱ͕ͦ΋ͦ΋ةݥ
   w FWBMʹ༩͑ΔύϥϝʔλͷνΣοΫΛ
 ͍ͯ͠ͳ͍ 
8. ରࡦ w FWBMΛ࢖Θͳ͍
   ഑ྻͷγϦΞϥΠζͳΒJNQMPEF
   FYQMPEF
   w FWBMʹ֎෦ύϥϝʔλΛ࢖༻͠ͳ͍
   w FWBMʹ༩͑Δ֎෦ύϥϝʔλΛӳ਺ࣈʹ੍ݶ 
9. FWBM࢖͏ͳɻ
10. ͓͠·͍