DeDeCMS漏洞分析
date
Dec 9, 2021
slug
dedecms-cve-analyse
status
Published
tags
安全研究
PHP安全
Jekyll
summary
最近看到这个cms又爆出漏洞,抓紧分析一下
type
Post
1.首先需要了解一个点,就是这个CMS 使用的是全局覆盖去注册变量的,都会经过
include/common.inc.php
这个文件进行处理,这个文件处理了是否符合php版本,还有一些安全过滤,更重要的是全局的变量注册也是在这个文件里面,这里面所有进来的变量都会经过addslashes的处理,也就是存在引号的内容确实会被转义的,可以调试一下就能发现他的流程,用了递归实现![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F2af1febe-d08a-4d3b-a4f8-d9444ac0e5e1%2FUntitled.png%3Fid%3D769f4adf-47ea-4fa3-a8b7-0b004aa31241%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Dlz_tQPaLNwHvsQlpGShPZ7eifxEmXHH_bXAKZWN0hDA?table=block&id=769f4adf-47ea-4fa3-a8b7-0b004aa31241&cache=v2)
在admin的后台目录里面,是通过包含config.php文件进行鉴权的操作,没有管理员的权限就会直接exit掉
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fd0b3e7ab-ada1-4f9d-87c1-fe62d47d682f%2FUntitled.png%3Fid%3D0930aeae-8b44-47e6-9dbb-cd4023a33693%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Dq46bUSYuarTAz2nFAT45SdgS2WZQcDsS6FTssGvMvp8?table=block&id=0930aeae-8b44-47e6-9dbb-cd4023a33693&cache=v2)
2.数据库语句里面的
#@__myad
,这里的 #@
在执行数据库详细语句的时候会转换成dede
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Ff2271927-7567-4715-b5a8-6c98e82509dd%2FUntitled.png%3Fid%3Dfb97d50f-f80c-44c9-8d6b-3d049f18a5ff%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DMXbzlpPHWEL7DP5OSHqhaPETrvpSYJmHh61M_rflN2Q?table=block&id=fb97d50f-f80c-44c9-8d6b-3d049f18a5ff&cache=v2)
3.整个CMS使用的include/dedesqli.class.php中的CheckSql检查SQL语句
这个CMS很久之前的版本了,之前还是爆出很多后台的漏洞的
历史漏洞
1.后台tpl.php代码执行
tpl.php存在代码执行漏洞,攻击者可利用该漏洞在增加新的标签中上传木马,获取webshell
payload 如下:
/dede/tpl.php?action=savetagfile&filename=mochazz.lib.php&content=<?php phpinfo();?>&token=[你的token值]
观察action是savetagfile的时候存在什么操作,这里有一个文件写的操作,但是前提还得绕过一下csrf的检测,而且filename和content参数都是可控的点,尽管中间进行了一些过滤的操作
stripslashes
函数的处理,只是删除删除由 addslashes()
函数添加的反斜杠,filename必须满足xxx.lib.php的格式![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F54a0a05c-9d2c-4579-946c-db5238583e9d%2FUntitled.png%3Fid%3D760d0093-af72-4815-990f-12b4847025f8%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DISpJdBsvf-zK0mqwPKVcnymT-PugeAhZastcqSxz-Is?table=block&id=760d0093-af72-4815-990f-12b4847025f8&cache=v2)
查看csrf_check这个函数,会根据你提供token与session进行检测,在哪个地方可以获取这个$_SESSION['token']呢,可以搜索功能页面或者全局搜索
$_SESSION['token']
,可以在input标签里面查找到这个值![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Ffb5b7594-668d-4418-909b-5cd468bfaa9a%2FUntitled.png%3Fid%3D3c1ac911-6a29-4f9d-ad49-5fd0c50f2596%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DzasarkOVR7dJ6cvO0G9fLZUaXV4oDtMvaQeyGB6fieE?table=block&id=3c1ac911-6a29-4f9d-ad49-5fd0c50f2596&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F21c482bf-b752-43de-b7e5-efe1e09d849f%2FUntitled.png%3Fid%3Dceed41bf-a601-45c0-92e2-a6440697727f%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DEcUz8NAtqQF5SCVJCw9trxM-S0-8wlvize4PieXoWrg?table=block&id=ceed41bf-a601-45c0-92e2-a6440697727f&cache=v2)
只需要在tpl.php这个页面触发upload操作即可
test.top:8880/dede57/dede/tpl.php?action=upload
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F085145ba-2f3a-4382-bed4-4bda30e5243c%2FUntitled.png%3Fid%3Df4616314-3a72-4dbe-a480-3277e7711f39%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DMYCdAYdp25tskDzPhDyOt0y0yrvFmdiRYEkxqh2JT28?table=block&id=f4616314-3a72-4dbe-a480-3277e7711f39&cache=v2)
接着就是构造filename和content了,成功写入
http://test.top:8880/dede57/dede/tpl.php?action=savetagfile&filename=4me.lib.php&content=<?php phpinfo();?>&token=667cf8f9020f184bd9483d4b97ed3038
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fd073c7b4-3223-40ad-8e1a-6f08ff183aea%2FUntitled.png%3Fid%3Dff8863e0-9f79-44f6-aa12-b214e27fe325%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DPnfj-B3W8fl1rKfwpeBSzvQ8Bad_kgiRUuEWsPowaVI?table=block&id=ff8863e0-9f79-44f6-aa12-b214e27fe325&cache=v2)
2.plus/ad_js.php代码执行
这个页面存在写文件的高危操作,尽管文件名后缀是固定的,但是这里的最后还有一个文件包含的触发点,只要我们可以写入PHP的代码内容即可
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fd8c54cfc-965a-40d7-ab61-e0ef126bf8a2%2FUntitled.png%3Fid%3D31cb6f91-816b-4ab8-9292-72a50910580a%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DgJA6wq1m5RewQzyBOpSbikCJMoosgLSjP4qE0rVx3j0?table=block&id=31cb6f91-816b-4ab8-9292-72a50910580a&cache=v2)
观察到内容变量是从
$adbody
是从数据库里面提取出来的,通过$row = $dsql->GetOne("SELECT * FROM #@__myad WHERE aid='$aid' ");
这个语句获取出来的内容,那么现在就需要寻找一下这个表哪里存在插入的语句,在后台的/ad_add.php:81存在这样的更新SQL语句,所以说这个点还是需要后台的管理员权限操作![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fae4520f9-46a3-4a2b-887d-91127eb625a2%2FUntitled.png%3Fid%3Dde03961e-eeb2-4ac2-a3b0-7848e1f0dfec%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DH8MNxYUNgdiC_96WTDBlQhHTqjThBobNKoberoQ6mU8?table=block&id=de03961e-eeb2-4ac2-a3b0-7848e1f0dfec&cache=v2)
访问一下这个页面,抓个包,这里面,包含了我们的恶意代码,里面tagname对应的就是aid参数
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Ff8a3e013-f797-44a0-b47c-98c113df85d2%2FUntitled.png%3Fid%3D76558637-fead-484d-a56a-0b0e0290ded5%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DXzIJ5m8ESgM1xumak5xIjVIn0dw9lxSbzCfc88chDhA?table=block&id=76558637-fead-484d-a56a-0b0e0290ded5&cache=v2)
插入之后的内容都在这里显示,如果是插入单引号的内容会转义,最好还是不要带上单引号
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F3a3931a0-c96c-4768-b82c-03323b182859%2FUntitled.png%3Fid%3Da04feb12-a147-49a8-8b81-c4cf42355eb3%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Dr0VyPD9b7WadSqsjeapy49dvIghZuVGW0fdObfPjI88?table=block&id=a04feb12-a147-49a8-8b81-c4cf42355eb3&cache=v2)
尝试触发一下漏洞,设置一下$nocache和$aid变量,这里对应的aid为2
test.top:8880/dede57/plus/ad_js.php?nocache=1&aid=2
此时已经写进去了
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F98e5b046-600b-4dd6-931b-8dde9947d84e%2FUntitled.png%3Fid%3D82029ab6-10f0-4df9-b769-24d438456831%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DkEQxM4-cprdUOzwMOvs4TVorKOHjAQwnNvUm-YQioNo?table=block&id=82029ab6-10f0-4df9-b769-24d438456831&cache=v2)
包含调用的话还需要输出闭合HTML注释的内容,不然会输出在注释里,不会在页面展示出来
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Ffaa341e9-f4ba-482e-8f6d-7670e45e204a%2FUntitled.png%3Fid%3De086e003-7d54-439d-a3e8-bf7feb03120e%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DAhuyenUTUHOvskJ47Pib-zWbFEPsyiEYZuQOEEt9Yqk?table=block&id=e086e003-7d54-439d-a3e8-bf7feb03120e&cache=v2)
修改一下就好
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F2419937f-005c-46e4-aa0c-5ad891a8a780%2FUntitled.png%3Fid%3D3cce420d-0dd0-4316-b4cd-b8bea46ea622%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DDAmqmO3F1CNaa0hwXr9nOSkk2jTIcrpmljPHW9wn_H0?table=block&id=3cce420d-0dd0-4316-b4cd-b8bea46ea622&cache=v2)
3.winapi查找后台目录
利用场景:
1、win系统下搭建的网站
2、网站后台目录存在/images/中的一个图片
基础知识
windows环境下查找文件基于Windows FindFirstFile的winapi函数,该函数到一个文件夹(包括子文件夹) 去搜索指定文件。
实际测试中用“<”或者“<<”都可以读到文件名很长的文件,而作者说“<”只能代表一个字符。
主要涉及的文件:
common.inc.php
在涉及到文件上传的参数的时候,会进入到这个文件处理uploadsafe.inc.php
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F86dcd18c-6993-427d-8df7-20f072dbdd89%2FUntitled.png%3Fid%3D3a7cb124-83f3-4661-a851-27acb4f9af85%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DJx3p5GRvrc-NwLduC1sh_MXnLCAdMsyC8z8cyKpBKqw?table=block&id=3a7cb124-83f3-4661-a851-27acb4f9af85&cache=v2)
关注这个文件内容,里面设置了一些不允许上传的文件后缀名,主要关注的点在getimagesize函数,只要有具体的文件内容就可以从里面获取信息,通过回显
Upload filetype not allow !
来判断![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F0327cee7-9556-4f87-94af-c994a4c15c41%2FUntitled.png%3Fid%3Ddef37833-8e08-4b62-aecc-12179af370e4%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DOb_CP5y8H5pWH2T-LwfhcbP310_xui5Y5ClQY3BOASY?table=block&id=def37833-8e08-4b62-aecc-12179af370e4&cache=v2)
首先来试一下这个windows特性,一个或者两个
<
都是可以触发文件包含的准备 test.php和 c4ca4238a0b923820dcc509a6f75849b.php
<?php
$name = $_GET['a'];
include $name;
<?php phpinfo();?>
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fb07152df-131e-4970-81ff-0f3b0e66ed19%2FUntitled.png%3Fid%3Db9f62795-a8ac-4839-80c9-0d2e1c32f2d4%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DoG9kfZLcFYImfs8YsuJmBhDe3tNvgWXd-qbmeCW0q0w?table=block&id=b9f62795-a8ac-4839-80c9-0d2e1c32f2d4&cache=v2)
但是当单独测试一下getimagesize这个函数,当存在的图片,与不存在的图片是什么反应,发现这个trick好像已经用不了了,只有完整路径才可行了
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F55748e65-d6b9-4faa-997c-8f9fced74dcb%2FUntitled.png%3Fid%3D03572d2b-a44f-4ed8-b186-9de3c3e1f399%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DmcfzSaQDsjB6YoWTjOfrdzLfCvwrJcHTCycVIZjpPcM?table=block&id=03572d2b-a44f-4ed8-b186-9de3c3e1f399&cache=v2)
新的漏洞
这个版本的还是使用include/common.inc.php进行全局变量的注册处理
这个作者从source就分析得很仔细,从全局变量注册开始,就注意到这里面全局变量还有$_FILE和$_SERVER的全局变量并没有被过滤掉,所以还能从这两个全局变量入手
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F755f610f-e5c9-4307-9465-9a2570f0cd98%2FUntitled.png%3Fid%3Dd313b4d8-6967-4218-ae84-2ad0192cac39%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3D99JxbsDSH43MJFJFgrPmHNXycL20b3ObC3Oxl8LjItQ?table=block&id=d313b4d8-6967-4218-ae84-2ad0192cac39&cache=v2)
所以这个点会导致一些跳转漏洞和一些反序列化的漏洞,作者认为
include/uploadsafe.inc.php
中处理文件上传内容的地方是存在反序列化风险的(具体就是getimagesize和filesize这两函数),但是找不到gadgets,但是还是可以构造一个DDOS漏洞的,可以参考这一篇文章:https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247485159&idx=1&sn=50b2e94d2d6fc5f69c540113ae9b3f1c&chksm=e89e2e3fdfe9a729869444aa593e97b52970add524b219553f646e8af2aec06e25e8678e7dde&mpshare=1&scene=23&srcid=0822QPN3ZXccNvKuWTQoahLi#rd![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F8b5a525f-1bb8-408b-b2f9-b34efce70dec%2FUntitled.png%3Fid%3D326023fd-b3f5-4ff7-ba37-70ae08638688%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DblOhH-O5JBythJh5zKAsBktWMwgjjEX1CP03MmoH0tA?table=block&id=326023fd-b3f5-4ff7-ba37-70ae08638688&cache=v2)
直接是通过FILES全局变量赋值,上传总是需要设置4个属性,这是上传检测的这份代码写死了的
$keyarr = array('name', 'type', 'tmp_name', 'size');
只要tmp_name属性是一个phar协议的内容,就可以触发反序列化了,这并没有太大危害,作者利用这个点构造新的变量,先是通过
include/common.inc.php
的GET方式处理生成$_FILES全局变量→include/uploadsafe.inc.php
对FILES方式的处理生成对应的具体变量而且利用表单提交的话还可以将绕过这里进入转义的那个过程,因为此时POST变量为空
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F5fa2a283-4744-4756-b3a7-cdbd8c74b673%2FUntitled.png%3Fid%3Dc6a75f9d-a0e3-48a1-8a55-aac02f03aaa0%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Da_aMMqT3g4zv57KdWsxNxhnK6l2IfXMSXp-BBpVcIhk?table=block&id=c6a75f9d-a0e3-48a1-8a55-aac02f03aaa0&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fba6fc61d-abc6-47e0-914b-a39568c9ed31%2FUntitled.png%3Fid%3D985bde3a-55ed-451b-ace3-9c1618c7fa3c%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DoMpM0Hdx_Tlu7Ujiuqm1AHC0qURLbocqXEicpdwFit8?table=block&id=985bde3a-55ed-451b-ace3-9c1618c7fa3c&cache=v2)
先是寻找了SQL注入的利用点
作者以dede/sys_payment.php的页面为例子,想构造pay_name的注入参数,这里巧就巧在这个变量刚好是下划线拼接的name,刚好在这个页面找到对应的这样格式的参数拼接SQL语句,绝了
调试的时候发现已经闭合SQL语句了,但是结果却不能执行
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F223fac09-f413-4f8e-a60c-04df5f354767%2FUntitled.png%3Fid%3D7cd287e1-24de-481b-abc2-ef87366afa0d%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Dor34gNNUEy8g5_jEAcTPeubkwrjgrkVYRrTPVpclVks?table=block&id=7cd287e1-24de-481b-abc2-ef87366afa0d&cache=v2)
这不能执行的原因在于底层做了防护,大多执行语句的函数在
include/dedesqli.class.php
中,其中SetQuery函数会针对SQL语句进行检查,所以这个点的注入不太好使,而且没有报错信息的返回,报错注入也不太管用了![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fcb8541da-eafd-4c25-93c4-cb9c11791aa5%2FUntitled.png%3Fid%3Dbfe1fe97-3a37-492f-9158-8908a15f8007%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DY9vLjJbaE6L_KA-c458YPVxbg6EUUXTtRVd0uPh2IH8?table=block&id=bfe1fe97-3a37-492f-9158-8908a15f8007&cache=v2)
然后作者寻找那些地方使用上了这个CheckSql函数,发现这个页面下存在两个,一个SetQuery一个Execute
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F3c9cdceb-5aa7-422e-bdb8-a936f30d9079%2FUntitled.png%3Fid%3D6646a7ad-9a3d-469b-8708-99f8c051f402%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DUNCJxqtw889XhrtXq-hzwG4VsQ7r29VI7Hw38HmxdxE?table=block&id=6646a7ad-9a3d-469b-8708-99f8c051f402&cache=v2)
再寻找没有使用这两个函数的封装函数,作者找到一个显而易见的点,直接调用SQL语句的mysqli_query函数
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F72aef87a-9b89-47c3-b5e8-d822f81be874%2FUntitled.png%3Fid%3Dacc0c8ea-473b-499e-932c-fcefdacdff0d%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DVjPc119pfvWn1ex7ORx67i8xuJtyzNlUuL6CaYjqtwk?table=block&id=acc0c8ea-473b-499e-932c-fcefdacdff0d&cache=v2)
在dede/sys_data_done.php调用了这个函数,但是此时的sink并没有像pay_name格式这么刚刚好,所以这里会经过
_RunMagicQuotes
这个函数,如果需要引号的内容的话,利用起来还是有点复杂的,但是没有引号的还是可以触发的,但是这个点仍然需要后台权限的校验GET /dede581/dede/sys_data_done.php?dopost=bak&tablearr=1&nowtable=%23@__vote+where+1=sleep(5)--+& HTTP/1.1
Host: test.top:8880
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Edg/91.0.864.37
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=b06759fe80ffe732bb2673f952528fe5; DedeUserID=1; DedeUserID__ckMd5=5b5668983ebc6ea8; DedeLoginTime=1633439876; DedeLoginTime__ckMd5=c5f24efc956c9acb; _csrf_name_5eddc9fb=1421828a04034ee5508ff8b62aa55c8e; _csrf_name_5eddc9fb__ckMd5=2db0863d8f9ae8d7
Connection: close
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Ff7b5bcfb-b579-4c92-9305-291d3bc0eb7e%2FUntitled.png%3Fid%3D9ca93429-7b94-48cc-a33d-dca298927dae%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3Dfq2kAgH96cMpimIriaC5fs-ngJI40OyWiu6deH96Q-Y?table=block&id=9ca93429-7b94-48cc-a33d-dca298927dae&cache=v2)
作者又在include/filter.inc.php这个文件里面找到有趣的东西,就是$magic_quotes_gpc这个变量,这个变量是从配置文件里面读取的,但是这个配置选项早在PHP5.4就被移除了,ini_get获取不到的配置选项的值会返回false
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F140377cc-2d6a-4acd-93e3-92422e09ff34%2FUntitled.png%3Fid%3D36ab6bd3-db45-419d-beb1-93ae83ecee9b%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DVEUj1c5eaoljmDMEl9JGahIByk-cYwtQ1AgEdL8Y0Tc?table=block&id=36ab6bd3-db45-419d-beb1-93ae83ecee9b&cache=v2)
这个地方再一次重新注册全局变量,服了,导致了问题的发生,一开始将$magic_quotes_gpc,设置为1,此时后面重新注册全局变量,导致后面的内容完全就不需要经过转义了,牛逼
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F88f86850-4396-4c66-b165-65c95b6d3c34%2FUntitled.png%3Fid%3Da93a129f-dc4e-4474-9c4f-b8f093756417%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DjlrN_RAeMVhFv89aPRPm4ZNJX6ebBtqp4lNX3SZj7tw?table=block&id=a93a129f-dc4e-4474-9c4f-b8f093756417&cache=v2)
所以到这里的关键点就是找调用了这个文件的地方,作者找到
/plus/bookfeedback.php
无需注册即可使用的点,存在两个可控变量一个catid一个是bookname,发表评论写入内容![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fb84a2791-677e-4f04-a3bf-4342a9358cb4%2FUntitled.png%3Fid%3D1ccc8a6e-ebcf-4ce7-8f27-ad5f64b5f849%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DaOk2Y1JtoocrFAJaRe50kCz-4sIONRbZPHF2ACXd5yo?table=block&id=1ccc8a6e-ebcf-4ce7-8f27-ad5f64b5f849&cache=v2)
POST /dede57/plus/bookfeedback.php?fid=123 HTTP/1.1
Host: test.top:8880
Content-Length: 178
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.top:8880
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Edg/91.0.864.37
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.top:8880/dede57/plus/bookfeedback.php?action=send&fid=1337?action=send&fid=1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=b06759fe80ffe732bb2673f952528fe5; _csrf_name_9461b8a7=67db522c6c5571ed6aba7b9260384952; _csrf_name_9461b8a7__ckMd5=f6c888f6acfb188e
Connection: close
action=send&aid=0&isconfirm=yes&face=6&feedbacktype=feedback&msg=test&username=&pwd=&validate=CSTD&magic_quotes_gpc=1&catid=1',version(),concat('&bookname=')||'s&comtype=comments
本质上触发的也是SQL注入罢了
后续作者关注了DEDECMS的模板,这个模板以前也爆出过漏洞:
主要触发的点在于DedeTagParse类中的Display()方法→GetResult→AssignSysTag→RunPHP ,最终达到执行代码的效果
作者借鉴这个思路(还是不大一样的),找了一个ShowMsg函数,这个函数在最后回用到\DedeTemplate::Display方法,这里面的$gourl参数可以通过
$_SERVER['HTTP_REFERER']
获取,然后LoadString将输入的内容赋值给当前的类变量$this->sourceString
,然后进入Display方法(本质上的调用是在这里的include文件包含),最后会进入到WriteCache,写上缓存文件,其中的WriteCache里面的result是我们写入的HTML内容![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fcafa438f-c4b7-4b52-8a32-d6010ab3f52d%2FUntitled.png%3Fid%3D590e58b0-0a95-4493-8a48-c50392fe419b%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DSwALoT-UFfzhFw1pIgVjusduHQAbEjPmDy3lqwvkEas?table=block&id=590e58b0-0a95-4493-8a48-c50392fe419b&cache=v2)
在这个写入缓存文件的过程中还会有一个危险函数的检测CheckDisabledFunctions,但是可以轻易绕过,原作者用的是
"system"("id")
的形式![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2F1dd12ded-8d92-4631-9ac5-f75fe137bc6c%2FUntitled.png%3Fid%3Db45ae79b-9659-4efc-b060-1e631e0f85bc%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3DVqTeQ3z5HkrbTMU_7iGF8SFe6CpktNlMw6kYU28WGgo?table=block&id=b45ae79b-9659-4efc-b060-1e631e0f85bc&cache=v2)
其实不止这一种的绕过方式
作者最后围绕ShowMsg函数找了一下路由:
/plus/flink.php?dopost=save
/plus/users_products.php?oid=1337
/plus/download.php?aid=1337
/plus/showphoto.php?aid=1337
/plus/users-do.php?fmdo=sendMail
/plus/posttocar.php?id=1337
/plus/vote.php?dopost=view
/plus/carbuyaction.php?do=clickout
/plus/recommend.php
...
直接删掉加载模板的这一块东西
![notion image](https://www.notion.so/image/https%3A%2F%2Ffile.notion.so%2Ff%2Ff%2Fc113620e-b4a6-4a92-bee1-d70b242f1a2f%2Fb9b37215-3e57-408a-b494-a2913b381233%2FUntitled.png%3Fid%3Daf624fb8-69cd-440d-be1f-7f1f678a1df7%26table%3Dblock%26spaceId%3Dc113620e-b4a6-4a92-bee1-d70b242f1a2f%26expirationTimestamp%3D1722146400000%26signature%3D28_AsAQIDmM8jZPreIBLeSYPdH2Yg0XTc5wMkxRPKas?table=block&id=af624fb8-69cd-440d-be1f-7f1f678a1df7&cache=v2)
这个漏洞主要还是在pre版本里面出现
危险点:
1.$_FILES(直接form表单提交形式的话)和 $_SERVER并没有经过转义的过滤,全局注册变量的弊端
2.magic_quotes_gpc在filter.inc.php中的问题(PHP5.4以后不再使用该选项),如果调用了这个文件,会重新进行一次赋值的操作,容易导致SQL注入的产生,只要执行语句中不再重复使用select语句的话可能会触发SQL注入
3.模板处理的危险点
4.后续可已关注的挖掘点:
include/dedetag.class.php
文件里的处理函数,比如SetTemplet第二个参数是string类型的,或者是调用了Display函数的