PHP2Shell 在线漏洞检测工具

#!/usr/bin/env bash
# PHP2Shell HTTP observations: 7 sequential requests, no exploit payload.
set -u

URL="${1:-https://example.com/}"
case "$URL" in
  http://*|https://*) ;;
  *) printf 'ERROR=HTTP(S)_URL_REQUIRED\n' >&2; exit 2 ;;
esac

if ! command -v curl >/dev/null 2>&1 || ! command -v awk >/dev/null 2>&1; then
  printf 'ERROR=CURL_AND_AWK_REQUIRED\n' >&2
  exit 127
fi

probe() {
  printf '\n[%s/7] %s %s\n' "$1" "$2" "$3"
  local method="$2"
  shift 3
  curl -q --globoff --proto '=http,https' --silent --show-error \
    --connect-timeout 5 --max-time 15 --request "$method" \
    --dump-header - --output /dev/null \
    --write-out '\nHTTP_CODE=%{http_code} TOTAL_SECONDS=%{time_total}\n' \
    "$@" --url "$URL" |
  awk '{
    sub(/\r$/, "")
    line = tolower($0)
    if ($0 ~ /^HTTP\// || line ~ /^(server|x-powered-by|content-type):/ || $0 ~ /^HTTP_CODE=/) {
      print
    } else if (line ~ /^set-cookie:[ \t]*phpsessid[ \t]*=/) {
      print "PHPSESSID=present; value hidden"
    }
  }'
  local curl_status="${PIPESTATUS[0]}"
  if [ "$curl_status" -ne 0 ]; then
    printf 'CURL_EXIT=%s\n' "$curl_status"
    FAILED=1
  fi
}

FAILED=0
probe 1 GET baseline
probe 2 POST urlencoded --data-raw 'php2shell_check=1'
probe 3 POST multipart --form-string 'php2shell_check=1'
probe 4 PUT urlencoded --data-raw 'php2shell_check=1'
probe 5 PUT multipart --form-string 'php2shell_check=1'
probe 6 PATCH urlencoded --data-raw 'php2shell_check=1'
probe 7 PATCH multipart --form-string 'php2shell_check=1'
exit "$FAILED"