├── requirements.txt
├── README.md
└── phpinfo.py


/requirements.txt:
--------------------------------------------------------------------------------
1 | requests
2 | bs4
3 | tabulate
4 | wcwidth


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ## Phpinfo Scanner
 2 | 抓取phpinfo重要信息，搬砖小工具，无难度。。。
 3 | 效果展示：
 4 | ```
 5 | +------------------------+------------------------------------------------------------------------------------------+
 6 | | Web Path               | /var/www/html/info.php                                                                   |
 7 | | Server IP              | 172.16.72.131                                                                            |
 8 | | Software               | nginx/1.15.8                                                                             |
 9 | | PHP Version            | 7.0.33                                                                                   |
10 | | System                 | Linux ubuntu 4.4.0-131-generic #157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 x86_64       |
11 | | Server API             | FPM/FastCGI                                                                              |
12 | | Registered PHP Streams | https, ftps, compress.zlib, compress.bzip2, php, file, glob, data, http, ftp, phar, zip  |
13 | | Allow Url Include      | Off, Off                                                                                 |
14 | | Short Open Tag         | On, On                                                                                   |
15 | | Enable Dl              | On, On                                                                                   |
16 | | Open Basedir           | no value, no value                                                                       |
17 | | Session                | session.serialize_handler:       php,php                                                 |
18 | |                        | session.upload_progress.enabled: On,On                                                   |
19 | |                        | session.upload_progress.cleanup: On,On                                                   |
20 | |                        | session.upload_progress.name:    PHP_SESSION_UPLOAD_PROGRESS,PHP_SESSION_UPLOAD_PROGRESS |
21 | | Libxml Version         | 2.9.3                                                                                    |
22 | | Disable Function       | no value                                                                                 |
23 | | Extentions             | xdebug                                                                                   |
24 | +------------------------+------------------------------------------------------------------------------------------+
25 | +--------------------------------------------------------------+
26 | | php 7.0: 移除dl; 不再支持asp_tag、<script language="php"> |
27 | +--------------------------------------------------------------+
28 | | SAPI为fpm，可能存在未授权访问漏洞                         |
29 | +--------------------------------------------------------------+
30 | | 支持phar协议，可扩展反序列化攻击面                        |
31 | +--------------------------------------------------------------+
32 | | libcurl支持gopher, dict协议                               |
33 | +--------------------------------------------------------------+
34 | | 可利用session.upload_progress上传临时文件然后包含         |
35 | | 临时文件会立刻删除，需用条件竞争getshell                     |
36 | +--------------------------------------------------------------+
37 | ```
38 | 


--------------------------------------------------------------------------------
/phpinfo.py:
--------------------------------------------------------------------------------
  1 | #-*- coding:utf-8 -*-
  2 | import re
  3 | import requests
  4 | import sys
  5 | from bs4 import BeautifulSoup, element
  6 | from tabulate import tabulate
  7 | import wcwidth
  8 | import pprint
  9 | 
 10 | #将重要信息取出，转化为dict
 11 | def info_to_dict(html):
 12 |     phpinfo_dict = {}
 13 |     #基本信息
 14 |     phpinfo_dict["Baseinfo"] = {}
 15 |     base_info_table = html.select("body > div > table:nth-child(2)")[0] if len(html.select("body > div > table:nth-child(2)")) != 0 else html.select("body > div > table:nth-child(3)")[0]
 16 |     for tr in base_info_table.find_all("tr"):
 17 |         key   = tr.select("td.e")[0].string.strip()
 18 |         value = tr.select("td.v")[0].string.strip()
 19 |         phpinfo_dict["Baseinfo"][key] = value
 20 | 
 21 |     for h2 in html.find_all("h2"):
 22 |         module_name = h2.string.strip()
 23 |         phpinfo_dict[module_name] = {}
 24 |         #每一个配置模块是从h2标题开始的，向下寻找所有的table标签
 25 |         #有一个特殊情况PHP Credits，它在h1标签中，其内容是php及其sapi、module等的作者，对脚本功能没有意义，所以不解析
 26 |         for sibling in h2.next_siblings:
 27 |             #使用next_siblings会匹配到许多\n \t等，需特殊处理，官方文档明确提到
 28 |             if sibling.name != "table" and type(sibling) != element.NavigableString and sibling.name != "br":
 29 |                 break
 30 |             if sibling.name == "table":
 31 |                 for tr in sibling.find_all("tr"):
 32 |                     key_elements = tr.select("td.e")
 33 |                     if len(key_elements) == 0:
 34 |                         continue
 35 |                     key = key_elements[0].string.strip()
 36 | 
 37 |                     value_elements = tr.select("td.v")
 38 |                     if len(value_elements) == 0:
 39 |                         value = ''
 40 |                     elif len(value_elements) == 2:
 41 |                         # 有些配置的value分为Local Value和Master Value
 42 |                         # local value是当前目录的设置，会受.htaccess、.user.ini、代码中ini_set()等的影响
 43 |                         # master value是php.ini中的值
 44 |                         value = [value_elements[0].string.strip(), value_elements[1].string.strip()]
 45 |                     else:
 46 |                         value = "no value" if value_elements[0].string == None else value_elements[0].string.strip()
 47 |                     phpinfo_dict[module_name][key] = value
 48 |     
 49 |     #windos _SERVER["xx"]
 50 |     #linux $_SERVER['xx']
 51 |     #消除这种差异
 52 |     php_var_dict = {}
 53 |     if list(phpinfo_dict["PHP Variables"].keys())[0][0] == "_":
 54 |         for key in phpinfo_dict["PHP Variables"].keys():
 55 |             new_key = "$" + key.replace('"', "'")
 56 |             php_var_dict[new_key] = phpinfo_dict["PHP Variables"][key]
 57 |         phpinfo_dict["PHP Variables"] = php_var_dict
 58 |     return phpinfo_dict
 59 | 
 60 | #获取关键信息
 61 | def get_important_info(phpinfo_dict):
 62 |     result = []
 63 |     #web目录
 64 |     result.append(["Web Path", phpinfo_dict["PHP Variables"]["$_SERVER['SCRIPT_FILENAME']"]])
 65 |     #真实ip
 66 |     server_ip = phpinfo_dict["PHP Variables"]["$_SERVER['LOCAL_ADDR']"] if "$_SERVER['LOCAL_ADDR']" in phpinfo_dict["PHP Variables"] else phpinfo_dict["PHP Variables"]["$_SERVER['SERVER_ADDR']"]
 67 |     result.append(["Server IP", server_ip])
 68 |     #中间件
 69 |     result.append(["Software", phpinfo_dict["PHP Variables"]["$_SERVER['SERVER_SOFTWARE']"]])
 70 |     #php版本
 71 |     phpversion = phpinfo_dict["Core"]["PHP Version"]
 72 |     result.append(["PHP Version", phpversion])
 73 |     #系统信息
 74 |     result.append(["System", phpinfo_dict["Baseinfo"]["System"]])
 75 |     #SAPI
 76 |     result.append(["Server API", phpinfo_dict["Baseinfo"]["Server API"]])
 77 |     #Registered PHP Streams
 78 |     result.append(["Registered PHP Streams", phpinfo_dict["Baseinfo"]["Registered PHP Streams"]])
 79 |     #allow_url_include
 80 |     result.append(["Allow Url Include", ", ".join(phpinfo_dict["Core"]["allow_url_include"])])
 81 |     #asp_tags
 82 |     #php7之后已移除
 83 |     if "asp_tags" in phpinfo_dict["Core"]:
 84 |         result.append(["Asp Tags", ", ".join(phpinfo_dict["Core"]["asp_tags"])])
 85 |     #short_open_tag
 86 |     result.append(["Short Open Tag", ", ".join(phpinfo_dict["Core"]["short_open_tag"])])
 87 |     #enable_dl
 88 |     result.append(["Enable Dl", ", ".join(phpinfo_dict["Core"]["enable_dl"])])
 89 |     #open_basedir
 90 |     result.append(["Open Basedir", ", ".join(phpinfo_dict["Core"]["open_basedir"])])
 91 |     #session
 92 |     ser_handler = ",".join(phpinfo_dict["session"]["session.serialize_handler"])
 93 |     upload_progress_enabled = ",".join(phpinfo_dict["session"]["session.upload_progress.enabled"])
 94 |     upload_progress_cleanup = ",".join(phpinfo_dict["session"]["session.upload_progress.cleanup"])
 95 |     upload_progress_name = ",".join(phpinfo_dict["session"]["session.upload_progress.name"])
 96 |     session_info = "session.serialize_handler:       %s\nsession.upload_progress.enabled: %s\nsession.upload_progress.cleanup: %s\nsession.upload_progress.name:    %s" % (ser_handler, upload_progress_enabled, upload_progress_cleanup, upload_progress_name)
 97 |     result.append(["Session", session_info])
 98 |     #curl
 99 |     #if  "curl" in phpinfo_dict:
100 |         #result.append(["Curl Protocols", phpinfo_dict["curl"]["Protocols"].replace(" ", "")])
101 |     #libxml
102 |     if "libxml" in phpinfo_dict:
103 |         result.append(["Libxml Version", phpinfo_dict["libxml"]["libXML Compiled Version"]])
104 |     #disable function
105 |     disable_func = phpinfo_dict["Core"]["disable_functions"][0]
106 |     result.append(["Disable Function", disable_func.replace(",", "\n")])
107 |     #extentions
108 |     extentions = ["imagick", "memcache", "redis", "xdebug", "opcache", "imap"]
109 |     exist_ext = []
110 |     for ext in extentions:
111 |         if ext in phpinfo_dict:
112 |             exist_ext.append(ext)
113 |     intresting_exts = "No Intrestring Ext" if len(exist_ext) == 0 else ", ".join(exist_ext)
114 |     result.append(["Extentions", intresting_exts])
115 | 
116 |     return tabulate(result, tablefmt="psql")
117 | 
118 | #解析获取到的信息，如bypass_disable_function、php版本特性等
119 | def get_parsed_info(phpinfo_dict):
120 |     result = []
121 |     #php version
122 |     suggestion = get_version_feature(phpinfo_dict["Core"]["PHP Version"])
123 |     if suggestion:
124 |         result.append([suggestion])
125 |     #sapi
126 |     sapi = phpinfo_dict["Baseinfo"]["Server API"]
127 |     if "FPM" in sapi:
128 |         result.append(["SAPI为fpm，可能存在未授权访问漏洞"])
129 |     #phar
130 |     if "phar" in phpinfo_dict["Baseinfo"]["Registered PHP Streams"]:
131 |         result.append(["支持phar协议，可扩展反序列化攻击面"])
132 |     #ssrf curl php_wrapper
133 |     protocols = ["gopher", "dict"]
134 |     available_protocols = []
135 |     if "curl" in phpinfo_dict:
136 |         for protocol in protocols:
137 |             if protocol in phpinfo_dict["curl"]["Protocols"]:
138 |                 available_protocols.append(protocol)
139 |         result.append(["libcurl支持%s协议" % (", ".join(available_protocols))])
140 |     #libxml版本
141 |     if "libxml" in phpinfo_dict and phpinfo_dict["libxml"]["libXML Compiled Version"] < "2.9":
142 |         result.append(["libxml版本 < 2.9 xxe可利用"])
143 |     #session upload progress
144 |     if phpinfo_dict["session"]["session.upload_progress.enabled"][0] == "On":
145 |         suggestion = "可利用session.upload_progress上传临时文件然后包含"
146 |         if phpinfo_dict["session"]["session.upload_progress.cleanup"][0] == "On":
147 |             suggestion += "\n临时文件会立刻删除，需用条件竞争getshell"
148 |         result.append([suggestion])
149 |     #session ser handler
150 |     if phpinfo_dict["session"]["session.serialize_handler"][0] != phpinfo_dict["session"]["session.serialize_handler"][1]:
151 |         result.append(["ser handler不一致，存在反序列化风险"])
152 |     #imagick
153 |     if "imagick" in phpinfo_dict:
154 |         result.append(["可利用imagick相关漏洞"])
155 |     #xdebug
156 |     if "xdebug" in phpinfo_dict and phpinfo_dict["xdebug"]["xdebug.remote_connect_back"][0] == "On" and phpinfo_dict["xdebug"]["xdebug.remote_enable"][0] == "On":
157 |         result.append(["存在xdebug rce https://github.com/vulhub/vulhub/tree/master/php/xdebug-rce\nxdebug idekey: " + phpinfo_dict["xdebug"]["xdebug.idekey"][0]])
158 |     #opcache
159 |     if "opcache" in phpinfo_dict:
160 |         result.append(["可上传opcache覆盖源文件"])
161 |     #imap
162 |     if "imap" in phpinfo_dict:
163 |         result.append(["可能存在imap rce https://github.com/vulhub/vulhub/blob/master/php/CVE-2018-19518/README.md"])
164 |     #disable function
165 |     if phpinfo_dict["Core"]["disable_functions"][0] != "no value":
166 |         result.append([bypass_disable_function(phpinfo_dict["Core"]["disable_functions"][0], phpinfo_dict)])
167 |     return tabulate(result, tablefmt="grid")
168 | 
169 | #根据版本获取版本特性
170 | def get_version_feature(version):
171 |     suggestion = ""
172 |     if "7.2" in version:
173 |         suggestion = "php 7.2: assert从函数变为语法结构，无法动态调用; 移除create_function"
174 |     if "7.0" in version:
175 |         suggestion = "php 7.0: 移除dl; 不再支持asp_tag、<script language=\"php\">"
176 |     return suggestion
177 | 
178 | #如果存在disable_function，寻找可能的bypass
179 | def bypass_disable_function(disable_func, phpinfo_dict):
180 |     disable_func = disable_func.split(",")
181 |     suggestion = ""
182 |     bypass_func = []
183 | 
184 |     if "dl" not in disable_func and phpinfo_dict["Core"]["enable_dl"] == "On":
185 |         bypass_func.append("dl")
186 |     if "pcntl_exec" not in disable_func and "--enable-pcntl" in phpinfo_dict["Baseinfo"]["Configure Command"]:
187 |         bypass_func.append("pcntl_exec")
188 |     common_funcs = ['exec', 'system', 'passthru', 'popen', 'proc_open', 'shell_exec']
189 |     for func in common_funcs:
190 |         if func not in disable_func:
191 |             bypass_func.append(func)
192 |     suggestion += "可用函数：" + ", ".join(bypass_func) + "\n"
193 | 
194 |     if "Linux" in phpinfo_dict["Baseinfo"]["System"] and "putenv" not in disable_func and "mail" not in disable_func:
195 |         suggestion += "使用LD_PRELOAD https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD\n"
196 |     if "imap" in phpinfo_dict:
197 |         suggestion += "使用imap https://github.com/vulhub/vulhub/blob/master/php/CVE-2018-19518/README.md\n"
198 |     if "imagemagick" in phpinfo_dict:
199 |         suggestion += "使用 ImageMagick\n"
200 |     suggestion += "disable function bypass合集 https://github.com/l3m0n/Bypass_Disable_functions_Shell"
201 |     return suggestion
202 | 
203 | def parse_phpinfo(url):
204 |     r = requests.get(url)
205 |     #print(r.text)
206 |     html = BeautifulSoup(r.text, "lxml")
207 |     phpinfo_dict = info_to_dict(html)
208 |     #pprint.pprint(phpinfo_dict)
209 |     print(get_important_info(phpinfo_dict))
210 |     print(get_parsed_info(phpinfo_dict))
211 | 
212 | if __name__ == "__main__":
213 |     url = sys.argv[1]
214 |     parse_phpinfo(url)
215 | 


--------------------------------------------------------------------------------