算利教官價值投資系統 CVE-2024-4577

Vulnerability Overview

ZDID: ZD-2026-00992
發信 Vendor: 系統所有權：弘農企管顧問有限公司 © 2026 i-stock 價值投資系統. All Rights Reserved. 聯絡我 ([email protected])
Title: 算利教官價值投資系統 CVE-2024-4577
Introduction: CVE-2024-4577 裸奔主機我不知道我亂打到的一台主機

處理狀態

目前狀態

公開

Last Update : 2026/09/20

新提交
已審核
已通報
已修補
已複測
公開

處理歷程

2026/08/07 19:47:41 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/07 19:48:19 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/07 20:28:45 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/11 00:38:00 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/11 01:02:04 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/13 16:31:44 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:31:16 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:31:16 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:31:17 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/09/16 16:55:37 : 複測申請中 (由組織帳號更新此狀態)
2026/09/16 19:10:16 : 確認已修補 (由桃園怪人協會幹部之一更新此狀態)
2026/09/20 03:00:09 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2026-00992
通報者：koby12345 (桃園怪人協會幹部之一)
風險：低
類型：使用已知含漏洞之元件 (Using Known Vulnerable Components)

參考資料

系統使用已存在漏洞的元件，攻擊者可以利用該漏洞執行惡意指令，甚至操控系統。

漏洞說明： OWASP - Top 10 - 2017 A9 - Using Components with Known Vulnerabilities
https://www.owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

https://220.132.235.208/

主要還是他的主機暴露在公網上了 https://220.132.235.208/

但他網站本身有防非網域登入時PHP會異常
並且網域本身打不了payload 有防火牆
但他本身的php檔案洩漏了他的網域
可是也很奇怪
nmap https://money-104.com/ 指向的是某防火牆
root@mail:/kok/cron# nmap money-104.com
Starting Nmap 7.80 ( https://nmap.org ) at 2026-08-07 20:25 CST
Nmap scan report for money-104.com (124.150.132.77)
Host is up (0.0046s latency).
Not shown: 894 filtered ports, 97 closed ports
PORT STATE SERVICE

我也很好奇我打的是甚麼https://220.132.235.208/ 可是裡面index.php檔案指向money-104.com

dir D:\xampp\htdocs\index.php

shell> type D:\xampp\htdocs\inc.php
<?php
// 啟動 Session，無 Output 衝突
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
// === 自動網域判斷與資料庫連線適配 ===
$current_host = isset($_SERVER['HTTP_HOST']) ? strtolower($_SERVER['HTTP_HOST']) : '';

if ($current_host === 'i-stock.com.tw' || $current_host === 'www.i-stock.com.tw') {
// 線上正式環境 1
$conn1 = @mysqli_connect("127.0.0.1", "blue2427", "781046istock", "istock");
if (!$conn1) {
die("i-Stock 資料庫連接失敗: " . mysqli_connect_error());
}
mysqli_set_charset($conn1, "utf8mb4");
}
elseif (strpos($current_host, 'money-104.com') !== false) {
// 線上正式環境 2
$conn1 = @mysqli_connect("localhost", "money104_user", "qzT7M1Vkhpr1", "money104_easysto1_stock");
if (!$conn1) {
die("money-104 資料庫連接失敗: " . mysqli_connect_error());
}
mysqli_set_charset($conn1, "utf8mb4");
}
else {
// 本機開發環境 (XAMPP / Localhost)
$conn1 = @mysqli_connect("127.0.0.1", "root", "", "money104_easysto1_stock");

if (!$conn1) {
    $conn1 = @mysqli_connect("127.0.0.1", "blue2427", "781046istock", "istock");
}

if (!$conn1) {
    die("本機資料庫連線失敗，請確認 MySQL 服務已啟動。錯誤: " . mysqli_connect_error());
}

mysqli_set_charset($conn1, "utf8mb4");

}

// Token 單點登入驗證機制
if (isset($_GET['s_token']) && !isset($_SESSION['id']) && ($current_host === 'i-stock.com.tw' || $current_host === 'www.i-stock.com.tw')) {
$secret_key = "My_iStock_Secret_Key_104";

if (function_exists('openssl_decrypt')) {
    $decrypted = openssl_decrypt($_GET['s_token'], 'AES-128-ECB', $secret_key);

    if ($decrypted !== false) {
        $auth_data = json_decode($decrypted, true);

        if ($auth_data && (time() - $auth_data['time']) < 120) {
            $token_username = $auth_data['username'];

            $sso_sql = "SELECT no, session_id FROM member_table WHERE username = ? LIMIT 1";
            $sso_stmt = mysqli_prepare($conn1, $sso_sql);

            if ($sso_stmt) {
                mysqli_stmt_bind_param($sso_stmt, "s", $token_username);
                mysqli_stmt_execute($sso_stmt);
                $sso_res = mysqli_stmt_get_result($sso_stmt);
                $sso_user = mysqli_fetch_assoc($sso_res);
                mysqli_stmt_close($sso_stmt);

                if ($sso_user) {
                    $_SESSION['right'] = $auth_data['right'];
                    $_SESSION['username'] = $auth_data['username'];
                    $_SESSION['id'] = $sso_user['no'];

                    $new_session_id = session_id();
                    $update_session_sql = "UPDATE member_table SET session_id = ? WHERE no = ?";
                    $up_stmt = mysqli_prepare($conn1, $update_session_sql);
                    if ($up_stmt) {
                        mysqli_stmt_bind_param($up_stmt, "si", $new_session_id, $sso_user['no']);
                        mysqli_stmt_execute($up_stmt);
                        mysqli_stmt_close($up_stmt);
                    }

                    $_SESSION['session_id'] = $new_session_id;
                }
            }
        }
    }
}

}

// 防重複登入踢退機制
$current_url = strtolower($_SERVER['PHP_SELF']);

$is_whitelisted_page = (
strpos($current_url, 'index.php') !== false ||
strpos($current_url, 'connect.php') !== false ||
strpos($current_url, 'register.php') !== false ||
strpos($current_url, 'forget_password.php') !== false ||
strpos($current_url, 'order_confirm.php') !== false ||
strpos($current_url, 'ar_crawler') !== false // 爬蟲主程式加入預設白名單
);

if (!$is_whitelisted_page) {
$current_file_name = basename($_SERVER['PHP_SELF']);

$wl_sql = "SELECT id FROM crawler_file_whitelist WHERE file_name = ? AND is_active = 1 LIMIT 1";
$wl_whitelist_stmt = mysqli_prepare($conn1, $wl_sql);

if ($wl_whitelist_stmt) {
    mysqli_stmt_bind_param($wl_whitelist_stmt, "s", $current_file_name);
    mysqli_stmt_execute($wl_whitelist_stmt);
    mysqli_stmt_store_result($wl_whitelist_stmt);

    if (mysqli_stmt_num_rows($wl_whitelist_stmt) > 0) {
        $is_whitelisted_page = true;
    }
    mysqli_stmt_close($wl_whitelist_stmt);
}

}

if (!$is_whitelisted_page) {
if (!isset($_SESSION['id']) || !isset($_SESSION['session_id'])) {
header("Location: index.php");
exit();
}

$user_id = $_SESSION['id'];
$current_session_id = $_SESSION['session_id'];

$check_sql = "SELECT session_id, login_ip FROM member_table WHERE no = ?";
$check_stmt = mysqli_prepare($conn1, $check_sql);

if ($check_stmt) {
    mysqli_stmt_bind_param($check_stmt, "i", $user_id);
    mysqli_stmt_execute($check_stmt);
    $res = mysqli_stmt_get_result($check_stmt);
    $user_data = mysqli_fetch_assoc($res);
    mysqli_stmt_close($check_stmt);

    if ($user_data && $user_data['session_id'] !== $current_session_id) {
        $new_ip = !empty($user_data['login_ip']) ? $user_data['login_ip'] : '未知 IP';

        session_unset();
        session_destroy();

        echo "<script>alert('您的帳號已在其他裝置登入（登入來源 IP: {$new_ip}），您已被迫登出！'); window.location.href='index.php';</script>";
        exit();
    }
}

}
重新看了是測試環境被打
shell> type D:\xampp\htdocs\register_finish.php
<?php
session_start();

// 開啟錯誤回報（除錯階段使用，正式上線可關閉）
// error_reporting(E_ALL);
// ini_set('display_errors', 1);

// 1. 檢查是否有收到 Google 驗證欄位
if (!isset($_POST['g-recaptcha-response']) || empty($_POST['g-recaptcha-response'])) {
echo "<script>
alert('驗證失敗：未收到安全驗證欄位，請回上一頁重試。');
window.history.back();
</script>";
exit();
}

// 2. 設定 reCAPTCHA 金鑰
$secret_key = '6Lfmdh8tAAAAAP_Bf9Ieak0KGOwV762tA5Od7U2I';
$response_key = $_POST['g-recaptcha-response'];
$user_ip = $_SERVER['REMOTE_ADDR'];

// 3. 發送請求至 Google 驗證伺服器
$verify_url = "https://www.google.com/recaptcha/api/siteverify?secret=" . $secret_key . "&response=" . $response_key . "&remoteip=" . $user_ip;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $verify_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // 避免本機 SSL 憑證驗證失敗
$response_data = curl_exec($ch);
curl_close($ch);

$response_result = json_decode($response_data, true);

if (!$response_result['success']) {
echo "<script>
alert('安全驗證不通過（機器人防禦系統攔截），請重新填寫！');
window.history.back();
</script>";
exit();
}

// 4. Email 驗證模式分流檢查
$verify_mode = isset($_POST['verify_mode']) ? $_POST['verify_mode'] : 'code';
$input_address = isset($_POST['address']) ? trim($_POST['address']) : '';

if ($verify_mode === 'double_input') {
$input_address2 = isset($_POST['address2']) ? trim($_POST['address2']) : '';

if (empty($input_address) || empty($input_address2) || $input_address !== $input_address2) {
    echo "<script>
            alert('錯誤：兩次輸入的電子郵件信箱不一致，請返回重新確認！');
            window.history.back();
          </script>";
    exit();
}

} else {
$input_code = isset($_POST['email_code']) ? trim($_POST['email_code']) : '';

if (
    !isset($_SESSION['email_verify_code']) ||
    !isset($_SESSION['email_verify_target']) ||
    $input_address !== $_SESSION['email_verify_target'] ||
    $input_code !== $_SESSION['email_verify_code']
) {
    echo "<script>
            alert('錯誤：電子郵件驗證碼不正確、已過期，或與發送驗證碼的信箱不符！');
            window.history.back();
          </script>";
    exit();
}

unset($_SESSION['email_verify_code']);
unset($_SESSION['email_verify_target']);

}

include("mysql_connect.inc.php");
require_once('./phpmailer/PHPMailerAutoload.php');
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>處理註冊申請</title>
</head>
<body>
<?php
$id = isset($_POST['id']) ? trim($_POST['id']) : '';
$pw = isset($_POST['pw']) ? trim($_POST['pw']) : '';
$pw2 = isset($_POST['pw2']) ? trim($_POST['pw2']) : '';
$telephone = isset($_POST['telephone']) ? trim($_POST['telephone']) : '';
$address = isset($_POST['address']) ? trim($_POST['address']) : '';
$product_classify = isset($_POST['product_classify']) ? trim($_POST['product_classify']) : '';
$other = isset($_POST['other']) ? trim($_POST['other']) : '';
$product_serial = isset($_POST['product_serial']) ? trim($_POST['product_serial']) : '';
$books_id = isset($_POST['books_id']) ? trim($_POST['books_id']) : ''; // 補齊預防未定義錯誤

// 判斷帳號重複性
if (!empty($id)) {
$stmt = mysqli_prepare($conn1, "SELECT username, right FROM member_table WHERE username = ?");
mysqli_stmt_bind_param($stmt, "s", $id);
mysqli_stmt_execute($stmt);
$result_check = mysqli_stmt_get_result($stmt);

if ($info_check = mysqli_fetch_array($result_check)) {
    if (empty($info_check['right'])) {
        echo "帳號已經存在，請耐心等待權限審查，審查後就會開通(不超過24小時)。";
    } else {
        echo "帳號重複，請洽管理員 [email protected]";
    }
    echo '<meta http-equiv="refresh" content="3;url=register.php">';
    exit();
}

}

if ($id != null && $pw != null && $pw2 != null && $pw == $pw2) {
// 使用預備語法預防 SQL 注入與寫入錯誤
$sql = "INSERT INTO member_table (username, password, telephone, address, other, date_line, nick_name, books_id, product_classify, product_serial) VALUES (?, ?, ?, ?, ?, '', '', ?, ?, ?)";

$stmt = mysqli_prepare($conn1, $sql);
mysqli_stmt_bind_param($stmt, "ssssssss", $id, $pw, $telephone, $address, $other, $books_id, $product_classify, $product_serial);

if (mysqli_stmt_execute($stmt)) {
    echo '新增成功！我們將在人工審核後開啟權限，敬請耐心等待。';
    send_notify($id, $other, $address);
    echo '<meta http-equiv="refresh" content="2;url=index.php">';
} else {
    echo '新增失敗：' . mysqli_error($conn1);
    echo '<meta http-equiv="refresh" content="5;url=register.php">';
}

} else {
echo '欄位填寫不完整或密碼不一致！';
echo '<meta http-equiv="refresh" content="2;url=register.php">';
}

// 安全的 Email 格式驗證函式
function isValidEmail($email) {
return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

function send_notify($id, $other, $address) {
$mail = new PHPMailer();
$mail->IsSMTP();
$mail->SMTPAuth = true;
$mail->SMTPSecure = "ssl";
$mail->Host = "smtp.gmail.com";
$mail->Port = 465;
$mail->CharSet = "utf-8";

// SSL 相容設定
$mail->SMTPOptions = array(
    'ssl' => array(
        'verify_peer' => false,
        'verify_peer_name' => false,
        'allow_self_signed' => true
    )
);

$mail->Username = "[email protected]";
$mail->Password = "hxbfdpbzhuejqpfk";
$mail->From = "[email protected]";
$mail->FromName = "楊禮軒";
$mail->Subject = "您好~剛剛有一位使用者 ".$id." 申請 i-stock 帳號";
$mail->Body = "i-stock 通知：<br />一、剛剛有一位使用者 ".$id." 申請 i-stock 權限：".$other."，請立即前往審核。<br />二、系統登入網址：http://money-104.com<br/>";
$mail->IsHTML(true);
$mail->AddAddress("[email protected]");

if (!$mail->Send()) {
    // 可印出 Log 記錄：$mail->ErrorInfo
}

}
?>
</body>
</html>

擷圖

留言討論

聯絡組織

發送私人訊息

您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。

算利教官價值投資系統 CVE-2024-4577 - HITCON ZeroDay

Vulnerability Detail Report