{"id":645,"date":"2025-12-08T20:02:38","date_gmt":"2025-12-08T12:02:38","guid":{"rendered":"https:\/\/www.52runoob.com\/?p=645"},"modified":"2025-12-08T20:02:38","modified_gmt":"2025-12-08T12:02:38","slug":"php%e6%96%87%e4%bb%b6%e8%af%bb%e5%8f%96%e6%bc%8f%e6%b4%9e%e5%89%96%e6%9e%90%e5%8f%8a%e9%98%b2%e5%be%a1%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.52runoob.com\/index.php\/2025\/12\/08\/php%e6%96%87%e4%bb%b6%e8%af%bb%e5%8f%96%e6%bc%8f%e6%b4%9e%e5%89%96%e6%9e%90%e5%8f%8a%e9%98%b2%e5%be%a1%e6%96%b9%e6%b3%95\/","title":{"rendered":"PHP\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u5256\u6790\u53ca\u9632\u5fa1\u65b9\u6cd5"},"content":{"rendered":"\n

\u4e0b\u9762\u7ed9\u4f60\u4e00\u4efd \u300aPHP \u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u5256\u6790\u53ca\u9632\u5fa1\u65b9\u6cd5\u300b\u5b8c\u6574\u6307\u5357\uff08\u542b\u539f\u7406 + \u5229\u7528\u65b9\u5f0f + \u9632\u5fa1\u4ee3\u7801\uff09<\/strong>\uff0c\u5185\u5bb9\u7ed3\u6784\u6e05\u6670\u3001\u76f4\u63a5\u53ef\u7528\u4e8e\u5b66\u4e60\u3001\u5199\u6587\u6863\u6216\u8f93\u51fa\u5230\u4f60\u7684\u7f51\u7ad9\u3002<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udee1 PHP \u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u5256\u6790\u53ca\u9632\u5fa1\u65b9\u6cd5\uff08\u5b8c\u6574\u6307\u5357\uff09<\/h1>\n\n\n\n

PHP \u4e2d\u7684\u6587\u4ef6\u8bfb\u53d6\u76f8\u5173\u51fd\u6570\u975e\u5e38\u5e38\u89c1\uff0c\u5982\uff1a<\/p>\n\n\n

\nfile_get_contents()\nfopen()\nreadfile()\ninclude \/ require\ninclude_once \/ require_once\n\n<\/pre><\/div>\n\n\n
\u5982\u679c\u5f00\u53d1\u65f6\u5904\u7406\u4e0d\u5f53\uff0c\u5c31\u4f1a\u51fa\u73b0 \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\uff08LFI\uff09<\/strong>\uff0c\u5e76\u53ef\u80fd\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3001\u4ee3\u7801\u6267\u884c\u3001\u670d\u52a1\u88ab\u653b\u7834\u3002<\/p>\n\n\n\n
\u672c\u6587\u5c06\u7cfb\u7edf\u89e3\u91ca\u4ea7\u751f\u539f\u56e0\u3001\u653b\u51fb\u65b9\u5f0f\u3001\u771f\u5b9e\u5229\u7528\u6848\u4f8b\uff0c\u5e76\u63d0\u4f9b\u5168\u9762\u7684\u9632\u5fa1\u7b56\u7565\u3002<\/p>\n\n\n\n
\n\n\n\n
\ud83d\udccc 1. \u4ec0\u4e48\u662f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\uff1f<\/h1>\n\n\n\n
\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\uff08LFI\uff09<\/strong> \u6307\u653b\u51fb\u8005\u901a\u8fc7\u53ef\u63a7\u53c2\u6570\uff0c\u8ba9\u670d\u52a1\u5668\u8bfb\u53d6\u4efb\u610f\u8def\u5f84\u4e0b\u7684\u6587\u4ef6\uff0c\u5982\uff1a<\/p>\n\n\n\n
    \n
  • \/etc\/passwd<\/code><\/li>\n\n\n\n
  • \u7f51\u7ad9\u7684\u00a0.env<\/code><\/li>\n\n\n\n
  • \u914d\u7f6e\u6587\u4ef6<\/li>\n\n\n\n
  • \u6e90\u4ee3\u7801\u6587\u4ef6<\/li>\n\n\n\n
  • session \u6587\u4ef6<\/li>\n\n\n\n
  • nginx\/apache \u914d\u7f6e\u7b49<\/li>\n<\/ul>\n\n\n\n
    \u5178\u578b\u4f8b\u5b50\uff08\u6f0f\u6d1e\u4ee3\u7801\uff09\uff1a<\/p>\n\n\n
    \n&lt;?php\n$file = $_GET['file'];\necho file_get_contents($file);\n?>\n\n<\/pre><\/div>\n\n\n
    \u653b\u51fb\u8005\u76f4\u63a5\u8bbf\u95ee\uff1a<\/p>\n\n\n
    \nhttp:\/\/site.com\/read.php?file=\/etc\/passwd\n\n<\/pre><\/div>\n\n\n
    \u5373\u53ef\u8bfb\u53d6\u7cfb\u7edf\u6587\u4ef6\u3002\u8fd9\u5c31\u662f LFI\u3002<\/p>\n\n\n\n
    \n\n\n\n
    \ud83d\udccc 2. \u5e38\u89c1\u7684\u6587\u4ef6\u8bfb\u53d6\u65b9\u5f0f\u4e0e\u5bf9\u5e94\u6f0f\u6d1e<\/h1>\n\n\n\n
    \u2726 2.1 \u4f7f\u7528 file_get_contents \u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\uff08\u6700\u5e38\u89c1\uff09<\/h2>\n\n\n
    \nfile_get_contents($_GET['path']);\n\n<\/pre><\/div>\n\n\n
    \u653b\u51fb\uff1a<\/p>\n\n\n
    \n?path=\/etc\/passwd\n\n<\/pre><\/div>\n\n\n
    \n\n\n\n
    \u2726 2.2 include \/ require \u5bfc\u81f4\u4ee3\u7801\u6267\u884c<\/h2>\n\n\n
    \ninclude $_GET['page'];\n\n<\/pre><\/div>\n\n\n
    \u653b\u51fb\u8005\u53ef\u4ee5\uff1a<\/p>\n\n\n\n
      \n
    • \u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9<\/strong><\/li>\n\n\n\n
    • \u6267\u884c\u6076\u610f\u4ee3\u7801<\/strong><\/li>\n<\/ul>\n\n\n\n
      \u5982\uff1a<\/p>\n\n\n
      \n?page=php:\/\/input\n\n<\/pre><\/div>\n\n\n
      \u7136\u540e POST malicious code\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \u2726 2.3 \u76ee\u5f55\u7a7f\u8d8a\u6f0f\u6d1e (..\/)<\/h2>\n\n\n\n
      \u653b\u51fb\u8005\u5229\u7528\uff1a<\/p>\n\n\n
      \n?file=..\/..\/..\/..\/etc\/passwd\n\n<\/pre><\/div>\n\n\n
      \u7a7f\u8d8a\u76ee\u5f55\u8bfb\u53d6\u654f\u611f\u6587\u4ef6\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \u2726 2.4 PHP stream wrapper \u7ed5\u8fc7\u8fc7\u6ee4<\/h2>\n\n\n\n
      \u5373\u4f7f\u4f60\u9650\u5236\u4e86 \u201c\u4e0d\u80fd\u51fa\u73b0 ..\/\u201d\uff0c\u653b\u51fb\u8005\u4ecd\u53ef\u4f7f\u7528\uff1a<\/p>\n\n\n\n
      Wrapper<\/th>\u4f5c\u7528<\/th><\/tr><\/thead>
      php:\/\/filter<\/code><\/td>\u8bfb\u53d6\u6e90\u7801\uff08\u7ed5\u8fc7 include \u6267\u884c\uff09<\/strong><\/td><\/tr>
      php:\/\/input<\/code><\/td>\u6ce8\u5165\u4ee3\u7801\u6267\u884c<\/td><\/tr>
      data:\/\/<\/code><\/td>\u6267\u884c\u811a\u672c<\/td><\/tr>
      file:\/\/<\/code><\/td>\u91cd\u65b0\u8bbf\u95ee\u7cfb\u7edf\u6587\u4ef6<\/td><\/tr>
      compress.zlib:\/\/<\/code><\/td>\u8bbf\u95ee\u538b\u7f29\u6587\u4ef6<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \u4f8b\u5982\u8bfb\u53d6 PHP \u6e90\u7801\uff1a<\/p>\n\n\n
      \n?page=php:\/\/filter\/convert.base64-encode\/resource=index.php\n\n<\/pre><\/div>\n\n\n
      \u7f51\u7ad9\u6e90\u7801\u88ab\u5b8c\u6574\u6cc4\u9732\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \ud83d\udccc 3. \u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u7684\u5229\u7528\u65b9\u5f0f\uff08\u9ed1\u5ba2\u80fd\u505a\u5230\u4ec0\u4e48\uff09<\/h1>\n\n\n\n
      \u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\uff1a<\/p>\n\n\n\n
      \u2714 3.1 \u8bfb\u53d6\u654f\u611f\u7cfb\u7edf\u6587\u4ef6<\/h3>\n\n\n
      \n\/etc\/passwd\n\/etc\/hosts\n\/proc\/self\/environ\n\n<\/pre><\/div>\n\n\n
      \u2714 3.2 \u8bfb\u53d6\u6570\u636e\u5e93\u5bc6\u7801 .env<\/code>\u3001\u914d\u7f6e .ini<\/code><\/h3>\n\n\n
      \n\/var\/www\/html\/.env\nconfig.php\nwp-config.php\n\n<\/pre><\/div>\n\n\n
      \u2714 3.3 \u8bfb\u53d6 session \u6587\u4ef6 \u2192 \u767b\u5f55\u540e\u53f0<\/h3>\n\n\n\n
      \u2714 3.4 \u901a\u8fc7 include \u76f4\u63a5\u6267\u884c\u6076\u610f\u4ee3\u7801\uff08RCE\uff09<\/h3>\n\n\n\n
      \u7ed3\u5408\uff1a<\/p>\n\n\n
      \nphp:\/\/input\ndata:\/\/\n\n<\/pre><\/div>\n\n\n
      \u653b\u51fb\u8005\u53ef\u4ee5\u83b7\u5f97\u670d\u52a1\u5668\u6743\u9650<\/strong>\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \ud83d\udccc 4. \u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u771f\u5b9e\u6848\u4f8b<\/h1>\n\n\n\n
      \u771f\u5b9e\u751f\u4ea7\u73af\u5883\u4e2d\u6700\u5e38\u89c1\u4f8b\u5b50\uff1a<\/p>\n\n\n\n
      \u274c \u9519\u8bef\u4ee3\u7801<\/h3>\n\n\n
      \n$file = $_GET["page"];\ninclude $file;\n\n<\/pre><\/div>\n\n\n
      \u653b\u51fb\u65b9\u5f0f\uff1a<\/h3>\n\n\n\n
      \u2460 \u8bfb\u53d6 PHP \u6e90\u7801\uff1a<\/strong><\/p>\n\n\n
      \n?page=php:\/\/filter\/convert.base64-encode\/resource=index.php\n\n<\/pre><\/div>\n\n\n
      \u2461 \u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\uff1a<\/strong><\/p>\n\n\n
      \n?page=php:\/\/input\n\n<\/pre><\/div>\n\n\n
      POST \u6570\u636e\uff1a<\/p>\n\n\n
      \n&lt;?php system('id'); ?>\n\n<\/pre><\/div>\n\n\n
      \u670d\u52a1\u5668\u6743\u9650\u88ab\u62ff\u4e0b\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \ud83d\udccc 5. \u5982\u4f55\u5f7b\u5e95\u9632\u5fa1 PHP \u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\uff1f<\/h1>\n\n\n\n
      \u8fd9\u662f\u6700\u91cd\u8981\u90e8\u5206\uff01\u4e0b\u9762\u7ed9\u4f60\u6700\u4f73\u9632\u5fa1\u7b56\u7565 + \u4ee3\u7801\u793a\u4f8b<\/strong>\u3002<\/p>\n\n\n\n
      \n\n\n\n
      \u2714 5.1 \u4e0d\u8981\u76f4\u63a5\u4f7f\u7528\u7528\u6237\u8f93\u5165\u7684\u8def\u5f84<\/h1>\n\n\n
      \n$file = $_GET['file'];\nfile_get_contents($file);  \/\/ \u274c \u975e\u5e38\u5371\u9669\n\n<\/pre><\/div>\n\n\n
      \u2713 \u5fc5\u987b\u505a \u767d\u540d\u5355<\/strong> \u6216 \u56fa\u5b9a\u76ee\u5f55\u9650\u5236<\/strong><\/p>\n\n\n\n
      \n\n\n\n
      \u2714 5.2 \u4f7f\u7528\u767d\u540d\u5355\uff08\u6700\u6709\u6548\uff09<\/h1>\n\n\n
      \n$allow = [\n  "about.html",\n  "contact.html",\n  "help.html"\n];\n\n$file = $_GET["file"];\nif (!in_array($file, $allow)) {\n    die("Access denied");\n}\n\necho file_get_contents("pages\/" . $file);\n\n<\/pre><\/div>\n\n\n
      \n\n\n\n
      \u2714 5.3 \u9650\u5236\u76ee\u5f55\uff1a\u7981\u6b62\u8df3\u51fa\u6307\u5b9a\u76ee\u5f55\uff08realpath\uff09<\/h1>\n\n\n
      \n$base = realpath(".\/uploads");\n$path = realpath($base . "\/" . $_GET['file']);\n\nif (strpos($path, $base) !== 0) {\n    die("Invalid path");\n}\n\necho file_get_contents($path);\n\n<\/pre><\/div>\n\n\n
      \n\n\n\n
      \u2714 5.4 \u7981\u6b62 wrapper\uff08\u5f3a\u70c8\u5efa\u8bae\uff09<\/h1>\n\n\n
      \nif (preg_match('\/^php:\\\/\\\/|^data:|^compress\\.zlib:|^phar:|^glob:\/i', $_GET['file'])) {\n    die("Illegal wrapper");\n}\n\n<\/pre><\/div>\n\n\n
      \n\n\n\n
      \u2714 5.5 \u7981\u6b62\u51fa\u73b0\u76ee\u5f55\u7a7f\u8d8a (..\/)<\/h1>\n\n\n
      \nif (strpos($_GET['file'], "..") !== false) {\n    die("Illegal path");\n}\n\n<\/pre><\/div>\n\n\n
      \n\n\n\n
      \u2714 5.6 include\/require \u53ea\u80fd\u7528\u4e8e \u56fa\u5b9a\u6587\u4ef6<\/strong><\/h1>\n\n\n\n
      \u4e0d\u8981\u8fd9\u6837\uff1a<\/p>\n\n\n
      \ninclude $_GET['page'];   \/\/ \u274c\n\n<\/pre><\/div>\n\n\n
      \u8981\u8fd9\u6837\uff1a<\/p>\n\n\n
      \ninclude "pages\/" . $page . ".php";   \/\/ \u2714 \u4e0d\u53ef\u968f\u610f\u8df3\u76ee\u5f55\n\n<\/pre><\/div>\n\n\n
      \n\n\n\n
      \u2714 5.7 \u6743\u9650\u9694\u79bb<\/h1>\n\n\n\n