| 订阅 | 在线投稿
分享
 
 
当前位置: 王朝网络 >> perl >> perl jiao ben zhong de yi xie an quan wen ti

perl jiao ben zhong de yi xie an quan wen ti

2008-05-19 06:25:39 编辑來源:互联网 评论
 
 
 
本文为【perl脚本中的一些安全问题】的拼音翻译版
  dui yi zhong bian cheng yu yan er yan , zai she ji zhe zhong yu yan de shi hou , yi ban shi bu hui chan sheng an quan yin huan de , shi shi shang , zhe zhong yin huan shi you cheng xu yuan yin ru de 。 ji hu mei yi zhong bian cheng yu yan dou you yi ding zhe yang de lou dong , zhe zhong lou dong jiang hui zai mou zhong cheng du shang dao zhi bu an quan ruan jian de chan sheng , dan shi yi ge ru ruan jian zheng ti de an quan xing reng ran da bu fen yi lai yu zhe ge ruan jian zhi zao zhe de zhi shi mian 、 li jie neng li he ta de an quan yi shi 。Perl ye you ta an quan shang ling ren dan you de bu fen , ran er da duo shu cheng xu yuan wan quan mei you yi shi dao zhe xie fang mian 。
  zai zhe pian wen zhang li , wo men jiang hui kan yi xia Perl zhong yi xie zui pu bian bei wu yong he hu shi de shu xing 。 wo men jiang hui kan dao ta men de wu yong jiang hui zen yang dui yun xing ta men de xi tong de an quan yi ji ta men de yong hu zao cheng wei xie 。 wo men jiang hui yan shi zen yang ba zhe xie ruo dian wa jue chu lai yi ji ru he qu xiu gai 、 bi mian ta men 。
  yong hu shu ru shang de ruo dian
  Perl jiao ben zhong chan sheng an quan wen ti de yi ge hen da de lai yuan shi mei you jing guo zheng que que ren ( huo gen ben jiu mei you que ren ) de yong hu de shu ru 。 mei ci dang ni de cheng xu yao cong yi ge bu xin ren yong hu na li huo qu shu ru xin xi de shi hou , ji shi cai yong de shi fei zhi jie de fang shi , ni dou ying gai xiao xin 。 ju ge li zi lai shuo ba , ru guo ni zai Perl zhong xie CGI jiao ben , ni yao yu qi dao e yi de yong hu jiang hui fa song gei ni jia de shu ru 。 bu zheng que de yong hu shu ru , ru guo mei you jing guo que ren jiu bei ren ke bing shi yong le , jiang hui dao zhi xu duo fang mian chu cuo 。 zui chang jian he ming xian de cuo wu shi , mei you jing guo que ren jiu qu zhi xing you yong hu zi ding yi shen shu de qi ta cheng xu 。
  syetem() he exec() han shu
  Perl yi neng bei yong zuo yi zhong “ nian he ” yu yan er zhu cheng ―― ta neng gou tong guo ru xia fang shi wan cheng yi ge chu se de gong zuo : zai tiao yong qi ta cheng xu lai wei ta gong zuo de shi hou , tong guo cai ji yi ge cheng xu de shu chu , jiang ta chong xin ge shi cheng yi zhong te ding de fang shi hou chuan di dao qi ta cheng xu de shu ru de fang shi zai xi de xie tiao ta men de yun xing 。 zhe yang ge ge cheng xu jiu neng hen hao de yun xing le 。
  zheng ru Perl fa bu biao yu gao xu wo men de , wo men you bu zhi yi zhong fang fa ke yi zuo tong yang de shi 。 yi zhong zhi xing yi ge wai bu cheng xu he yi ge xi tong ming ling de fang fa shi tong guo tiao yong exec() han shu 。 dang Perl yu dao yi ge exec() yu ju de shi hou , ta shen shi exec() bei tiao yong chu de shen shu , ran hou qi dong yi ge xin de jin cheng lai zhi xing zhe tiao te ding de ming ling 。Perl cong bu hui fan hui kong zhi gei tiao yong exec() de yuan lai de na ge jin cheng 。
  ling yi ge xiang si de han shu shi sys_tem( qu diao "_")()。sys_tem( qu diao "_")() de yun xing fang shi fei chang xiang exec()。 ta men zhi jian de wei yi de da de qu bie shi Perl hui shou xian cong fu jin cheng zhong fen cha chu yi ge zi jin cheng , zi jin cheng zuo wei ti gong gei sys_tem( qu diao "_")() de yi ge shen shu 。 fu jin cheng deng dao zi jin cheng jie shu yun xing hou zai jie zhe yun xing cheng xu de qi yu bu fen 。 wo men jiang hui zai xia mian geng xiang xi de tao lun sys_tem( qu diao "_")() tiao yong , dan zhe xie tao lun da bu fen ye shi yong yu exec()。
  chuan di gei sys_tem( qu diao "_")() de shen shu shi yi ge lie biao ―― lie biao li de di yi ge yuan su shi yao bei zhi xing de zhe ge cheng xu de cheng xu ming , qi ta yuan su shi chuan gei zhe ge cheng xu de shen shu 。 ran er , ru guo zhi you yi ge shen shu de de hua ,sys_tem( qu diao "_")() de zhi xing fang shi hui fa sheng cha yi 。 zai na zhong qing xing xia ,Perl jiang hui sao miao zhe ge shen shu kan ta shi bu shi bao han ren he shell zhuan huan zi fu 。 ru guo you de hua , ta jiu yao ba zhe xie zi fu tong guo shell lai jie shi 。 suo yi chan sheng yi ge shell ming ling xing lai gong zuo 。 bu ran ,Perl hui jiang zi fu chuan chai cheng dan ci ran hou tiao yong xiao lv geng gao de c ku han shu execvp(), zhe ge han shu bu neng li jie te shu de shell zi fu 。
  xian zai jia she wo men you yi zhang CGI biao dan , ta yao xun wen yong hu ming , ran hou xian shi bao han zhe ge yong hu tong ji xin xi de yi ge wen jian 。 wo ming ke yi ru xia shi yong sys_tem( qu diao "_")() lai tiao yong "cat" shi xian na zhong yao qiu :
  sys_tem( qu diao "_") ("cat /usr/stats/$username");
  yong hu ming lai zi zhe yang de yi ge biao dan :
  $username = param ("username");
  . ju ge li zi , dang yong hu zai biao dan li tian shang username = jdimov, ran hou ti jiao hou 。Perl zai zi fu chuan ``cat /usr/stats/jdimov zhong mei you zhao dao ren he zhuan huan zi fu chuang , suo yi ta jiu tiao yong execvp() han shu yun xing ”cat” hou fan hui dao wo men de jiao ben zhong 。 zhe ge jiao ben ye xu kan qi lai mei you hai chu ke yan , dan shi ta rong yi bei yi ge e yi de gong ji zhe suo li yong 。
  wen ti shi zhe yang de , tong guo zai biao dan de ”username” yu nei shi yong te shu de zi fu , yi ge gong ji zhe ke yi tong guo shell lai zhi xing ren he ming ling 。 ju ge li zi , wo men ke yi zhe yang shuo , ru guo gong ji zhe chuan di zhe yang de zi fu chuan "jdimov; cat /etc/passwd",Perl hui ba fen hao dang zuo yi ge zhuan huan zi fu , ran hou ba ta chuan di dao shell zhong :
  cat /usr/stats/jdimov; cat /etc/passwd
  gong ji zhe ji ke yi huo de ya yuan wen jian , you ke yi huo de mi ma wen jian 。 ru guo gong ji zhe xiang yao gao po huai de hua , ta zhi yao fa song "; rm rf /*" jiu ke yi le 。
  wo men zai qian mian ti dao sys_tem( qu diao "_")() you yi ge shen shu biao , bing qie jiang di yi ge yuan su kan zuo ming ling lai zhi xing , er jiang qi yu de yuan su zuo wei shen shu lai chuan di 。 suo yi wo men ke yi shao wei gai bian yi xia wo men de jiao ben , shi zhi you wo men xiang rang zhi xing de cheng xu neng gou bei zhi xing :
  sys_tem( qu diao "_") ("cat", "/usr/stats/$username");
  ji ran wo men fen kai lai zhi ding cheng xu de shen shu , na me shell jiu yong yuan ye bu hui bei tiao yong le 。 suo yi fa song ";rm -rf /*" ye jiu bu hui qi zuo yong le , yin wei gong ji zi fu chuan jiang zhi hui bei jie shi cheng yi ge wen jian ming er yi 。
  zhe zhong fang fa bi dan ge shen shu de ban ben yao hao duo le , yin wei ta bi mian le shi yong shell ming ling , dan shi reng ran you qian zai de que xian 。 te bie de , wo men yao kao lv dao $username de zhi hui bu hui bei li yong chan sheng cheng xu zhong neng bei zhi xing de ruo dian 。 ju li lai shuo , yi ge gong ji zhe reng ran ke yi li yong wo men chong xie de dai ma ban ben , tong guo ba $username she zhi cheng zi fu chuan "././etc/passwd" lai huo de xi tong de mi ma wen jian 。
  shi yong na yang de cheng xu de shi hou hen duo di fang hui chu cuo , ju li lai shuo , yi xie ying yong cheng xu jiang te shu de zi fu xu lie jie shi cheng zhi xing yi tiao shell ming ling de qing qiu 。 yi ge pu bian de wen ti shi you xie ban ben de Unix you jian gong ju dang ta men zai yi ding de shang xia wen bei jing xia kan dao you ”~!…” deng zi fu xu lie de shi hou jiang hui zhi xing yi ge shell ming ling 。 suo yi zai yi ge xiao xi ti zhong de kong bai xing zhong bao han "~!rm -rf *" de yong hu shu ru jiang hui zai mou zhong qing xing xia chan sheng wen ti 。
  zhi yao shi tan ji an quan de , shang mian lun ji system() han shu de ren he nei rong ye shi yong yu exec().
  Open() han shu
  zai Perl zhong open() han shu bei yong lai da kai wen jian 。 zai zui wei chang jian de xing shi zhong , ta shi zhe yang shi yong de :
  open (FILEHANDLE, "filename");
  zhe yang shi yong de shi hou ,"filename” shi yi zhi du fang shi da kai de 。 ru guo ”filename” shi han you ”” biao zhi de qian zhui , na me ta shi wei shu chu er da kai de , bing qie zai wen jian yi jing cun zai de shi hou fu gai yuan wen jian ; ru guo han you ”” qian zhui , na me shi wei zhui jia da kai de ; qian zhui ”
  open (STATFILE, "/usr/stats/$username");
  ran hou wo men cong wen jian zhong du qu dai ma bing xian shi ta 。Perl wen dang gao xu wo men : ru guo wen jian ming shi yi ”│” kai shi de , wen jian ming jiang hui bei jie shi cheng yi ge shu chu guan dao ming ling ; fan zhi , ru guo wen jian ming yi ”│” jie shu de hua , wen jian ming jiang hui bei jie shi cheng jiang rang wo men jin xing shu chu de guan dao 。
  yu shi , zhi yao jia shang yi ge ”│” qian zhui , yong hu jiu ke yi zai /usr/stats mu lu xia yun xing ren he ming ling le 。 xiang hou hui su mu lu de cao zuo neng gou rang yong hu zai zhe ge xi tong li zhi xing ren he cheng xu 。
  yi zhong jie jue zhe ge wen ti da fang fa shi : dui yu ni xiang yao da kai bing xiang qi zhong shu ru de wen jian zong shi yao qiu tong guo jia ”
  you shi wo men que shi yao tiao yong yi ge wai bu de cheng xu , bi ru , wo men xiang yao gai biao wo men de jiao ben wen jian yi rang ta neng gou du qu jiu de chun wen ben wen jian /usr/stats/username, dan shi zai xian shi gei yong hu zhi qian yao xian tong guo yi ge HTML guo lv qi 。 wo men you yi ge ma shang jiu ke yi shi yong de bian li de fang fa lai shi xian zhe ge yi tu 。 yi zhong fang fa ke yi zhe yang zuo :
  open (HTML, "/usr/bin/txt2html /usr/stats/$username│");
  print while ;
  bu xing de shi , zhe yi ran yao tong guo shell ceng 。 ran er wo men ke yi cai yong open() tiao yong de ling yi ge xing shi lai bi mian qian she dao shell:
  open (HTML, "-│")
  or exec ("/usr/bin/txt2html", "/usr/stats/$username");
  print while ;
  dang wo men da kai yi ge guan dao ming ling , huo zhe shi wei le du (“-│”), huo zhe shi wei le xie (”│-“) de shi hou ,Perl zai dang qian jin cheng zhong chan sheng fen zhi , bing qie fan hui zi jin cheng de PID gei fu jin cheng , fan hui 0 gei zi jin cheng 。”or” yu ju yong lai jue ding wo men shi zai fu jin cheng huan shi zai zi jin cheng 。 ru guo wo men zai fu jin cheng ( fan hui zhi wei fei ling ), wo men ji xu zhi xing print() yu ju 。 fou ze wo men zai zi jin cheng zhong , jiu zhi xing txt2html cheng xu , shi yong duo yu yi ge shen shu de exec() de an quan ban ben lai bi mian chuan di ren he ming ling dao shell ceng 。 suo fa sheng de shi , zi jin cheng da ying txt2html chan sheng de STDOUT shu chu , ran hou jiu mo mo de xiao wang le ( ji zhu :exec() cong bu fan hui ), tong shi fu jin cheng cong STDIN zhong du qu jie guo 。 xiang zhe yang de ji shu ke yi bei yong lai tong guo guan dao jiang shu chu shu dao yi ge wai bu cheng xu de ji shu :
  open (PROGRAM, "│-")
  or exec ("/usr/bin/progname", "$userinput");
  print PROGRAM, "This is piped to /usr/bin/progname";
  zai wo men xu yao guan dao de shi hou ,open() de yi shang zhe xie xing shi ying gai zong shi bi zhi jie de guan dao open() ming ling you xian cai yong , yin wei ta men bu tong guo shell ceng 。 xian zai rang wo men she xiang wo men yao jiang jing tai wen ben zhuan hua cheng ge shi hua hen hao de HTML ye mian , bing qie , ji yu fang bian kao lv , yao cun fang zai xian shi zhe xie ye mian de Perl jiao ben xiang tong de mu lu xia 。 na me wo men de open yu ju kan qi lai ke neng shi ru xia xing shi :
  open (STATFILE, "
  dang yong hu tong guo biao dan zhong chuan di username=jdimo de shi hou , jiao ben xian shi jdimov.html。 zhe li reng ran you bei gong ji de ke neng 。 bu tong yu c++ he c ,perl bu yong kong zi jie lai jie shu zi fu chuan , zhe yang de hua zi fu chuan jdimov/”jdimov/lo/bah zai jue da shu c ku tiao yong zhong jie shi wei ”jdimo”, dan shi zai Perl zhong que shi ”jdimov\0blah”。 dang perl chuan di yi ge han kong zi fu de zi fu chuan gei yong c xie de cheng xu de shi hou , zhe ge wen ti jiu tu chu le 。UNIX nei gai yi ji jue da duo shu UNIX he shell dou shi chun c yu yan de 。Perl zi shen ye zhu yao shi qie c bian xie , dang yong hu ru xia tiao yong wo men de jiao ben :
  statscrit.plusername=jdimov/%00
  hui fa sheng shen me ne ? wo men de cheng xu chuan di zi fu chuan ”jdimov/%。html” dao dui ying de xi tong tiao yong li yi da kai ta , dan shi yin wei na xie xi tong tiao yong shi yong c bian xie , jie shou de shi kong zi jie de zi fu chuan fang shi 。 jie guo zen yang ne ? ru guo you wen jian ”jdimov” de hua jiu hui xian shi zhe ge wen jian , ke neng bing mei you zhe ge wen jian , ji shi you ye bu shi hen you yong 。 dan shi ru guo yong "statscript./pusername=statscript。p/%" lai tiao yong jiao ben , hui fa sheng shen me ne ? ru guo jiao ben he wo men de html wen jian zai tong yi ge mu lu xia de hua , zhe yang wo men ke yi yong zhe ge shu ru lai qi pian jiao ben , lai xian shi gei wo men suo you de nei rong 。 zai zhe zhong qing kuang xia huo xu bu shi
  【原文】【汉音对照
 
 
 
 
 
 
 
 
 
日版宠物情人插曲《Winding Road》歌词

日版宠物情人2017的插曲,很带节奏感,日语的,女生唱的。 最后听见是在第8集的时候女主手割伤了,然后男主用嘴帮她吸了一下,插曲就出来了。 歌手:Def...

兄弟共妻,我成了他们夜里的美食

老钟家的两个儿子很特别,就是跟其他的人不太一样,魔一般的执着。兄弟俩都到了要结婚的年龄了,不管自家老爹怎么磨破嘴皮子,兄弟俩说不娶就不娶,老父母为兄弟两操碎了心...

如何磨出破洞牛仔裤?牛仔裤怎么剪破洞?

把牛仔裤磨出有线的破洞 1、具体工具就是磨脚石,下面垫一个硬物,然后用磨脚石一直磨一直磨,到把那块磨薄了,用手撕开就好了。出来的洞啊很自然的。需要猫须的话调几...

我就是扫描下图得到了敬业福和爱国福

先来看下敬业福和爱国福 今年春节,支付宝再次推出了“五福红包”活动,表示要“把欠大家的敬业福都还给大家”。 今天该活动正式启动,和去年一样,需要收集“五福”...

冰箱异味产生的原因和臭味去除的方法

有时候我们打开冰箱就会闻到一股异味,冰箱里的这种异味是因为一些物质发出的气味的混合体,闻起来让人恶心。 产生这些异味的主要原因有以下几点。 1、很多人有这种习...

 
 
   dui yi zhong bian cheng yu yan er yan , zai she ji zhe zhong yu yan de shi hou , yi ban shi bu hui chan sheng an quan yin huan de , shi shi shang , zhe zhong yin huan shi you cheng xu yuan yin ru de 。 ji hu mei yi zhong bian cheng yu yan dou you yi ding zhe yang de lou dong , zhe zhong lou dong jiang hui zai mou zhong cheng du shang dao zhi bu an quan ruan jian de chan sheng , dan shi yi ge ru ruan jian zheng ti de an quan xing reng ran da bu fen yi lai yu zhe ge ruan jian zhi zao zhe de zhi shi mian 、 li jie neng li he ta de an quan yi shi 。Perl ye you ta an quan shang ling ren dan you de bu fen , ran er da duo shu cheng xu yuan wan quan mei you yi shi dao zhe xie fang mian 。    zai zhe pian wen zhang li , wo men jiang hui kan yi xia Perl zhong yi xie zui pu bian bei wu yong he hu shi de shu xing 。 wo men jiang hui kan dao ta men de wu yong jiang hui zen yang dui yun xing ta men de xi tong de an quan yi ji ta men de yong hu zao cheng wei xie 。 wo men jiang hui yan shi zen yang ba zhe xie ruo dian wa jue chu lai yi ji ru he qu xiu gai 、 bi mian ta men 。    yong hu shu ru shang de ruo dian      Perl jiao ben zhong chan sheng an quan wen ti de yi ge hen da de lai yuan shi mei you jing guo zheng que que ren ( huo gen ben jiu mei you que ren ) de yong hu de shu ru 。 mei ci dang ni de cheng xu yao cong yi ge bu xin ren yong hu na li huo qu shu ru xin xi de shi hou , ji shi cai yong de shi fei zhi jie de fang shi , ni dou ying gai xiao xin 。 ju ge li zi lai shuo ba , ru guo ni zai Perl zhong xie CGI jiao ben , ni yao yu qi dao e yi de yong hu jiang hui fa song gei ni jia de shu ru 。 bu zheng que de yong hu shu ru , ru guo mei you jing guo que ren jiu bei ren ke bing shi yong le , jiang hui dao zhi xu duo fang mian chu cuo 。 zui chang jian he ming xian de cuo wu shi , mei you jing guo que ren jiu qu zhi xing you yong hu zi ding yi shen shu de qi ta cheng xu 。   syetem() he exec() han shu      Perl yi neng bei yong zuo yi zhong “ nian he ” yu yan er zhu cheng ―― ta neng gou tong guo ru xia fang shi wan cheng yi ge chu se de gong zuo : zai tiao yong qi ta cheng xu lai wei ta gong zuo de shi hou , tong guo cai ji yi ge cheng xu de shu chu , jiang ta chong xin ge shi cheng yi zhong te ding de fang shi hou chuan di dao qi ta cheng xu de shu ru de fang shi zai xi de xie tiao ta men de yun xing 。 zhe yang ge ge cheng xu jiu neng hen hao de yun xing le 。    zheng ru Perl fa bu biao yu gao xu wo men de , wo men you bu zhi yi zhong fang fa ke yi zuo tong yang de shi 。 yi zhong zhi xing yi ge wai bu cheng xu he yi ge xi tong ming ling de fang fa shi tong guo tiao yong exec() han shu 。 dang Perl yu dao yi ge exec() yu ju de shi hou , ta shen shi exec() bei tiao yong chu de shen shu , ran hou qi dong yi ge xin de jin cheng lai zhi xing zhe tiao te ding de ming ling 。Perl cong bu hui fan hui kong zhi gei tiao yong exec() de yuan lai de na ge jin cheng 。    ling yi ge xiang si de han shu shi sys_tem( qu diao "_")()。sys_tem( qu diao "_")() de yun xing fang shi fei chang xiang exec()。 ta men zhi jian de wei yi de da de qu bie shi Perl hui shou xian cong fu jin cheng zhong fen cha chu yi ge zi jin cheng , zi jin cheng zuo wei ti gong gei sys_tem( qu diao "_")() de yi ge shen shu 。 fu jin cheng deng dao zi jin cheng jie shu yun xing hou zai jie zhe yun xing cheng xu de qi yu bu fen 。 wo men jiang hui zai xia mian geng xiang xi de tao lun sys_tem( qu diao "_")() tiao yong , dan zhe xie tao lun da bu fen ye shi yong yu exec()。    chuan di gei sys_tem( qu diao "_")() de shen shu shi yi ge lie biao ―― lie biao li de di yi ge yuan su shi yao bei zhi xing de zhe ge cheng xu de cheng xu ming , qi ta yuan su shi chuan gei zhe ge cheng xu de shen shu 。 ran er , ru guo zhi you yi ge shen shu de de hua ,sys_tem( qu diao "_")() de zhi xing fang shi hui fa sheng cha yi 。 zai na zhong qing xing xia ,Perl jiang hui sao miao zhe ge shen shu kan ta shi bu shi bao han ren he shell zhuan huan zi fu 。 ru guo you de hua , ta jiu yao ba zhe xie zi fu tong guo shell lai jie shi 。 suo yi chan sheng yi ge shell ming ling xing lai gong zuo 。 bu ran ,Perl hui jiang zi fu chuan chai cheng dan ci ran hou tiao yong xiao lv geng gao de c ku han shu execvp(), zhe ge han shu bu neng li jie te shu de shell zi fu 。    xian zai jia she wo men you yi zhang CGI biao dan , ta yao xun wen yong hu ming , ran hou xian shi bao han zhe ge yong hu tong ji xin xi de yi ge wen jian 。 wo ming ke yi ru xia shi yong sys_tem( qu diao "_")() lai tiao yong "cat" shi xian na zhong yao qiu :   sys_tem( qu diao "_") ("cat /usr/stats/$username");    yong hu ming lai zi zhe yang de yi ge biao dan :      $username = param ("username");   . ju ge li zi , dang yong hu zai biao dan li tian shang username = jdimov, ran hou ti jiao hou 。Perl zai zi fu chuan ``cat /usr/stats/jdimov zhong mei you zhao dao ren he zhuan huan zi fu chuang , suo yi ta jiu tiao yong execvp() han shu yun xing ”cat” hou fan hui dao wo men de jiao ben zhong 。 zhe ge jiao ben ye xu kan qi lai mei you hai chu ke yan , dan shi ta rong yi bei yi ge e yi de gong ji zhe suo li yong 。    wen ti shi zhe yang de , tong guo zai biao dan de ”username” yu nei shi yong te shu de zi fu , yi ge gong ji zhe ke yi tong guo shell lai zhi xing ren he ming ling 。 ju ge li zi , wo men ke yi zhe yang shuo , ru guo gong ji zhe chuan di zhe yang de zi fu chuan "jdimov; cat /etc/passwd",Perl hui ba fen hao dang zuo yi ge zhuan huan zi fu , ran hou ba ta chuan di dao shell zhong :   cat /usr/stats/jdimov; cat /etc/passwd    gong ji zhe ji ke yi huo de ya yuan wen jian , you ke yi huo de mi ma wen jian 。 ru guo gong ji zhe xiang yao gao po huai de hua , ta zhi yao fa song "; rm rf /*" jiu ke yi le 。    wo men zai qian mian ti dao sys_tem( qu diao "_")() you yi ge shen shu biao , bing qie jiang di yi ge yuan su kan zuo ming ling lai zhi xing , er jiang qi yu de yuan su zuo wei shen shu lai chuan di 。 suo yi wo men ke yi shao wei gai bian yi xia wo men de jiao ben , shi zhi you wo men xiang rang zhi xing de cheng xu neng gou bei zhi xing :   sys_tem( qu diao "_") ("cat", "/usr/stats/$username");    ji ran wo men fen kai lai zhi ding cheng xu de shen shu , na me shell jiu yong yuan ye bu hui bei tiao yong le 。 suo yi fa song ";rm -rf /*" ye jiu bu hui qi zuo yong le , yin wei gong ji zi fu chuan jiang zhi hui bei jie shi cheng yi ge wen jian ming er yi 。    zhe zhong fang fa bi dan ge shen shu de ban ben yao hao duo le , yin wei ta bi mian le shi yong shell ming ling , dan shi reng ran you qian zai de que xian 。 te bie de , wo men yao kao lv dao $username de zhi hui bu hui bei li yong chan sheng cheng xu zhong neng bei zhi xing de ruo dian 。 ju li lai shuo , yi ge gong ji zhe reng ran ke yi li yong wo men chong xie de dai ma ban ben , tong guo ba $username she zhi cheng zi fu chuan "././etc/passwd" lai huo de xi tong de mi ma wen jian 。    shi yong na yang de cheng xu de shi hou hen duo di fang hui chu cuo , ju li lai shuo , yi xie ying yong cheng xu jiang te shu de zi fu xu lie jie shi cheng zhi xing yi tiao shell ming ling de qing qiu 。 yi ge pu bian de wen ti shi you xie ban ben de Unix you jian gong ju dang ta men zai yi ding de shang xia wen bei jing xia kan dao you ”~!…” deng zi fu xu lie de shi hou jiang hui zhi xing yi ge shell ming ling 。 suo yi zai yi ge xiao xi ti zhong de kong bai xing zhong bao han "~!rm -rf *" de yong hu shu ru jiang hui zai mou zhong qing xing xia chan sheng wen ti 。    zhi yao shi tan ji an quan de , shang mian lun ji system() han shu de ren he nei rong ye shi yong yu exec().   Open() han shu    zai Perl zhong open() han shu bei yong lai da kai wen jian 。 zai zui wei chang jian de xing shi zhong , ta shi zhe yang shi yong de :   open (FILEHANDLE, "filename");    zhe yang shi yong de shi hou ,"filename” shi yi zhi du fang shi da kai de 。 ru guo ”filename” shi han you ”” biao zhi de qian zhui , na me ta shi wei shu chu er da kai de , bing qie zai wen jian yi jing cun zai de shi hou fu gai yuan wen jian ; ru guo han you ”” qian zhui , na me shi wei zhui jia da kai de ; qian zhui ”   open (STATFILE, "/usr/stats/$username");    ran hou wo men cong wen jian zhong du qu dai ma bing xian shi ta 。Perl wen dang gao xu wo men : ru guo wen jian ming shi yi ”│” kai shi de , wen jian ming jiang hui bei jie shi cheng yi ge shu chu guan dao ming ling ; fan zhi , ru guo wen jian ming yi ”│” jie shu de hua , wen jian ming jiang hui bei jie shi cheng jiang rang wo men jin xing shu chu de guan dao 。    yu shi , zhi yao jia shang yi ge ”│” qian zhui , yong hu jiu ke yi zai /usr/stats mu lu xia yun xing ren he ming ling le 。 xiang hou hui su mu lu de cao zuo neng gou rang yong hu zai zhe ge xi tong li zhi xing ren he cheng xu 。    yi zhong jie jue zhe ge wen ti da fang fa shi : dui yu ni xiang yao da kai bing xiang qi zhong shu ru de wen jian zong shi yao qiu tong guo jia ”    you shi wo men que shi yao tiao yong yi ge wai bu de cheng xu , bi ru , wo men xiang yao gai biao wo men de jiao ben wen jian yi rang ta neng gou du qu jiu de chun wen ben wen jian /usr/stats/username, dan shi zai xian shi gei yong hu zhi qian yao xian tong guo yi ge HTML guo lv qi 。 wo men you yi ge ma shang jiu ke yi shi yong de bian li de fang fa lai shi xian zhe ge yi tu 。 yi zhong fang fa ke yi zhe yang zuo :   open (HTML, "/usr/bin/txt2html /usr/stats/$username│");   print while ;    bu xing de shi , zhe yi ran yao tong guo shell ceng 。 ran er wo men ke yi cai yong open() tiao yong de ling yi ge xing shi lai bi mian qian she dao shell:   open (HTML, "-│")   or exec ("/usr/bin/txt2html", "/usr/stats/$username");   print while ;    dang wo men da kai yi ge guan dao ming ling , huo zhe shi wei le du (“-│”), huo zhe shi wei le xie (”│-“) de shi hou ,Perl zai dang qian jin cheng zhong chan sheng fen zhi , bing qie fan hui zi jin cheng de PID gei fu jin cheng , fan hui 0 gei zi jin cheng 。”or” yu ju yong lai jue ding wo men shi zai fu jin cheng huan shi zai zi jin cheng 。 ru guo wo men zai fu jin cheng ( fan hui zhi wei fei ling ), wo men ji xu zhi xing print() yu ju 。 fou ze wo men zai zi jin cheng zhong , jiu zhi xing txt2html cheng xu , shi yong duo yu yi ge shen shu de exec() de an quan ban ben lai bi mian chuan di ren he ming ling dao shell ceng 。 suo fa sheng de shi , zi jin cheng da ying txt2html chan sheng de STDOUT shu chu , ran hou jiu mo mo de xiao wang le ( ji zhu :exec() cong bu fan hui ), tong shi fu jin cheng cong STDIN zhong du qu jie guo 。 xiang zhe yang de ji shu ke yi bei yong lai tong guo guan dao jiang shu chu shu dao yi ge wai bu cheng xu de ji shu :   open (PROGRAM, "│-")   or exec ("/usr/bin/progname", "$userinput");   print PROGRAM, "This is piped to /usr/bin/progname";    zai wo men xu yao guan dao de shi hou ,open() de yi shang zhe xie xing shi ying gai zong shi bi zhi jie de guan dao open() ming ling you xian cai yong , yin wei ta men bu tong guo shell ceng 。 xian zai rang wo men she xiang wo men yao jiang jing tai wen ben zhuan hua cheng ge shi hua hen hao de HTML ye mian , bing qie , ji yu fang bian kao lv , yao cun fang zai xian shi zhe xie ye mian de Perl jiao ben xiang tong de mu lu xia 。 na me wo men de open yu ju kan qi lai ke neng shi ru xia xing shi :   open (STATFILE, "    dang yong hu tong guo biao dan zhong chuan di username=jdimo de shi hou , jiao ben xian shi jdimov.html。 zhe li reng ran you bei gong ji de ke neng 。 bu tong yu c++ he c ,perl bu yong kong zi jie lai jie shu zi fu chuan , zhe yang de hua zi fu chuan jdimov/”jdimov/lo/bah zai jue da shu c ku tiao yong zhong jie shi wei ”jdimo”, dan shi zai Perl zhong que shi ”jdimov\0blah”。 dang perl chuan di yi ge han kong zi fu de zi fu chuan gei yong c xie de cheng xu de shi hou , zhe ge wen ti jiu tu chu le 。UNIX nei gai yi ji jue da duo shu UNIX he shell dou shi chun c yu yan de 。Perl zi shen ye zhu yao shi qie c bian xie , dang yong hu ru xia tiao yong wo men de jiao ben :   statscrit.plusername=jdimov/%00    hui fa sheng shen me ne ? wo men de cheng xu chuan di zi fu chuan ”jdimov/%。html” dao dui ying de xi tong tiao yong li yi da kai ta , dan shi yin wei na xie xi tong tiao yong shi yong c bian xie , jie shou de shi kong zi jie de zi fu chuan fang shi 。 jie guo zen yang ne ? ru guo you wen jian ”jdimov” de hua jiu hui xian shi zhe ge wen jian , ke neng bing mei you zhe ge wen jian , ji shi you ye bu shi hen you yong 。 dan shi ru guo yong "statscript./pusername=statscript。p/%" lai tiao yong jiao ben , hui fa sheng shen me ne ? ru guo jiao ben he wo men de html wen jian zai tong yi ge mu lu xia de hua , zhe yang wo men ke yi yong zhe ge shu ru lai qi pian jiao ben , lai xian shi gei wo men suo you de nei rong 。 zai zhe zhong qing kuang xia huo xu bu shi   
󰈣󰈤
  免责声明:本文仅代表作者个人观点,与王朝网络无关。王朝网络登载此文出于传递更多信息之目的,并不意味着赞同其观点或证实其描述,其原创性以及文中陈述文字和内容未经本站证实,对本文以及其中全部或者部分内容、文字的真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
清凉一夏_清纯美丽
纯白色小礼服
靓丽可人儿_嘉嘉
我的女神_靓丽女生
主题摄影
贵州,让我欢喜,让我神伤。
莫干山
天平秋色
 
>>返回首页<<
 
 
 为你推荐
 
 
 
 转载本文
 UBB代码 HTML代码
复制到剪贴板...
 
 热帖排行
 
 
 
 
 
©2005- 王朝网络 版权所有