今天发现phpinfo_scanner的一个问题，当遇到证书不匹配等问题就爬不出来，然后我就加了个忽略证书错误。没啥大变动，只是备份一下

    1. #-*- coding:utf-8 -*-
    2. import re
    3. import requests
    4. import sys
    5. from bs4 import BeautifulSoup, element
    6. from tabulate import tabulate
    7. import wcwidth
    8. import pprint
    9. #将重要信息取出，转化为dict
    10. def info_to_dict(html):
    11.     phpinfo_dict = {}
    12.     #基本信息
    13.     phpinfo_dict["Baseinfo"] = {}
    14.     base_info_table = html.select("body > div > table:nth-child(2)")[0] if len(html.select("body > div > table:nth-child(2)")) != 0 else html.select("body > div > table:nth-child(3)")[0]
    15.     for tr in base_info_table.find_all("tr"):
    16.         key   = tr.select("td.e")[0].string.strip()
    17.         value = tr.select("td.v")[0].string.strip()
    18.         phpinfo_dict["Baseinfo"][key] = value
    19.     for h2 in html.find_all("h2"):
    20.         module_name = h2.string.strip()
    21.         phpinfo_dict[module_name] = {}
    22.         #每一个配置模块是从h2标题开始的，向下寻找所有的table标签
    23.         #有一个特殊情况PHP Credits，它在h1标签中，其内容是php及其sapi、module等的作者，对脚本功能没有意义，所以不解析
    24.         for sibling in h2.next_siblings:
    25.             #使用next_siblings会匹配到许多\n \t等，需特殊处理，官方文档明确提到
    26.             if sibling.name != "table" and type(sibling) != element.NavigableString and sibling.name != "br":
    27.                 break
    28.             if sibling.name == "table":
    29.                 for tr in sibling.find_all("tr"):
    30.                     key_elements = tr.select("td.e")
    31.                     if len(key_elements) == 0:
    32.                         continue
    33.                     key = key_elements[0].string.strip()
    34.                     value_elements = tr.select("td.v")
    35.                     if len(value_elements) == 0:
    36.                         value = ''
    37.                     elif len(value_elements) == 2:
    38.                         # 有些配置的value分为Local Value和Master Value
    39.                         # local value是当前目录的设置，会受.htaccess、.user.ini、代码中ini_set()等的影响
    40.                         # master value是php.ini中的值
    41.                         value = [value_elements[0].string.strip(), value_elements[1].string.strip()]
    42.                     else:
    43.                         value = "no value" if value_elements[0].string == None else value_elements[0].string.strip()
    44.                     phpinfo_dict[module_name][key] = value
    46.     #windos _SERVER["xx"]
    47.     #linux $_SERVER['xx']
    48.     #消除这种差异
    49.     php_var_dict = {}
    50.     if list(phpinfo_dict["PHP Variables"].keys())[0][0] == "_":
    51.         for key in phpinfo_dict["PHP Variables"].keys():
    52.             new_key = "$" + key.replace('"', "'")
    53.             php_var_dict[new_key] = phpinfo_dict["PHP Variables"][key]
    54.         phpinfo_dict["PHP Variables"] = php_var_dict
    55.     return phpinfo_dict
    56. #获取关键信息
    57. def get_important_info(phpinfo_dict):
    58.     result = []
    59.     #web目录
    60.     result.append(["Web Path", phpinfo_dict["PHP Variables"]["$_SERVER['SCRIPT_FILENAME']"]])
    61.     #真实ip
    62.     server_ip = phpinfo_dict["PHP Variables"]["$_SERVER['LOCAL_ADDR']"] if "$_SERVER['LOCAL_ADDR']" in phpinfo_dict["PHP Variables"] else phpinfo_dict["PHP Variables"]["$_SERVER['SERVER_ADDR']"]
    63.     result.append(["Server IP", server_ip])
    64.     #中间件
    65.     result.append(["Software", phpinfo_dict["PHP Variables"]["$_SERVER['SERVER_SOFTWARE']"]])
    66.     #php版本
    67.     phpversion = phpinfo_dict["Core"]["PHP Version"]
    68.     result.append(["PHP Version", phpversion])
    69.     #系统信息
    70.     result.append(["System", phpinfo_dict["Baseinfo"]["System"]])
    71.     #SAPI
    72.     result.append(["Server API", phpinfo_dict["Baseinfo"]["Server API"]])
    73.     #Registered PHP Streams
    74.     result.append(["Registered PHP Streams", phpinfo_dict["Baseinfo"]["Registered PHP Streams"]])
    75.     #allow_url_include
    76.     result.append(["Allow Url Include", ", ".join(phpinfo_dict["Core"]["allow_url_include"])])
    77.     #asp_tags
    78.     #php7之后已移除
    79.     if "asp_tags" in phpinfo_dict["Core"]:
    80.         result.append(["Asp Tags", ", ".join(phpinfo_dict["Core"]["asp_tags"])])
    81.     #short_open_tag
    82.     result.append(["Short Open Tag", ", ".join(phpinfo_dict["Core"]["short_open_tag"])])
    83.     #enable_dl
    84.     result.append(["Enable Dl", ", ".join(phpinfo_dict["Core"]["enable_dl"])])
    85.     #open_basedir
    86.     result.append(["Open Basedir", ", ".join(phpinfo_dict["Core"]["open_basedir"])])
    87.     #session
    88.     ser_handler = ",".join(phpinfo_dict["session"]["session.serialize_handler"])
    89.     upload_progress_enabled = ",".join(phpinfo_dict["session"]["session.upload_progress.enabled"])
    90.     upload_progress_cleanup = ",".join(phpinfo_dict["session"]["session.upload_progress.cleanup"])
    91.     upload_progress_name = ",".join(phpinfo_dict["session"]["session.upload_progress.name"])
    92.     session_info = "session.serialize_handler:       %s\nsession.upload_progress.enabled: %s\nsession.upload_progress.cleanup: %s\nsession.upload_progress.name:    %s" % (ser_handler, upload_progress_enabled, upload_progress_cleanup, upload_progress_name)
    93.     result.append(["Session", session_info])
    94.     #curl
    95.     #if  "curl" in phpinfo_dict:
    96.         #result.append(["Curl Protocols", phpinfo_dict["curl"]["Protocols"].replace(" ", "")])
    97.     #libxml
    98.     if "libxml" in phpinfo_dict:
    99.         result.append(["Libxml Version", phpinfo_dict["libxml"]["libXML Compiled Version"]])
    100.     #disable function
    101.     disable_func = phpinfo_dict["Core"]["disable_functions"][0]
    102.     result.append(["Disable Function", disable_func.replace(",", "\n")])
    103.     #extentions
    104.     extentions = ["imagick", "memcache", "redis", "xdebug", "opcache", "imap"]
    105.     exist_ext = []
    106.     for ext in extentions:
    107.         if ext in phpinfo_dict:
    108.             exist_ext.append(ext)
    109.     intresting_exts = "No Intrestring Ext" if len(exist_ext) == 0 else ", ".join(exist_ext)
    110.     result.append(["Extentions", intresting_exts])
    111.     return tabulate(result, tablefmt="psql")
    112. #解析获取到的信息，如bypass_disable_function、php版本特性等
    113. def get_parsed_info(phpinfo_dict):
    114.     result = []
    115.     #php version
    116.     suggestion = get_version_feature(phpinfo_dict["Core"]["PHP Version"])
    117.     if suggestion:
    118.         result.append([suggestion])
    119.     #sapi
    120.     sapi = phpinfo_dict["Baseinfo"]["Server API"]
    121.     if "FPM" in sapi:
    122.         result.append(["SAPI为fpm，可能存在未授权访问漏洞"])
    123.     #phar
    124.     if "phar" in phpinfo_dict["Baseinfo"]["Registered PHP Streams"]:
    125.         result.append(["支持phar协议，可扩展反序列化攻击面"])
    126.     #ssrf curl php_wrapper
    127.     protocols = ["gopher", "dict"]
    128.     available_protocols = []
    129.     if "curl" in phpinfo_dict:
    130.         for protocol in protocols:
    131.             if protocol in phpinfo_dict["curl"]["Protocols"]:
    132.                 available_protocols.append(protocol)
    133.         result.append(["libcurl支持%s协议" % (", ".join(available_protocols))])
    134.     #libxml版本
    135.     if "libxml" in phpinfo_dict and phpinfo_dict["libxml"]["libXML Compiled Version"] < "2.9":
    136.         result.append(["libxml版本 < 2.9 xxe可利用"])
    137.     #session upload progress
    138.     if phpinfo_dict["session"]["session.upload_progress.enabled"][0] == "On":
    139.         suggestion = "可利用session.upload_progress上传临时文件然后包含"
    140.         if phpinfo_dict["session"]["session.upload_progress.cleanup"][0] == "On":
    141.             suggestion += "\n临时文件会立刻删除，需用条件竞争getshell"
    142.         result.append([suggestion])
    143.     #session ser handler
    144.     if phpinfo_dict["session"]["session.serialize_handler"][0] != phpinfo_dict["session"]["session.serialize_handler"][1]:
    145.         result.append(["ser handler不一致，存在反序列化风险"])
    146.     #imagick
    147.     if "imagick" in phpinfo_dict:
    148.         result.append(["可利用imagick相关漏洞"])
    149.     #xdebug
    150.     if "xdebug" in phpinfo_dict and phpinfo_dict["xdebug"]["xdebug.remote_connect_back"][0] == "On" and phpinfo_dict["xdebug"]["xdebug.remote_enable"][0] == "On":
    151.         result.append(["存在xdebug rce https://github.com/vulhub/vulhub/tree/master/php/xdebug-rce\nxdebug idekey: " + phpinfo_dict["xdebug"]["xdebug.idekey"][0]])
    152.     #opcache
    153.     if "opcache" in phpinfo_dict:
    154.         result.append(["可上传opcache覆盖源文件"])
    155.     #imap
    156.     if "imap" in phpinfo_dict:
    157.         result.append(["可能存在imap rce https://github.com/vulhub/vulhub/blob/master/php/CVE-2018-19518/README.md"])
    158.     #disable function
    159.     if phpinfo_dict["Core"]["disable_functions"][0] != "no value":
    160.         result.append([bypass_disable_function(phpinfo_dict["Core"]["disable_functions"][0], phpinfo_dict)])
    161.     return tabulate(result, tablefmt="grid")
    162. #根据版本获取版本特性
    163. def get_version_feature(version):
    164.     suggestion = ""
    165.     if "7.2" in version:
    166.         suggestion = "php 7.2: assert从函数变为语法结构，无法动态调用; 移除create_function"
    167.     if "7.0" in version:
    168.         suggestion = "php 7.0: 移除dl; 不再支持asp_tag、<script language=\"php\">"
    169.     return suggestion
    170. #如果存在disable_function，寻找可能的bypass
    171. def bypass_disable_function(disable_func, phpinfo_dict):
    172.     disable_func = disable_func.split(",")
    173.     suggestion = ""
    174.     bypass_func = []
    175.     if "dl" not in disable_func and phpinfo_dict["Core"]["enable_dl"] == "On":
    176.         bypass_func.append("dl")
    177.     if "pcntl_exec" not in disable_func and "--enable-pcntl" in phpinfo_dict["Baseinfo"]["Configure Command"]:
    178.         bypass_func.append("pcntl_exec")
    179.     common_funcs = ['exec', 'system', 'passthru', 'popen', 'proc_open', 'shell_exec']
    180.     for func in common_funcs:
    181.         if func not in disable_func:
    182.             bypass_func.append(func)
    183.     suggestion += "可用函数：" + ", ".join(bypass_func) + "\n"
    184.     if "Linux" in phpinfo_dict["Baseinfo"]["System"] and "putenv" not in disable_func and "mail" not in disable_func:
    185.         suggestion += "使用LD_PRELOAD https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD\n"
    186.     if "imap" in phpinfo_dict:
    187.         suggestion += "使用imap https://github.com/vulhub/vulhub/blob/master/php/CVE-2018-19518/README.md\n"
    188.     if "imagemagick" in phpinfo_dict:
    189.         suggestion += "使用 ImageMagick\n"
    190.     suggestion += "disable function bypass合集 https://github.com/l3m0n/Bypass_Disable_functions_Shell"
    191.     return suggestion
    192. def parse_phpinfo(url):
    193.     r = requests.get(url,verify=False)
    194.     #print(r.text)
    195.     html = BeautifulSoup(r.text, "lxml")
    196.     phpinfo_dict = info_to_dict(html)
    197.     #pprint.pprint(phpinfo_dict)
    198.     print(get_important_info(phpinfo_dict))
    199.     print(get_parsed_info(phpinfo_dict))
    200. if __name__ == "__main__":
    201.     url = sys.argv[1]
    202.     parse_phpinfo(url)

    requirements.txt文件内容

    requests
bs4
tabulate
wcwidth