Home Backend Development PHP Tutorial phpspy2010 绕过登陆破绽解析

phpspy2010 绕过登陆破绽解析

Jun 13, 2016 am 10:40 AM
admin charset content cookie

phpspy2010 绕过登陆漏洞解析

??? phpspy2010可谓是webshell界很不错的一个工具,但是phpspy2010 和2011相继爆出了绕过认证漏洞,我简单分析下php2010的绕过漏洞,首先据说只有php2010的加密版才有这个漏洞,我大概看了下官方解释,估计也只有加密版才有这个问题,而且看上去应该是个失误。。。

????? 下面具体分析:附件是2010的源代码,由于是加密的eval执行base64解密,

把eval改成echo就可以输出源代码了。

代码核心部分如下

$admin = array();// 是否需要密码验证, true 为需要验证, false 为直接进入.下面选项则无效$admin['check'] = true;// 如果需要密码验证,请修改登陆密码$admin['pass']  = 'f4f068e71e0d87bf0ad51e6214ab84e9'; //angel								//如您对 cookie 作用范围有特殊要求, 或登录不正常, 请修改下面变量, 否则请保持默认// cookie 前缀$admin['cookiepre'] = '';// cookie 作用域$admin['cookiedomain'] = '';// cookie 作用路径$admin['cookiepath'] = '/';// cookie 有效期$admin['cookielife'] = 86400;
Copy after login
error_reporting(7);@set_magic_quotes_runtime(0);ob_start();$mtime = explode(' ', microtime());$starttime = $mtime[1] + $mtime[0];define('SA_ROOT', str_replace('\\', '/', dirname(__FILE__)).'/');define('IS_WIN', DIRECTORY_SEPARATOR == '\\');define('IS_COM', class_exists('COM') ? 1 : 0 );define('IS_GPC', get_magic_quotes_gpc());$dis_func = get_cfg_var('disable_functions');define('IS_PHPINFO', (!eregi("phpinfo",$dis_func)) ? 1 : 0 );@set_time_limit(0);foreach(array('_GET','_POST') as $_request) {	foreach($$_request as $_key => $_value) {		if ($_key{0} != '_') {			if (IS_GPC) {				$_value = s_array($_value);			}			$$_key = $_value;		}	}}//???ò???÷???????????à??!$writabledb && $writabledb = 'php,cgi,pl,asp,inc,js,html,htm,jsp';$charsetdb = array('','armscii8','ascii','big5','binary','cp1250','cp1251','cp1256','cp1257','cp850','cp852','cp866','cp932','dec8','eucjpms','euckr','gb2312','gbk','geostd8','greek','hebrew','hp8','keybcs2','koi8r','koi8u','latin1','latin2','latin5','latin7','macce','macroman','sjis','swe7','tis620','ucs2','ujis','utf8');if ($charset == 'utf8') {	header("content-Type: text/html; charset=utf-8");} elseif ($charset == 'big5') {	header("content-Type: text/html; charset=big5");} elseif ($charset == 'gbk') {	header("content-Type: text/html; charset=gbk");} elseif ($charset == 'latin1') {	header("content-Type: text/html; charset=iso-8859-2");} elseif ($charset == 'euckr') {	header("content-Type: text/html; charset=euc-kr");} elseif ($charset == 'eucjpms') {	header("content-Type: text/html; charset=euc-jp");}$self = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];$timestamp = time();/*===================== ?í·??é?¤ =====================*/if ($action == "logout") {	scookie('loginpass', '', -86400 * 365);	p('<meta http-equiv="refresh" content="1;URL='.$self.'">');	p('<a style="font:12px Verdana" href="'.$self.'">Success</a>');	exit;}if($admin['check']) {	if ($doing == 'login') {		if ($admin['pass'] == md5($password)) {			scookie('loginpass', md5($password));			p('<meta http-equiv="refresh" content="1;URL='.$self.'">');			p('<a style="font:12px Verdana" href="'.$self.'">Success</a>');			exit;		}	}	if ($_COOKIE['loginpass']) {		if ($_COOKIE['loginpass'] != $admin['pass']) {			loginpage();		}	} else {		loginpage();	}}
Copy after login

?

?

这个代码以拥有两个部分,第一个部分就是不加密的部分,这里需要用户填写登录密码,问题就发生在这里,密码存到了

admin['pass']中,而在第二部分解密出来的php代码中,才接受了用户传递过来的参数,这样用户可以自己构造md5加密后的admin['pass'],覆盖掉第一部分定义好的,以及password,从而通过

?

	if ($admin['pass'] == md5($password)) {			scookie('loginpass', md5($password));			p('<meta http-equiv="refresh" content="1;URL='.$self.'">');			p('<a style="font:12px Verdana" href="'.$self.'">Success</a>');			exit;		}
Copy after login

?如图就是修改后的传递参数

?注意admin['pass']是md5加密的。

?

?

?

2011据说也是类似的漏洞,但是我只找到了后来更新过的版本,这个版本中,定义pass的语句下移,放到了


?

foreach($_POST as $key => $value) {	if (IS_GPC) {		$value = s_array($value);	}	$$key = $value;}
Copy after login

?

的后面,从而修正了这个bug。

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Roblox: Bubble Gum Simulator Infinity - How To Get And Use Royal Keys
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Nordhold: Fusion System, Explained
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Mandragora: Whispers Of The Witch Tree - How To Unlock The Grappling Hook
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

Java Tutorial
1664
14
PHP Tutorial
1269
29
C# Tutorial
1249
24
Where are cookies stored? Where are cookies stored? Dec 20, 2023 pm 03:07 PM

Cookies are usually stored in the cookie folder of the browser. Cookie files in the browser are usually stored in binary or SQLite format. If you open the cookie file directly, you may see some garbled or unreadable content, so it is best to use Use the cookie management interface provided by your browser to view and manage cookies.

Where are the cookies on your computer? Where are the cookies on your computer? Dec 22, 2023 pm 03:46 PM

Cookies on your computer are stored in specific locations on your browser, depending on the browser and operating system used: 1. Google Chrome, stored in C:\Users\YourUsername\AppData\Local\Google\Chrome\User Data\Default \Cookies etc.

Where are the mobile cookies? Where are the mobile cookies? Dec 22, 2023 pm 03:40 PM

Cookies on the mobile phone are stored in the browser application of the mobile device: 1. On iOS devices, Cookies are stored in Settings -> Safari -> Advanced -> Website Data of the Safari browser; 2. On Android devices, Cookies Stored in Settings -> Site settings -> Cookies of Chrome browser, etc.

How cookies work How cookies work Sep 20, 2023 pm 05:57 PM

The working principle of cookies involves the server sending cookies, the browser storing cookies, and the browser processing and storing cookies. Detailed introduction: 1. The server sends a cookie, and the server sends an HTTP response header containing the cookie to the browser. This cookie contains some information, such as the user's identity authentication, preferences, or shopping cart contents. After the browser receives this cookie, it will be stored on the user's computer; 2. The browser stores cookies, etc.

What are the dangers of cookie leakage? What are the dangers of cookie leakage? Sep 20, 2023 pm 05:53 PM

The dangers of cookie leakage include theft of personal identity information, tracking of personal online behavior, and account theft. Detailed introduction: 1. Personal identity information is stolen, such as name, email address, phone number, etc. This information may be used by criminals to carry out identity theft, fraud and other illegal activities; 2. Personal online behavior is tracked and analyzed through cookies With the data in the account, criminals can learn about the user's browsing history, shopping preferences, hobbies, etc.; 3. The account is stolen, bypassing login verification, directly accessing the user's account, etc.

Does clearing cookies have any impact? Does clearing cookies have any impact? Sep 20, 2023 pm 06:01 PM

The effects of clearing cookies include resetting personalization settings and preferences, affecting ad experience, and destroying login status and password remembering functions. Detailed introduction: 1. Reset personalized settings and preferences. If cookies are cleared, the shopping cart will be reset to empty and products need to be re-added. Clearing cookies will also cause the login status on social media platforms to be lost, requiring re-adding. Enter your username and password; 2. It affects the advertising experience. If cookies are cleared, the website will not be able to understand our interests and preferences, and will display irrelevant ads, etc.

Detailed explanation of where browser cookies are stored Detailed explanation of where browser cookies are stored Jan 19, 2024 am 09:15 AM

With the popularity of the Internet, we use browsers to surf the Internet have become a way of life. In the daily use of browsers, we often encounter situations where we need to enter account passwords, such as online shopping, social networking, emails, etc. This information needs to be recorded by the browser so that it does not need to be entered again the next time you visit. This is when cookies come in handy. What are cookies? Cookie refers to a small data file sent by the server to the user's browser and stored locally. It contains user behavior of some websites.

How to solve the problem that document.cookie cannot be obtained How to solve the problem that document.cookie cannot be obtained Nov 23, 2023 am 10:02 AM

Solutions for document.cookie not being obtained: 1. Browser privacy settings; 2. Same-origin policy; 3. HTTPOnly Cookie; 4. JavaScript code error; 5. Cookie does not exist or expires; 6. Cross-domain issues; 7. Viewer mode; 8. Server problems; 9. JavaScript execution timing; 10. Check console log, etc.

See all articles