2010-01-10 │phpwind 7.5 0day漏洞利用 【转】

作者:逍遥乾坤 | 发表时间:2010-01-10 16:19:45 | 分类:网络随笔 | 阅读:47192 | 评论:5132
2010-01-10 15:10
phpwind 7.5 Multiple Include Vulnerabilities

author: 80vul
team:http://www.80vul.com
phpwind 7.5 Multiple Include Vulnerabilities
一.api/class_base.php本地包含漏洞

1.描叙

api/class_base.php文件里callback函数里$mode变量没有过滤导致任意包含本地文件,从而可以执行任意PHP命令.

2. 具体分析

api/class_base.php文件里:

function callback($mode, $method, $params) {
if (!isset($this->classdb[$mode])) {
if (!file_exists(R_P.'api/class_' . $mode . '.php')) {
return new ErrorMsg(API_MODE_NOT_EXISTS, "Class($mode) Not Exists");
}
require_once(R_P.'api/class_' . $mode . '.php'); //这里
$this->classdb[$mode] = new $mode($this);
}
if (!method_exists($this->classdb[$mode], $method)) {
return new ErrorMsg(API_METHOD_NOT_EXISTS, "Method($method of $mode) Not Exists");
}
!is_array($params) && $params = array();
return @call_user_func_array(array(&$this->classdb[$mode], $method), $params);
}

我们继续跟一下具体变量传递的过程. 上面的函数在run()里有调用:

function run($request) {
$request = $this->strips($request);
if (isset($request['type']) && $request['type'] == 'uc') {
$this->type = 'uc';
$this->apikey = $GLOBALS['uc_key'];//注意这个变量也是该漏洞的关键
} else {
$this->type = 'app';
$this->apikey = $GLOBALS['db_siteownerid'];
$this->siteappkey = $GLOBALS['db_siteappkey'];
}
/***
if ($this->type == 'app' && !$GLOBALS['o_appifopen']) {
return new ErrorMsg(API_CLOSED, 'App Closed');
}
***/
ksort($request);
reset($request);
$arg = '';
foreach ($request as $key => $value) {
if ($value && $key != 'sig') {
$arg .= "$key=$value&";
}
}
if (md5($arg . $this->apikey) != $request['sig']) { //注意这个判断,需要绕过它.上面的代码可以看的出来$this->apikey = $GLOBALS['uc_key'],和$request['sig']我们
//都可以控制,那么很容易绕过它
return new ErrorMsg(API_SIGN_ERROR, 'Error Sign');
}
$mode = $request['mode']; //取$mode 没有过滤直接进入下面的callback()
$method = $request['method'];
$params = isset($request['params']) ? unserialize($request['params']) : array();
if (isset($params['appthreads'])) {
if (PHP_VERSION < 5.2) {
require_once(R_P.'api/class_json.php');
$json = new Services_JSON(true);
$params['appthreads'] = $json->decode(@gzuncompress($params['appthreads']));
} else {
$params['appthreads'] = json_decode(@gzuncompress($params['appthreads']),true);
}
}
if ($params && isset($request['charset'])) {
$params = pwConvert($params, $this->charset, $request['charset']);
}
return $this->callback($mode, $method, $params); //调用callback ()
}

我们继续看看run()函数的调用:

在pw_api.php文件里:

$api = new api_client();
$response = $api->run($_POST + $_GET);//直接run了$_POST , $_GET提交的变量.

上面的分析是逆行分析了整个漏洞变量提交的过程,其实我们这个漏洞还包含一次编码与解码的问:require_once(R_P.'api/class_' . $mode . '.php');这个需要绕过魔术引号才可以
包含容易文件.我们注意看run()的第一句

$request = $this->strips($request);

strips()的代码:

function strips($param) {
if (is_array($param)) {
foreach ($param as $key => $value) {
$param[$key] = $this->strips($value);
}
} else {
$param = stripslashes($param); //变量直接使用了stripslashes,那么我们可以直接绕过魔术引号了 :)
}
return $param;
}

3.POC/EXP



4.FIX

由于漏洞信息的外泄,官方针对这个漏洞已经做出了修补:

http://www.phpwind.net/read-htm-tid-914851.html

具体代码:

require_once Pcv(R_P.'api/class_' . $mode . '.php');

function Pcv($filename,$ifcheck=1){
$tmpname = strtolower($filename);
$tmparray = array(' http://',"\0"); //过滤了http:// \0 意思是不让远程 不让截断
$ifcheck && $tmparray[] = '..'; //过滤了.. 意思是不让转跳目录
if (str_replace($tmparray,'',$tmpname)!=$tmpname) {
exit('Forbidden');
}
return $filename;
}

从Pcv()可以看出来phpwind的补丁风格是很猥琐的,单从这个pcv来看 还有很多的逻辑问题,比如http://这个过滤很搞笑,人家就不可以用ftp://? ...


二.apps/share/index.php远程包含漏洞

1.描叙

apps/share/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码

2.具体分析

if ($route == "share") {
require_once $basePath . '/action/m_share.php';
} elseif ($route == "sharelink") {
require_once $basePath . '/action/m_sharelink.php';
}
?>

这个漏洞好象不太需要分析!!!! 我建议写这个代码的人应该扣除年终奖...

3.POC/EXP



4.FIX

已经在这个补丁的同时'修补'了
http://www.phpwind.net/read-htm-tid-914851.html

!function_exists('readover') && exit('Forbidden');
if ($route == "share") {
require_once $basePath . '/action/m_share.php';
} elseif ($route == "sharelink") {
require_once $basePath . '/action/m_sharelink.php';
}
?>

三.apps/groups/index.php远程包含漏洞

1.描叙

apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码

2.具体分析

if ($route == "groups") {
require_once $basePath . '/action/m_groups.php';
} elseif ($route == "group") {
require_once $basePath . '/action/m_group.php';
} elseif ($route == "galbum") {
require_once $basePath . '/action/m_galbum.php';
}


这个漏洞好象不太需要分析!!!! 我建议写这个代码的人应该扣除年终奖...

3.POC/EXP



4.FIX

已经在这个补丁的同时'修补'了
http://www.phpwind.net/read-htm-tid-914851.html

!function_exists('readover') && exit('Forbidden');
if ($route == "groups") {
require_once $basePath . '/action/m_groups.php';
} elseif ($route == "group") {
require_once $basePath . '/action/m_group.php';
} elseif ($route == "galbum") {
require_once $basePath . '/action/m_galbum.php';
}
?>

评论

  • homembt:
  • hm long sleeve polo coach tabby crossbody in colorblock red sox memorial day hat low profile queen mary pandora contemporary sandro celia ruched mini dress jordan red hat for uk
    homembt http://www.homembt.com/(2022-01-28 04:58:27)
  • texhort:
  • bijoux swarovski lunette de soleil ray ban junior bolso chanel rue cambon cowhide loafers zadig et voltaire sac matelass茅 chaussure running tout terrain
    texhort https://www.texhort.com/(2022-01-25 03:28:53)
  • vwww-office:
  • lentes celine mujer bolso iconico chanel maripe pumps cartable petite section personnalis茅 basket de course femme hermes kroko tasche preis
    vwww-office https://www.vwww-office.com/(2022-01-25 03:28:52)
  • esep-portal:
  • literie drap lentillas de colores baratas bolso chanel lona imitacion replay chelsea boots damen sac mac douglas romy bottes tom tailor
    esep-portal https://www.esep-portal.com/(2022-01-25 03:28:52)
  • binyorem:
  • maglia calhanoglu prada mini bag with strap coque rhinoshield samsung galaxy a40 a quel doigt se porte une chevaliere homme lunettes schott bolsas chanel
    binyorem https://www.binyorem.com/(2022-01-25 03:28:30)
  • akbolbelize:
  • sac jester the north face daniel hechter stiefel zara m眉tze louis vuitton backpack nordstrom mo farah sunglasses bolso shopper chanel
    akbolbelize https://www.akbolbelize.com/(2022-01-24 05:20:25)
  • mymandrin:
  • sac a dos padded eastpak lowa gtx herren kinderm眉tze rot etui voyage mm louis vuitton blocking blue light on computer carteras tipo chanel
    mymandrin https://www.mymandrin.com/(2022-01-24 05:20:24)
  • tuffease:
  • pandora vintage fascination ring coque pour iphone 11 violet sac 脿 dos on the road jumping jump shoes roller skates regenhut filz louis vuitton mens tote bag
    tuffease https://www.tuffease.com/(2022-01-24 05:20:23)
  • gfbotanicals:
  • boucheron quatre radiant ring sears eyeglass frames bolso chanel negro clasico air jordan 1 bleu et blanche ibrahimovic trikot ajax oakley prizm deep h2o polarized
    gfbotanicals https://www.gfbotanicals.com/(2022-01-24 05:20:22)
  • fairqqonline:
  • north face windbreaker red prada borsello sac celine classic box bracciale di perle miluna tiffany and co heart tag toggle bracelet coach taylor signature jacquard tote
    fairqqonline https://www.fairqqonline.com/(2022-01-24 03:56:26)
  • ziqiwy:
  • zwart en wit iphone x hoesje vintage giants jersey cascade portfel samsung s9 phone case with card holder micro zak trend 2018 iphone k暖啪e kryt
    ziqiwy https://demo.ziqiwy.com/(2022-01-21 10:02:32)
  • lespitchousvoyagent:
  • five ten maltese falcon mtb spd sneaker modern damen sports iphone xr hoesje nike celtics 12 terry rozier iii green nba swingman icon edition jersey marynarka wojenna torebki for wedding minnie mouse phone case iphone 8 plus
    lespitchousvoyagent https://demo.lespitchousvoyagent.com/(2022-01-21 10:02:03)
  • hamlock3r:
  • mikimoto pearl bracelet smart case battery iphone 11 supreme faux fur north face ray ban herren sonnenbrille schwarz sac celine vintage ikea couette 2 personnes
    hamlock3r https://www.hamlock3r.com/(2022-01-17 05:08:20)
  • hbstimes:
  • coach hallie shoulder bag taupe damen legero schuhe borse love moschino zalando anfibi moda inverno 2021 turquoise necklace vintage carbon fiber case for oneplus 7t
    hbstimes https://www.hbstimes.com/(2022-01-17 05:08:19)
  • restbet481:
  • gesundheits clogs borse donne firmate scarpe mocassino gucci heartbreak necklace case nokia 2 the north face borealis classic backpack in black
    restbet481 https://www.restbet481.com/(2022-01-17 05:08:19)
  • bannersechler:
  • snipes m眉tze louis vuitton speedy 25 ebene ray ban large aviator sunglasses cartera chanel blanca chaussure nike retour vers le futur pro football hall of fame merchandise
    bannersechler https://www.bannersechler.com/(2022-01-09 20:55:53)
  • luststyle:
  • porte carte grise cuir volkswagen bonprix damen pantoletten cap sommer herren damier ebene neverfull mm purple tint glasses bolso chanel vintage
    luststyle https://www.luststyle.com/(2022-01-09 20:55:51)
  • eschoolman:
  • adidas superstar homme amazon new barca jerseys pandora pink pave clip charm coque iphone xr transparente apple sac 脿 main tods on schuhe damen gigasport
    eschoolman https://www.eschoolman.com/(2022-01-09 20:55:50)
  • brickrooftile:
  • costa lenses 580g carteras estilo chanel new balance jaden smith noir bulls 23 jersey pandora reflexions oxidised bracelet coque iphone 12 mini swarovski
    brickrooftile https://www.brickrooftile.com/(2022-01-09 20:55:28)
  • annabelohio:
  • pandora sterling silver bangles moncler jacket fur hood mens moncler with fur mid length night dress jordan 7 svart hvit and rosa pandora open ring rose gold(2022-01-09 14:23:17)
  • smithlevi:
  • open ear audio sunglasses bolsos chanel originales chaussure nike a colorier inter trikot 2020 oakley madman lenses recharge iphone 7
    smithlevi https://www.smithlevi.com/(2022-01-06 14:22:47)
  • innovafeline:
  • oakley ferrari sunglasses coque samsung galaxy a5 2015 sac asos cuir wanderschuhe damen leder anglerhut j盲germeister black earrings lovisa
    innovafeline https://www.innovafeline.com/(2022-01-06 14:22:46)
  • lillyslim:
  • leichte sommerm眉tze herren st raphael bracelet izipizi blue tortoise sunglasses bolso timeless chanel bottines femme yves saint laurent em trikot havertz
    lillyslim https://www.lillyslim.com/(2022-01-06 14:22:24)
  • digpik:
  • amazon magliette personalizzate portacarte prada donna coque de telephone avec chaine collier pierre protectrice lunette fin bolso chanel negro acolchado
    digpik https://www.digpik.com/(2021-12-30 07:24:53)
  • easyriccione:
  • alt herren m眉tze calvin klein double zip crossbody bag clear frame glasses designer bolso chanel 19 chaussure salomon leonis gtx boston celtic uniforms
    easyriccione https://www.easyriccione.com/(2021-12-27 07:27:22)
  • ainhoaart:
  • the north face kappe louis vuitton off white jordan 1 price good sunglasses brands for women bolsa chanel negra original nike react 55 element homme santini rennrad trikot
    ainhoaart https://www.ainhoaart.com/(2021-12-21 17:15:11)
  • utilitiesmanda:
  • heart dangle charm coque dragon ball z iphone 11 asos sac bandouli猫re femme blaue stiefeletten damen caps f眉r pferdeschwanz affordable louis vuitton handbags
    utilitiesmanda https://www.utilitiesmanda.com/(2021-12-21 17:15:10)
  • statencom:
  • printed bias slip dress nike air barrage low 41 pink and white balenciaga sneakers blanc backes david 42 jersey for cheap thomas rawls 34 jersey adidas street football shoes
    statencom http://www.statencom.com/(2021-12-16 00:34:11)
  • alizeblue:
  • une porte carte skechers og 85 damen sonnenm眉tze mit nackenschutz louis vuitton essential trunk dita subsystem bolsa chanel negra clasica
    alizeblue https://www.alizeblue.com/(2021-12-05 21:58:13)
  • obxpubcrawl:
  • louis vuitton phone case for iphone 11 walmart vision eyeglasses bolso de chanel negro birkenstock madrid homme zalando raptors city edition jersey 2020 pandora harru potter
    obxpubcrawl https://www.obxpubcrawl.com/(2021-12-05 21:58:13)
  • ainhoaart:
  • cartera negra chanel 996 new balance homme jacket cowboy pandora shine butterfly ring coque iphone 12 ferrari sacoche kenzo bleu
    ainhoaart https://www.ainhoaart.com/(2021-12-05 21:58:11)
  • thbogota:
  • louis vuitton phone case for iphone 11 walmart vision eyeglasses bolso de chanel negro birkenstock madrid homme zalando raptors city edition jersey 2020 pandora harru potter
    thbogota https://www.thbogota.com/(2021-12-05 21:57:46)
  • reportermilan:
  • iphone 5 cases for kids nodus compact portemonnee under armour phone pouzdro xr velvet ruched 拧aty orlando magic nero graph 59fifty berretto crocs womens leigh suede wedge shootie boot
    reportermilan http://www.reportermilan.net/(2021-11-05 15:08:40)
  • evalempert:
  • donatella a gianni 膷ern谩 拧aty marina militare wide brim cappello lidl mens walking boots magnus midtbo schuhe rubber hoesje for oneplus 6t green bay packers bart starr official nike white limited adult road nfl jersey
    evalempert http://www.evalempert.net/(2021-11-05 15:08:39)
  • rainbowcart:
  • iphone se bts pouzdro milkmaid midi 拧aty miami dolphins 47 nfl kids clean up berretto flogg clogs fila fur stiefel gr眉n magnetic battery hoesje
    rainbowcart http://www.rainbowcart.net/(2021-11-05 15:08:17)
  • tealsolar:
  • limited julius thomas mens jersey jacksonville jaguars 80 lights out black nfl lebron 6 jersey san francisco giants game hat linux man utd sharp away kit derrick henry jersey for cheap nike knit hat brim 6000
    tealsolar http://www.tealsolar.com/(2021-10-31 16:31:36)

发表评论

  • 昵称:
  • 邮箱: (可选,保密)
  • 网址: (可选)
  • QQ: (可选,保密)
  • 内容:
  • 验证码: